In a privacy-first digital world, first-party data such as email and phone number are critical for accurate ad attribution, audience building, and conversion tracking—especially for Meta CAPI, Google Ads Enhanced Conversions, and server-side GA4.

✅ Why Capture First-Party Identifiers?

Purpose	Benefit
Meta CAPI Matching	Increases match quality and conversion attribution
Google Ads Enhanced Conversions	Helps match conversions to ads without relying on cookies
Cross-device tracking	Powers persistent user identity across devices
Compliance	You control how and where data flows

---

🧰 Prerequisites

• OpenCart v3.x or v4.x with checkout customization access
• Google Tag Manager Web + Server-Side containers deployed
• Domain mapped for ssGTM (e.g., gtm.yoursite.com)
• Basic consent mechanism (CMP or manual logic)
• Google Ads & Meta Pixel Conversion setup

---

🚀 Step-by-Step Implementation

---

🔹 Step 1: Extract Email & Phone After Checkout

Edit catalog/controller/checkout/success.php and extract order data:

$order_id = $this->session->data['order_id'];
$order_info = $this->model_checkout_order->getOrder($order_id);

// Sanitize and hash
$email_clean = strtolower(trim($order_info['email']));
$phone_clean = preg_replace('/\D/', '', $order_info['telephone']);

$email_hashed = hash('sha256', $email_clean);
$phone_hashed = hash('sha256', $phone_clean);

✅ This hashes PII before any browser exposure.

---

🔹 Step 2: Inject Hashed Data into success.twig

Pass hashed values to the template:

$data['user_hash_data'] = json_encode([
  'email' => $email_hashed,
  'phone' => $phone_hashed,
  'event_id' => uniqid('purchase_', true)
]);

In success.twig, push to the dataLayer:

{% if user_hash_data %}
<script>
window.dataLayer = window.dataLayer || [];
dataLayer.push({
  event: 'purchase',
  user_data: {{ user_hash_data|raw }},
  ecommerce: {
    transaction_id: '{{ order_id }}',
    value: '{{ total }}',
    currency: '{{ currency }}'
  }
});
</script>
{% endif %}

✅ At this point, your GTM Web Container can access user_data.email and user_data.phone.

---

🔹 Step 3: Create GA4 and Ads Tags in Web GTM

Create GA4 Event Tag

• Event Name: purchase
• Parameters:
  • transaction_id, value, currency
  • Custom parameter: user_data_email, user_data_phone (if passing to GA4 directly)

✅ More often, you’ll pass these directly to Server GTM, not GA4.

Trigger: Custom Event = purchase

---

🔹 Step 4: Send Data to Server-Side GTM

In GA4 Event Tag (Web), set:

Field Name	Value
transport_url	https://gtm.yoursite.com

✅ This routes your purchase event and associated user_data to the server.

---

🔹 Step 5: Handle Data in Server-Side GTM

1. Create Variables:

• Event Data → user_data.email
• Event Data → user_data.phone
• Event Data → ecommerce.transaction_id
• Event Data → event_id

2. Create Tags:

---

🅰️ Google Ads Enhanced Conversion (Server Tag)

• Tag Type: Google Ads Conversion
• Include:
  • email: {{ user_data.email }}
  • phone_number: {{ user_data.phone }}
  • transaction_id, currency, value, event_id
• Trigger: purchase

✅ Google will hash this again before processing.

---

🅱️ Meta CAPI HTTP Request Tag

• Use Meta CAPI tag template
• Fields:
  • em: {{ user_data.email }}
  • ph: {{ user_data.phone }}
  • event_name: Purchase
  • event_id: {{ event_id }}
  • action_source: website
  • currency, value, transaction_id

✅ Improves match quality in Meta by 30–40% for some accounts.

---

🔹 Step 6: Deduplicate and Validate

Use event_id to deduplicate conversions across:

• Web → Google Ads
• Server → Google Ads
• Web → Meta Pixel
• Server → Meta CAPI

Both platforms support deduplication based on event_id.

---

🔹 Step 7: Test Your Implementation

Use:

• GA4 DebugView for real-time event monitoring
• Server GTM Preview mode to verify incoming values
• Meta CAPI Test Events in Events Manager
• Google Ads Enhanced Conversion Troubleshooter (under Tools > Conversions)

---

🔐 Security & Compliance Best Practices

Action	Purpose
Hash emails/phones in backend	Prevent raw PII exposure in browser
Use first-party domain (gtm.yoursite.com)	Ensures cookies persist
Honor consent	Only fire tags if user agrees
Log events in Server GTM	Monitor anomalies
Use secure headers	Restrict spoofed incoming traffic

---

📦 Summary Flow

[OpenCart Checkout (PHP)]
       ↓
[Hash Email & Phone → Twig → dataLayer.push()]
       ↓
[Web GTM → GA4 Tag → Server Endpoint]
       ↓
[Server GTM]
   ↓           ↓
[Google Ads]  [Meta CAPI]

---

🧪 QA Checklist

Item	Status
Email & phone hashed in backend	✅
dataLayer push has user_data	✅
GTM tags triggered with correct values	✅
Server GTM receives and parses data	✅
Tags sent to Meta and Google Ads	✅
event_id used for deduplication	✅

---