Capturing first-party data like email and phone in a privacy-compliant way is essential for Enhanced Conversions, Meta CAPI, GA4 attribution, and audience building. With Server-Side Tagging in OpenCart, you can securely hash and forward these identifiers without exposing them in the browser.

🧰 Requirements

Tool	Purpose
OpenCart 3.x/4.x	Store with checkout success access
Web + Server GTM Containers	Installed and linked
GA4 / Google Ads / Meta Pixel	Platform integrations
HTTPS Domain	For secure user data transfer
Consent Mechanism	Required for lawful data capture (GDPR/CCPA)

---

🎯 Goal

Securely collect and pass email & phone:

• 🧠 Hashed with SHA-256 before leaving OpenCart
• 🚀 Sent via GTM Web to ssGTM endpoint
• ✅ Delivered to GA4, Google Ads (Enhanced Conversions), Meta CAPI

---

📦 Step 1: Capture Email and Phone on Purchase

In catalog/controller/checkout/success.php:

$order_id = $this->session->data['order_id'];
$this->load->model('checkout/order');
$order_info = $this->model_checkout_order->getOrder($order_id);

$email = strtolower(trim($order_info['email']));
$phone = preg_replace('/\D/', '', $order_info['telephone']);

$data['hashed_email'] = hash('sha256', $email);
$data['hashed_phone'] = hash('sha256', $phone);
$data['event_id'] = uniqid('ss_', true);

---

🧩 Step 2: Push Data to dataLayer (success.twig)

In catalog/view/theme/*/template/checkout/success.twig:

<script>
window.dataLayer = window.dataLayer || [];
dataLayer.push({
  event: "purchase",
  event_id: "{{ event_id }}",
  email: "{{ hashed_email }}",
  phone: "{{ hashed_phone }}"
});
</script>

✅ The dataLayer now holds hashed identifiers and a unique event_id.

---

🛰️ Step 3: Forward Data to Server-Side GTM

In GTM Web Container:

Tag Type: Custom HTML
Trigger: Event equals purchase

<script>
fetch('https://gtm.yoursite.com/event', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    event_name: 'purchase',
    email: '{{DL - email}}',
    phone: '{{DL - phone}}',
    event_id: '{{DL - event_id}}'
  })
});
</script>

---

🧠 Step 4: Setup Clients in Server-Side GTM

Enable these clients:

• GA4 Client – For enhanced attribution
• Google Ads Client – For Enhanced Conversions
• Meta CAPI Client – For matching and optimization

Use event_id, email, phone, and other fields from the request body.

---

🎯 Step 5: Server-Side Tags Configuration

📌GA4 Tag

Parameter	Variable
email	{{email}}
phone	{{phone}}
event_id	{{event_id}}
Event Name	purchase

GA4 does not directly use email/phone yet, but this data can be logged or used for custom endpoints.

---

📌 Google Ads Enhanced Conversions Tag

Parameter	Value
Conversion ID / Label	From Google Ads
Email / Phone	{{email}}, {{phone}} (hashed)
Event ID	{{event_id}}
Event Name	purchase

Google Ads uses hashed values for user matching and deduplication.

---

📌 Meta Conversions API Tag

{
  "event_name": "Purchase",
  "event_time": {{ timestamp }},
  "event_id": "{{event_id}}",
  "user_data": {
    "em": "{{email}}",
    "ph": "{{phone}}"
  },
  "custom_data": {
    "currency": "USD",
    "value": 49.99
  }
}

---

🔐 Step 6: Consent Compliance

Only include email/phone in your dataLayer if consent is granted:

{% if consent_granted %}
<script>
dataLayer.push({
  event: "purchase",
  email: "{{ hashed_email }}",
  phone: "{{ hashed_phone }}",
  event_id: "{{ event_id }}"
});
</script>
{% endif %}

Replace consent_granted with your platform’s consent variable.

---

🧪 Step 7: QA & Validation

Tool	Use
GTM Preview (Web & Server)	Validate email, phone, event_id
GA4 DebugView	Track server events
Google Ads Conversion Diagnostics	Match rate and Enhanced Conversion
Meta Events Manager → Test Events	See hashed PII payloads

---

🧠 Pro Tips

Tip	Why
Always hash on the backend	Protects user data from browser leakage
Deduplicate with event_id	Avoids double counting
Reuse same email for audience match	Helps cross-session attribution
Use logging in ssGTM	Debug data without sending to platforms

---

📊 Example Attribution Path

User completes purchase
 ↓
OpenCart hashes email & phone server-side
 ↓
Pushes to dataLayer with event_id
 ↓
Web GTM sends payload to ssGTM
 ↓
ssGTM sends:
  - GA4 event with ID
  - Google Ads EC with PII
  - Meta CAPI with PII
 ↓
Platforms match user → higher attribution

---