Tracking changelog

All notable changes to slova/module-tracking. Versions follow Semantic Versioning.

1.0.2 — 2026-10-17

Documentation only; no code changes.

• README: new section Returns and cancellations — what triggers a retraction (cancellation, configured statuses, credit memos), why it is exact and never double-counts, how it works with any order-status module, and what it does not cover.

1.0.1 — 2026-10-17

Fixed

• Content Security Policy: analytics-ipv6.tiktokw.us allowed in connect-src. The TikTok Pixel calls it on live sites to add the visitor’s IPv6 address for match quality; on pages that enforce CSP (checkout) the call was blocked.

1.0.0 — 2026-10-17

First release.

Platforms

• Meta — Pixel and Conversions API, deduplicated by event_id.
• Google Analytics 4 — gtag and Measurement Protocol (same client_id and session_id), deduplicated by transaction_id; gross value with shipping and tax.
• Google Ads — conversion with enhanced conversions, identifiers hashed on the server.
• ChatGPT Ads — Measurement Pixel and Conversions API, deduplicated by event_id, amounts in minor units.
• TikTok — Pixel and Events API 2.0, deduplicated by event_id.

Events

• view_item, add_to_wishlist, add_to_cart, begin_checkout, purchase (browser and server) and sign_up.
• Add to cart and add to wishlist are captured on the server from what was actually saved — the chosen variant of a configurable, the bundle, each product of a grouped product — for form posts and AJAX alike, on full-page-cached pages. Events reach the page with the next customer-data load, including partial loads made by themes and AJAX modules.
• sign_up for every account created on the storefront: registration form, login modals, social login, account after checkout.
• refund to GA4 when a reported sale is lost: configured statuses, cancellation, credit memos — once, and only for sales that were reported.

Values

• Ad platforms receive product revenue net of shipping and tax by default (configurable), derived from each order’s own totals.
• Item prices are what the shopper pays: after line discounts, on the same basis as the event value.
• Bundles reported as one product (catalog SKU) or as their components, with the paid amount split across them without losing a cent.
• Brand on every product event, from a configurable attribute (GA4 item_brand, TikTok brand).

Consent and privacy

• Consent sources: Google Consent Mode v2 (any consent platform that sends it), Magento Cookie Restriction Mode, or none; extensible through ConsentSourceInterface.
• Server-side sends obey the same decision as the browser tags.
• Personal data normalized and SHA-256 hashed on the server; phone numbers in E.164 for the EEA, the UK, Switzerland and North America.

Other

• Ad click ids (fbclid, gclid, oppref, ttclid) persisted in durable first-party cookies.
• Third-party scripts start on interaction or after a configurable delay; never delayed on the success page.
• Google Customer Reviews opt-in.
• Strict CSP on checkout supported (every inline script registered).
• English and Romanian admin.
• module:uninstall --remove-data removes the sales_order ledger columns and the module’s settings.