Identifying your users

By default every visitor is anonymous and the identifier expires daily. If your site has signed-in users, you can attach your own stable reference to their events:

oa.identify("user_8f21c4");

From that moment the visitor's events carry your reference (hashed, site-scoped, never stored raw), so a returning signed-in user reads as the same person across visits, and revenue can be joined through Stripe's client_reference_id (see revenue attribution, recipe 2).

Recognising a person across visits is not ordinary audience measurement, so the reasoning that lets most sites run this script without a banner does not cover this call. You are the controller for it: the script sends what your code tells it to, and we do not hold it back on a consent state we cannot see.

Decide how you ask, then wire the answer. If you use a banner or a preference centre, tell the script:

oa.consent("granted"); // or "denied" — denied stops everything, immediately

Calling oa.identify() only after your own consent check is the straightforward pattern, and it is the one our privacy notice template describes for site owners.

• The ID is yours: an internal account number, a database key. Our terms require it not be directly identifying; no emails, no names.
• It is hashed before storage with a site-scoped key, so the same reference on two sites produces unrelated values.
• 1 to 128 characters. The identify event itself is always free; it never counts against your plan.
• Unlike the anonymous identifier, it does not rotate daily. That is its purpose, and your own privacy notice should say you use it.