A personal community project under @kyletaylored, MIT licensed.Not provided or supported by Datadog.

Privacy, consent and security

These plugins get installed on checkout pages, so they have to be safer by default than hand-written tracking code. Every rule below lives in the shared core, not in individual adapters, and the conformance suite fails a release that breaks one.

No payment data, ever

Adapters read the platform's event payloads, never DOM inputs. Card numbers, CVV, expiry and billing addresses are stripped in the core even when a platform payload includes them — the fixtures deliberately carry a card_number so that stripping is exercised rather than assumed.

PII is off by default

• usr.id is the platform or provider customer ID. That is the only identifier sent by default.
• Email, name, phone and address need an explicit opt-in (includeEmail, includeName). Phone and address have no opt-in at all.
• Search queries are sent as search_term_length only. The text never leaves the browser, because a shopper can type anything into a search box.
• Free-text fields — notes, comments, messages — are dropped wherever they appear in a payload.

Consent

When a consent adapter is present it runs first and sets trackingConsent = 'not-granted'before the SDK starts, which stops RUM collecting anything, not just this plugin's actions. Commerce adapters additionally hold their own events, including setUser, until consent is granted.

Nothing is queued. Events that happen while the decision is pending are dropped, not buffered, so a later grant never backfills pre-consent activity. One consequence worth stating plainly: a declined visitor sends nothing at all, so RUM cannot report opt-in rate. A consent plugin describes only the categories of sessions that opted in.

Size limits

• items[] is opt-in and capped at 20 entries.
• Strings are truncated at 256 characters.
• Nested objects deeper than four levels are dropped rather than partly sent.
• commerce.purchase is deduplicated per transaction_id for 24 hours in localStorage.

Supply chain

• Packages publish to npm from CI only, with provenance. No local publishes.
• CDN URLs are exact-version jsDelivr links with an SRI hash. There is no auto-updating latest URL; merchants pin a version.
• GitHub Actions are pinned by commit SHA, and workflows run with persist-credentials: false.
• A new runtime dependency on an adapter needs core-maintainer review. The launch adapters have none beyond the shared core.
• Every release runs the conformance suite and the real-SDK integration test.

Declared footprint

Each adapter declares the platform globals it reads, the events it subscribes to, the storage keys it writes and the RUM APIs it calls. The gallery renders that as a permissions screen, debug mode prints it to the console, and the conformance suite compares it against what the adapter actually did during its fixture run — so an adapter cannot quietly call an API it did not declare.

What the tests actually check