I have been asked by topcashback.com to make purchase tracking cookies ‘strictly necessary’ so tracking is applied regardless of customer consent. There was a recent ICO ruling on this for cash back sites & services, but from what I’ve read (and from AI searches) this is a grey area for advertisers and dropping cookies before consent is more for the publishers themselves.
Does anyone have any experience or advise with regards to this?
Many thanks.
Haven’t seen the ICO ruling you’re referring to, so I’ll stick to the Shopify side.
If that tracking runs as a custom pixel, the toggle already exists. Go to Customer events, open the pixel, and look at the Customer privacy section for Permission. New custom pixels default to requiring Marketing and Analytics, and you can set either one to Not required. Shopify’s pixel manager only loads a pixel when the visitor has granted everything that pixel declares as required, so switching those to Not required is precisely what makes it fire regardless of the banner. There’s a separate Data sale setting alongside it for the opt out case.
The part I’d think about before flipping it is that the declaration lives in your admin, under your account. TopCashback is the one asking, but the record of who classified that tracking as strictly necessary is you.
On the substance, strictly necessary is normally read as necessary for the service the user actually asked for. A member who clicked through from TopCashback did ask for the cashback, so the argument holds up for that visitor. It gets much weaker for a shopper who arrived from Google and has never heard of the cashback site, and a pixel can’t tell those two apart on its own.
That’s the middle ground I’d look at. Fire it unconditionally only when the cashback click ID or referrer is present in the session, and keep it consent gated for everyone else. A bit more work, but it keeps the necessity argument attached to the visitors it actually applies to.
Has TopCashback given you their legal basis in writing, or is this just coming from the account management side?