Installing via GTM

Install the Korvus snippet with Google Tag Manager in under 5 minutes.

Before you install: mandatory GDPR checklist

Korvus acts as a processor within the meaning of Article 28 of the GDPR. Before you deploy the snippet, check the 5 points below: without them, your site does not meet the information obligation set by Article 13 of the GDPR and Article 82 of the French Data Protection Act (loi Informatique et Libertés).

A working client-side CMP. Your site needs a consent banner that exposes its state through a recognized standard. Korvus automatically detects Axeptio, Didomi, Cookiebot, OneTrust, the IAB Europe TCF v2 framework and Google Consent Mode v2.
A visible opt-out mechanism. Visitors must be able to refuse collection independently of your CMP, through a link that sets the korvus_optout=1 cookie (example below).
Content Security Policy (CSP). If your site uses one, add https://cdn.korvus.fr to script-src and https://app.korvus.fr to connect-src. Details on the CSP page.
A Korvus mention in your privacy policy. Article 13 of the GDPR requires it. We provide a ready-to-paste paragraph in FR / IT / ES / EN.
Korvus added to your list of processors. The full list of our sub-processors is published on the Korvus sub-processors page.

Sample opt-out link

To add to your privacy policy:

<a href="#" onclick="document.cookie='korvus_optout=1; path=/; max-age=31536000'; alert('La collecte Korvus est désactivée sur ce navigateur.'); return false;">
  Refuser la collecte Korvus
</a>

Prerequisites

An active Korvus account (create an account)
Access to Google Tag Manager

The Korvus snippet

In GTM, create a Custom HTML tag and name it "Korvus"
Paste the following code:

<script>
  window.__korvus = { apiKey: "YOUR_API_KEY", enableProofCapture: true };
  (function () {
    var started = false;
    function startEngine() {
      if (started) return;
      started = true;
      var s = document.createElement("script");
      s.src = "https://cdn.korvus.fr/v2/korvus.min.js";
      s.async = true;
      document.head.appendChild(s);
    }
    var c = document.createElement("script");
    c.src = "https://cdn.korvus.fr/v2/o/YOUR_ORG_KEY/" + location.hostname + ".js";
    c.async = true;
    c.onload = c.onerror = startEngine;
    setTimeout(startEngine, 3000);
    document.head.appendChild(c);
  })();
</script>

Replace YOUR_API_KEY and YOUR_ORG_KEY with the two keys Korvus sent you
Trigger: Initialization - All Pages. If your container serves several sites, restrict it to your domains with a Page Hostname condition
Publish the container

Do not add any consent condition to this tag. The script reads the visitor's choice from your consent banner itself and follows it.

Both scripts load in the background: they do not slow down how your pages display.

Configuration goes through the window.__korvus object rather than data- attributes on the tag. That is the reliable method in Google Tag Manager: when GTM injects custom HTML, the script cannot always find its own tag to read those attributes.

Verification

Once installed, go back to your Korvus dashboard. The first data shows up within a few minutes. The 28-day learning period starts automatically.

During this period, Korvus observes your site's normal behavior without sending alerts.

NextShopify installation