Privacy Compliant Customer Data Collection: A Guide for E-commerce

In the e-commerce industry, customer data is one of the most valuable resources for improving marketing strategies, understanding user behavior, and increasing sales performance.

When a user visits a product page, adds an item to their cart, begins checkout, or completes a purchase, each action represents an important data point that helps businesses understand the customer journey.

However, collecting more data does not necessarily lead to better decisions.

With regulations such as the General Data Protection Regulation (GDPR), Türkiye's Personal Data Protection Law (KVKK), and other digital privacy requirements, how businesses collect, process, store, and share customer data with third-party platforms has become increasingly important.

Is it possible to measure marketing performance accurately while respecting user privacy?

The answer largely depends on how first-party data strategies, consent management, Google Consent Mode v2, and server-side tracking technologies work together.

Why Do E-commerce Businesses Collect Customer Data?

Before exploring privacy-compliant customer data collection methods, it is important to understand why e-commerce businesses need customer data in the first place.

One of the primary purposes of collecting customer data is to analyze user behavior and improve both the shopping experience and marketing performance.

Understanding User Behavior

Actions performed by users on an e-commerce website represent different stages of the customer journey.

For example, businesses can track the following events through Hardal:

page_view: A user visits a page.
view_item: A user views a product.
add_to_cart: A user adds a product to their shopping cart.
begin_checkout: A user starts the checkout process.
purchase: A user completes a purchase.

By analyzing these events, businesses can identify where users experience difficulties during the shopping journey.

For example, imagine an e-commerce website where 10,000 users visit a product page, 2,000 users add products to their carts, but only 400 users complete a purchase.

This situation indicates that different stages of the purchase journey should be investigated.

These insights allow businesses to analyze product page performance, cart abandonment rates, and potential issues within the checkout process.

Measuring Marketing Performance

E-commerce businesses acquire customers through Google Ads, Meta Ads, organic search, email marketing, and other marketing channels.

Accurate measurement is essential for understanding the contribution of each channel to business performance.

For example:

Which campaigns generate the most purchases?
Which traffic sources have higher conversion rates?
What is the return on ad spend (ROAS)?
Which marketing channels do users interact with before making a purchase?

Answering these questions requires appropriate measurement of customer interactions.

However, the need for accurate measurement does not give businesses unlimited permission to collect user data.

The goal is not to collect as much customer data as possible, but to collect the data necessary for business objectives accurately and lawfully.

What Customer Data Should E-commerce Businesses Collect?

One of the fundamental principles of privacy compliant customer data collection is data minimization.

Data minimization means collecting only the personal data necessary for a specific purpose.

Customer data collected by e-commerce websites can be divided into several categories.

Data Type	Examples	Purpose
Behavioral Data	Page views, product views, add-to-cart events	User behavior analysis
Transactional Data	Order ID, order value, product information	Sales analysis and order management
Customer Information	Email addresses, account details, preferences	Customer support and consent-based communication
Marketing Data	UTM parameters, campaign information	Campaign performance measurement
Technical Data	IP addresses, device and browser information	Security, error analysis, and appropriate measurement

Not all of these data categories carry the same privacy risks.

For example, the category of a purchased product and a customer's email address have different sensitivity levels.

However, behavioral and technical data may also qualify as personal data when they can be linked to an identifiable individual.

Therefore, before creating a tracking event, businesses should ask three important questions:

Why are we collecting this data?
Is this data genuinely necessary?
Do we have an appropriate legal basis for processing this data?

If these questions cannot be answered clearly, the necessity of collecting the data should be reconsidered.

Privacy compliant customer data collection in e-commerce is not only a technical challenge. It also involves legal responsibilities.

Different data protection regulations may apply depending on where a business operates and which customers it serves.

For example:

GDPR: Regulates personal data processing activities that fall within the scope of the regulation, including relevant activities connected to the European Economic Area.
KVKK: Establishes personal data protection obligations in Türkiye.
Cookie and Electronic Communications Regulations: May impose additional requirements when storing information on, or accessing information from, users' devices.

These regulations can directly affect how e-commerce websites use analytics tools, advertising pixels, and customer identification technologies.

No.

For example, an e-commerce business may need to process a customer's delivery address to fulfill an order.

Depending on the applicable law, this processing may rely on a legal basis such as contractual necessity rather than consent.

However, behavioral advertising and measurement activities involving non-essential cookies may require user consent.

For this reason, businesses should distinguish data processing activities according to their purposes.

The following activities should be evaluated separately:

Processing data necessary to complete an order.
Analyzing website performance.
Measuring advertising conversions.
Delivering personalized advertisements.

An important point is that simply displaying a cookie banner does not make a website privacy compliant.

The website's actual data collection behavior must align with the user's consent preferences.

What Happens When Users Reject Cookies?

Imagine a user visiting an e-commerce website for the first time.

A cookie banner appears with the following options:

Accept All
Reject All
Customize Preferences

When users accept all optional cookies, the relevant analytics and advertising technologies may be activated according to the scope of their consent.

But what happens when a user clicks Reject All?

This is where a properly configured Consent Management Platform (CMP) and tracking infrastructure become essential.

Under a basic consent management approach, analytics and advertising tags that require consent should be prevented from operating when the user has not granted the necessary permission.

For example, if a user rejects analytics cookies, a standard analytics implementation should not continue tracking that user as though consent had been granted.

Users should also have the ability to modify their consent preferences or withdraw previously granted consent.

A well designed CMP communicates these preferences to the relevant technologies, helping ensure that data collection activities follow the user's decisions.

Google Consent Mode is a technology that helps Google tags adjust their behavior based on users' consent preferences.

Google Consent Mode v2 includes four important consent parameters.

Consent Parameter	Function
`analytics_storage`	Controls consent for storage used for analytics purposes
`ad_storage`	Controls consent for advertising-related storage
`ad_user_data`	Indicates consent for sending user data to Google for advertising purposes
`ad_personalization`	Indicates consent for personalized advertising

Each parameter can have a value of granted or denied.

For example, a user may accept analytics cookies while rejecting advertising personalization.

In this scenario, the website should not treat all consent categories as a single permission.

Google Consent Mode supports two main implementation approaches.

Basic Consent Mode

In Basic Consent Mode, the relevant Google tags are blocked until the required consent is granted.

If the user does not provide consent, no measurement data is sent through the blocked tags.

Advanced Consent Mode

In Advanced Consent Mode, Google tags may load before a user grants consent.

However, their behavior is restricted according to the user's consent status.

Depending on the implementation, cookieless signals may be sent to Google, potentially contributing to conversion modeling.

However, using Advanced Consent Mode does not automatically mean that the associated data processing activities comply with privacy regulations.

Businesses must evaluate the applicable legal requirements before implementing this approach.

Google Consent Mode is a technical mechanism for communicating user consent preferences to Google technologies. It does not independently ensure GDPR or KVKK compliance.

One of the major challenges in privacy-focused marketing measurement is data completeness.

Suppose an e-commerce business reports the following results during a specific period:

Metric	Value
Backend Orders	1,000
Purchase Events	780
Difference	220
Measurement-to-Backend Ratio	78%

These values are provided for illustrative purposes.

This example shows a difference of 220 orders between the backend system and a hypothetical measurement platform called X.

But does this mean that all 220 missing purchases are caused by users rejecting cookies?

Not necessarily.

Differences between measurement platform X and backend data may result from several factors:

Users not granting analytics consent.
Ad blocker usage.
Browser restrictions.
Network issues.
Incorrect tracking implementations.
Missing or duplicate purchase events.
Differences in reporting and data processing.

Therefore, analysts should not automatically attribute every missing purchase in platform X to consent restrictions.

One metric that can help evaluate measurement quality is the Purchase Measurement Ratio.

Purchase Measurement Ratio = (X Purchases / Backend Orders) × 100

This ratio can be used to monitor the consistency of a measurement system over time.

However, it should not be treated as a definitive indicator of data accuracy.

Canceled orders, refunds, time zone differences, and transaction ID inconsistencies must also be considered.

The goal is to understand the limitations of privacy-aware measurement and distinguish consent-related data gaps from technical tracking problems.

Why Is First-Party Data Becoming More Important?

One approach e-commerce businesses can adopt to reduce their dependency on third-party data sources is building a strong first-party data strategy.

First-party data refers to information that a business collects directly through its own digital channels and customer touchpoints.

Examples include:

Customer purchase history.
Customer account information.
Consent-based newsletter subscriptions.
Preferences voluntarily shared by customers.
Product interactions collected under an appropriate legal basis.
Information generated through customer support interactions.

This data is valuable for understanding customer behavior and developing more sustainable marketing strategies.

For example, an e-commerce business can analyze its own order data to calculate repeat purchase rates.

This allows the business to evaluate customer loyalty or explore purchasing relationships between different product categories.

However, there is an important distinction:

Using first-party data does not automatically mean that the data has been collected in compliance with privacy regulations.

Data collected directly from customers is still subject to requirements involving transparency, data minimization, security, retention periods, and appropriate legal bases.

The Role of Server-Side Tracking in Privacy Compliant Data Collection

In traditional client-side tracking, technologies such as Google Analytics, Google Ads, and Meta Pixel collect data primarily through JavaScript code running in the user's browser.

In this architecture, the user's browser may communicate directly with multiple third-party analytics and advertising platforms.

Server-side tracking introduces an additional layer of control over the data flow.

For example, when using Server-Side Google Tag Manager (sGTM), appropriately collected measurement data can first be sent to a server container controlled by the business.

The data can then be processed and forwarded to relevant analytics or advertising platforms.

Client-Side Tracking

User Browser
    ↓
Google Analytics / Google Ads / Meta

Server-Side Tracking

User Browser
    ↓
First-Party Endpoint
    ↓
Server-Side GTM
    ↓
Analytics / Advertising Platforms

The primary difference between these architectures is that server-side tracking provides businesses with additional control over how data is processed and shared.

1. Controlling Which Data Is Shared

One of the key advantages of server-side tracking is the ability to inspect and control data before it is sent to third-party platforms.

For example, imagine a purchase event containing the following information:

Transaction ID
Purchase Value
Currency
Product Information
Customer Identifier

With a server-side tracking infrastructure, businesses can remove or transform parameters that are unnecessary for a particular purpose.

This allows businesses to share only the information required by the receiving platform for the intended use case.

This approach supports the principle of data minimization.

However, removing an email address does not mean that the remaining event data becomes completely anonymous.

IP addresses, cookie identifiers, and other customer identifiers must also be evaluated.

Server-side tracking can provide an additional opportunity to verify user consent before forwarding data to external platforms.

For example, a user may complete a purchase without granting the consent required for advertising measurement.

In this case, the order may still need to be recorded and processed within the business's backend system.

However, sending the same order data to advertising platforms may be subject to different legal requirements.

Rules configured in Server-Side GTM can help determine which platforms are allowed to receive an event.

For example:

Relevant data can be sent to analytics destinations when the required permissions are available.
Advertising data transfers can be blocked when the necessary permissions are missing.
Unnecessary customer identifiers can be removed from events before transmission.

These controls can strengthen privacy-focused data governance.

However, server-side consent validation does not replace consent management within the user's browser.

3. Improving Data Quality

Server-side tracking can also support event processing and data quality.

Before forwarding a purchase event to a destination platform, businesses can perform several checks:

Is the transaction_id present?
Does value have the correct data type?
Is the currency parameter included?
Are product parameters formatted correctly?
Does the event meet the necessary conditions for delivery to the destination platform?

These validation steps can help reduce certain implementation errors.

However, server-side tracking does not automatically recover data that was never collected because the user did not provide the required consent.

4. Supporting Website Performance

Websites using client-side tracking may load multiple third-party JavaScript scripts.

Moving some measurement processes to the server side can reduce the processing workload in the user's browser.

With an appropriately designed architecture, this may contribute to better website performance.

Reducing unnecessary script execution can be especially beneficial on product pages and during checkout, where user experience plays an important role.

However, actual performance improvements depend on the integrations and technical implementation.

Not by itself.

A common misconception about server-side tracking is that sending data through a first-party server automatically solves all privacy-related challenges.

In reality, server-side tracking does not make personal data collection lawful when the necessary legal basis or consent is missing.

Similarly, hashing customer information does not automatically make that information anonymous.

Therefore, server-side tracking should be viewed not as a way to bypass privacy requirements, but as a technology that enables businesses to manage data flows with greater control.

Privacy Compliant Customer Data Collection: A Guide for E-commerce

Related articles