Consent

Consent works in two layers. Yours, which Luria needs before it reads anything from your store. And your visitors', which Luria needs in the regions where the law requires it.

What you'll need

• On Shopify: the Luria app open inside your Shopify admin.
• On a script install: nothing. The snippet handles visitor consent by itself.
• A private browser window, if you want to see what a visitor sees.

Layer 1: your consent

Open Luria in your Shopify admin. The "One-time permission" card explains what Luria processes and links to the Terms and the Data Processing summary. Click Agree & start syncing.

This layer is blocking. Until you accept, Luria syncs no store data and the engine does not serve variants. Luria records which version of the terms you accepted, when, from which staff account, and from which IP address. Acceptance has to come from a real admin session inside your Shopify admin, so nobody can accept on your behalf.

If the terms are ever updated, the card comes back asking you to agree to the updated terms.

Layer 2: your visitors' consent

Three checks happen in the visitor's browser, in this order.

1. Global Privacy Control and Do Not Track. If the browser sends either signal, Luria collects nothing at all. No visitor id is created, no events are sent, no variant is applied. The page renders normally.
2. Region check. Otherwise the snippet asks Luria once whether this visitor's region requires opt-in. The EEA, the UK and Switzerland do. If the country cannot be determined, Luria treats it as required. Nothing has been tracked at this point.
3. The banner. Where consent is required, the snippet shows its own small bar at the bottom of the page: "We use analytics to measure and improve this site. May we?" with Accept and Decline. Declining is one click, exactly like accepting. Nothing is tracked until the visitor chooses, and the answer is remembered in their browser so they are only asked once.

Where consent is not required, tracking starts on the first pageview.

The snippet does not read a third-party consent platform. It asks on its own, where it has to.

On Shopify stores running Luria's variant engine, visitor consent comes from your store's own Customer Privacy settings instead of Luria's banner. Keeping one visitor on the same variant is treated as functional and runs in every consent state; the marketing extras wait for consent.

Your own privacy policy

You are the controller of your visitors' data. Getting their consent, and disclosing that a service provider runs analytics and testing for you, is your responsibility. The Luria app has an "Add to your privacy policy" card with paste-ready wording for it.

Verify it worked

• Shopify: the Status card shows Data agreement accepted, with a version.
• Turn Global Privacy Control on in a test browser and load your site. No luria_sid key should appear in that site's localStorage.
• Load your site from a consent-required region. The banner should appear, and nothing should be sent to luriart.com until you click.

Common failures

• Nothing is tracked at all. Global Privacy Control or Do Not Track is on in your test browser, or you clicked Decline earlier. Clear the luria_consent key for the site and retest with those signals off.
• The engine never starts on Shopify. The Data Processing Terms are not approved. Open the Luria app and click Agree & start syncing.
• The banner appears when you did not expect it. Luria fails closed when it cannot tell the country, which a VPN or an unusual proxy will cause.
• You already run your own consent banner. On a script install, Luria's banner is separate and asks independently. On Shopify with the variant engine, your store's Customer Privacy settings govern instead.

Next steps

• What Luria stores
• Deletion and the DPA
• Security
• Snippet not firing