Privacy & GDPR

UTM Manager is designed so that tracking campaign performance doesn’t mean surveilling your visitors.

What is stored — and what isn’t

Data	Stored?	Notes
Raw IP address	Never	Only a salted SHA-256 hash is kept, and even that can be disabled
Visitor identifier	Yes	A random first-party UUID — carries no personal information by itself
Email / user ID	Only for logged-in users	Attached to the lead when the visitor has a WordPress account
UTM parameters	Yes	The campaign values from your own URLs
Pages visited	Yes	URL, title, referrer, and timestamp per view
Third-party cookies	Never	Only the first-party utmm_vid cookie + localStorage
Data sent off-site	Never	Everything lives in your own WordPress database

About the IP hash

When a visit is recorded, the visitor’s IP is hashed with SHA-256 using a site-specific salt. That means:

• The original IP cannot be recovered from the stored hash.
• Hashes cannot be correlated across different websites (each site’s salt differs).
• The hash is never used to identify or deduplicate leads — that’s what the random visitor ID is for.

To store nothing at all, disable IP hashing entirely:

add_filter( 'utmm_store_ip', '__return_false' );

Consent gating

If your privacy policy requires consent before analytics cookies are set, gate the tracker with the utmm_enable_tracking filter. When it returns false, the tracking script is not loaded at all — no cookie, no beacon, no data.

// Example: only track when your consent plugin reports analytics consent.
add_filter( 'utmm_enable_tracking', function ( $enabled ) {
    if ( function_exists( 'my_consent_plugin_has_consent' ) ) {
        return my_consent_plugin_has_consent( 'analytics' );
    }
    return $enabled;
} );

The same filter is handy for excluding logged-in administrators from your stats:

add_filter( 'utmm_enable_tracking', function ( $enabled ) {
    return current_user_can( 'manage_options' ) ? false : $enabled;
} );

The visitor cookie

• Name: utmm_vid
• Content: a random UUID (e.g. 2f1d0a4e-...) — no personal data
• Type: first-party, SameSite=Lax, Secure on HTTPS sites
• Lifetime: 365 days (also mirrored in localStorage)

Declare it in your cookie policy as a first-party analytics/attribution cookie.

Data deletion

• Individual or bulk lead deletion (including all visit history) from the Leads screen.
• Deleting the plugin removes all plugin data: tables, options, and legacy records.

Privacy controls without code (Pro)

UTM Manager Pro puts everything above behind checkboxes at UTM Manager → Settings → Pro Settings → Privacy & Data Controls (GDPR):

• Store IP address — untick to stop storing any IP-derived data, the UI equivalent of the utmm_store_ip filter.
• Require consent — track only once a consent cookie is present. Enter the cookie name your banner sets (default utmm_consent); the values yes, 1, true, allow, and granted are treated as consent. This wires the consent gate to CookieYes, Complianz, or any other banner without writing a filter.
• Data retention (days) — a daily job permanently deletes leads not seen within the window, along with their visits and enrichment data. 0 keeps everything forever. This is the simplest way to honor a documented retention policy.
• Exclude roles — never track logged-in users in the roles you tick.

Pro also records country (only from a header your host or CDN already sets — no external lookup) and device / browser / OS parsed locally from the user agent. Both are optional and can be switched off under Geolocation & Device. If you enable them, mention the country and device data in your privacy policy alongside the cookie.

Your responsibilities

UTM Manager gives you privacy-preserving defaults, but compliance depends on your site as a whole. We recommend: disclosing UTM/attribution tracking and the utmm_vid cookie in your privacy policy, wiring the consent gate if your jurisdiction requires prior consent, and honoring deletion requests using the lead delete tools.