Square Online: Meta external_id and diagnostic data sharing

Questions
1

Hello, Square Customer Success referred me here.

I need technical clarification about Square Online’s built-in website integrations to complete privacy disclosures for an app that displays our Square Online site in a WebView. We do not use a custom Square API integration.

  1. With Automatic Advanced Matching disabled, what does Square send to Meta as external_id? Is it a customer/account ID or a browser/device identifier? Does this setting affect both Pixel and Conversions API sharing?

  2. Does Square Online use Sentry for website diagnostics? If so, do reports include customer IDs, email addresses, IP addresses or persistent device/browser identifiers? Are these used solely for diagnostics?

Could someone confirm this or route the questions to Square Online’s engineering/privacy team?

Thank you.

3

Hello, following up with findings from testing our Square Online site inside our iOS app’s WebView.

With Automatic Advanced Matching disabled, we inspected guest and signed-in page views:

  • Requests to Square’s facebook/pixel-events endpoint contained fbp and event_id, but no external_id.

  • Direct Facebook PageView requests also showed no external_id or ud[...] fields.

  • The Sentry session reports we inspected contained a session ID, timestamps, status, error count, release, environment, and user agent. No email, customer ID, or explicit IP-address field appeared in those bodies.

To complete our Apple App Privacy disclosures, could you please confirm:

  1. Does Square add external_id or other customer identifiers when forwarding events to Meta through the Conversions API? If so, what generates that identifier, and does disabling Automatic Advanced Matching affect this server-side sharing?

  2. Can other Sentry reports, including error reports, contain customer IDs, email addresses, or persistent browser/device identifiers? Are visitors’ IP addresses retained or associated with those reports?

  3. Are these diagnostics used exclusively for service operation and troubleshooting, or also for advertising, marketing, or cross-service tracking?

Our inspection only shows traffic leaving the WebView, so we cannot verify what happens on Square’s servers. Could you route these questions to the Square Online engineering or privacy team if needed?

Thank you for helping us make the disclosures accurate.

4

Thanks for providing the additional observations.

Questions concerning Square Online are outside the scope of the Developer Forums, and we aren’t able to provide further implementation or compliance determinations here.

For an official privacy inquiry, please use the Square Privacy Portal. For questions about the Square Online product, you can also contact Square Support. You should work with your privacy or legal advisor to determine the disclosures required for your application.