Cookies and Coupons: What Stores See When You Use a Code

Applying a promo code at checkout is one of the most data-rich actions a shopper takes online. In a single click, the merchant's checkout system writes between 14 and 30 distinct fields to a log somewhere — the code itself, the timestamp, your cart contents, the device and browser you're using, the IP address you're coming from, the affiliate cookie that referred you, the session ID that ties this checkout to everything you did on the site beforehand, and a half-dozen fingerprint signals that, in aggregate, identify you with surprising precision even if you've never logged in.

Most of this is invisible. The shopper sees a "code applied" message and a discounted total. The merchant sees, depending on their analytics stack, something closer to a forensic dossier. None of it is illegal in the US (and most of it survives the European GDPR regime by way of "legitimate interest" carveouts), and most of it is in fact what shoppers would want their merchants to log if they thought about it for thirty seconds — fraud detection, cart-abandonment recovery, fulfillment routing all depend on it. But the data exists, and it goes places.

Here is what we mapped, after working through the analytics documentation of three major e-commerce platforms and interviewing four anonymous engineers who have worked on checkout systems at retailers you've shopped at.

What gets logged at the moment of code entry

The act of entering and validating a promo code triggers, at minimum, the following events on a typical e-commerce platform (Shopify Plus, BigCommerce, Salesforce Commerce Cloud, Adobe Commerce, and the major custom stacks all instrument similar fields):

The code itself. Captured verbatim, with the timestamp of entry, the cart ID, and the user session ID. Even invalid codes are logged — failed code attempts are a fraud signal.

The source attribution. If you arrived from an affiliate link, the network and publisher ID are recorded. If you arrived organically (typed the URL, clicked a Google result, came in through email), that path is recorded too. The code-source pairing is one of the most-watched analytics in retail: merchants want to know which codes are coming through which channels, because it tells them which channels are driving incremental purchases versus which are riding existing demand.

Cart contents. Every SKU, quantity, and price in the cart at the moment the code was applied. This is logged at the line-item level, so the merchant can see exactly which items the code's discount applied to, which it excluded, and what your final basket composition was. Cross-referenced with previous browse history in the same session, this becomes a behavioral profile — "this shopper looked at six pairs of running shoes, abandoned twice, came back via an email link, and applied a code on the third visit."

Device fingerprint. A composite of your browser, OS, screen resolution, installed fonts, language settings, time zone, GPU rendering signature (canvas fingerprinting), audio context fingerprint, and a handful of platform-specific signals. Modern fingerprinting libraries can identify a device across sessions with 80 to 95 percent accuracy even without cookies. This was less true five years ago; it is more true now, despite (and partly because of) browser-vendor efforts to constrain cookies.

IP address and inferred geolocation. The IP itself is logged. From the IP, the merchant infers a city-level location, an ISP, and — increasingly — whether the IP is associated with a VPN or proxy. VPN traffic is not blocked at most retailers but is often weighted differently in fraud scoring.

Session graph. Everything you did on the site this session: which pages you viewed, how long you spent on each, what you added and removed from your cart, whether you filled out any form fields and didn't submit, scroll depth on key pages. This is collected by the merchant's session-replay tool (FullStory, Hotjar, LogRocket, Quantum Metric, or one of the custom in-house equivalents at the largest retailers).

Cookie state. First-party cookies set by the merchant itself. Third-party cookies set by ad networks, analytics tools, and affiliate trackers, where the browser still allows them. As of 2026, third-party cookies are heavily restricted by Safari, Firefox, and (finally, after years of delay) Chrome — but plenty of fingerprinting and first-party-as-third-party workarounds have filled the gap.

Logged-in user state, if applicable. If you're logged in, all of the above is tied to your account record. If you're not, the merchant uses fingerprint and session data to attempt to match you to an existing account profile anyway. The match accuracy varies but is, again, surprisingly high.

Where it goes

The merchant retains all of this in their primary analytics warehouse, typically Snowflake, BigQuery, or Databricks for large retailers, and a managed Shopify or similar warehouse for smaller ones. The retention period varies — between 13 and 36 months is typical for behavioral data, longer for transactional records that are subject to financial regulations.

A subset of the data flows out to external systems:

The affiliate network. When a code is applied that's tied to an affiliate publisher, the network is informed of the order — including the order total, the items, and any flagged restrictions on commission (returns, fraud holds). The publisher, in turn, can see aggregate data on their conversions in their network dashboard. Individual shopper data is generally not exposed to publishers, but aggregate behavioral patterns are.

Ad platforms. Conversion events flow to Meta, Google, TikTok, and (depending on the merchant's ad mix) a long tail of others. These events are increasingly server-side rather than client-side — meaning the merchant sends them directly to the ad platform's API rather than relying on a pixel in your browser — which improves match rates and dodges most ad blockers. The data sent typically includes a hashed version of your email and phone number (if known), which the ad platforms use to match you across devices.

Analytics and CDP tools. Customer Data Platforms (Segment, mParticle, RudderStack, Tealium) stream the data to dozens of downstream tools — CRM, email, SMS, recommendation engines, loyalty platforms. Each of these has its own retention and privacy posture.

Fraud-detection services. Sift, Riskified, Signifyd, and similar third parties receive the order data in real time and return a fraud score. They retain the data for cross-merchant pattern detection, which is one of the few cases where merchants actively share data about you across the retail industry.

This is not a paranoid map. It is the standard plumbing of a 2026 e-commerce stack. The merchants are not, in most cases, trying to do anything sinister with the data; they are trying to run a business. But the data exists, and the moment it leaves the merchant's primary warehouse — to the ad platforms, to the CDP downstream destinations, to the fraud services — the merchant's ability to control or delete it diminishes.

Browser extensions: the tradeoff

Browser extensions in the coupon space — Honey, Capital One Shopping, Rakuten, the smaller players — solve a real shopper problem (find and apply working codes automatically) and create a real privacy tradeoff. To do their job, they need to know what site you're on, what's in your cart, and what codes have been tried.

What they typically do know, based on their own privacy policies as of 2026:

Capital One Shopping retains data on the merchants you visit, the items in your cart, and your purchase history through the extension. The privacy policy explicitly notes the data may be used for marketing across Capital One's broader product portfolio, which is meaningful given that Capital One is a credit-card issuer.

Rakuten retains broadly similar data and ties it to your Rakuten account. Because Rakuten is a cashback service, the data linkage is somewhat more transparent — you logged in to get cashback; you knew they would track the purchase.

Honey (now under PayPal) collects the merchant URL, cart contents, and code attempts, and retains the data for analytics and product-improvement purposes. After the 2024 last-click controversy, the privacy disclosures around Honey have become substantially more explicit; the underlying data collection has not, by independent audit, materially changed.

The general principle: an extension that watches your checkout sees your checkout. There is no version of these extensions that solves the user-facing problem without seeing the data. If you want the convenience, you accept the visibility. If you want the privacy, you don't install the extension and you go look up codes manually.

Incognito mode: not what you think

A common assumption is that incognito or private-browsing mode prevents merchants from tracking you. It does some things — it doesn't keep first-party cookies between sessions, it doesn't share cookies with your normal browsing — but it does not change your IP address, your device fingerprint, or any of the other persistent identifiers we listed earlier.

A merchant looking at incognito traffic sees: a session with no cookies, but with a fingerprint signature that matches a returning customer to within 90 percent confidence, coming from an IP address that resolves to a residential ISP in a known city. They know who you are. They will tie the order to your account at checkout the moment you enter your email. The "private" in private-browsing means private from other people on your computer, not private from the websites you visit.

If your goal is to dodge a "new customer only" code restriction by going incognito, this often works in practice — many merchants enforce that restriction on cookie state alone and don't push the fingerprint match all the way through. But the merchants who do enforce it (a growing share, in our experience) will catch you, and the order will be either rejected or downgraded to a non-discounted state.

What you can actually opt out of

The patchwork US privacy regime has improved meaningfully since California's CCPA (now CPRA) took effect in 2020, and is improving further with the state-by-state cascade — Virginia, Colorado, Connecticut, Utah, Texas, Iowa, and a growing list of others have shipped privacy laws since 2023. The federal preemption debate in Congress has not resolved. The practical effect, in 2026, is that most US shoppers can request the following from most large retailers:

A copy of the data the retailer has about them. (Right of access.) Deletion of that data, with carve-outs for transactional records that the retailer is legally required to retain. (Right of deletion.) An opt-out from the sale or sharing of their data for cross-context behavioral advertising. (The "Do Not Sell or Share My Personal Information" link required at the bottom of most retail sites.) A correction of any inaccuracies in their profile.

What you generally cannot opt out of: the retailer's own first-party use of your data to fulfill your order, recommend products, run loyalty programs, or detect fraud. The retailer treats these as the core of the contract you entered into when you bought the thing.

The Global Privacy Control (GPC) browser signal, supported by Firefox, Brave, and a number of Chrome extensions, is now legally binding as a "do not sell" signal in California, Colorado, and Connecticut, and is honored on a courtesy basis by many large retailers in other states. Turning it on is the lowest-effort meaningful privacy lever a shopper can pull. It does not stop tracking; it stops the resale of tracking data to third parties for ad-targeting purposes.

GDPR-equivalent protections are not available to US shoppers, full stop. If you live in the US, you do not have the right to demand a particular merchant stop processing your data for legitimate-interest purposes. You have the right to opt out of resale, and you have the right to access and deletion. That is a meaningful set of rights, but it is not the same as the European baseline.

Practical posture

A few habits are worth adopting if you'd like to keep your data footprint smaller without giving up the use of coupons entirely.

Use a guest checkout when you can. Most retailers offer one. The data still gets logged, but it's not tied to a persistent account profile, which makes the profile harder to maintain over time.

Keep at least one browser with strict tracking protection (Firefox with strict mode, Brave, Safari with cross-site tracking prevention) for shopping you don't want correlated with your other browsing.

Use a unique-per-merchant email alias if your email provider supports them (iCloud Hide My Email, Apple Mail+, Fastmail's Masked Email, SimpleLogin, addy.io). This dramatically reduces the merchants' ability to match your identity across their ecosystem and across to ad platforms.

Decline or remove browser extensions that watch your checkout unless you are actively using their cashback or code-finding functionality. The data leakage of an idle extension that's running on every site you visit is much larger than its idle utility.

Check your privacy controls at the merchants you shop at most. Many of them have surprisingly granular settings — opt-outs from email marketing, SMS, postal mail, ad personalization, third-party data sharing — that nobody ever uses because they're buried four clicks deep. The five minutes you spend setting them at your top-five retailers is a meaningful investment in a smaller data footprint.

The takeaway is not that promo codes are dangerous, or that you should stop using them. They aren't, and you shouldn't. The takeaway is that the moment of code entry is a moment of unusually rich data exchange, and the shoppers who do best — financially and in terms of their data posture — are the ones who go in with their eyes open about what's being exchanged.