Gorgias

Overview

Gorgias is a helpdesk and customer support platform built specifically for e-commerce brands, with deep native integrations into Shopify, BigCommerce, and Magento. It centralizes support tickets from email, live chat, social media DMs, and SMS into a single agent workspace. Merchants embed a Gorgias chat widget on their storefront to provide real-time customer support and access to order data during conversations.

What This Script Does

Chat Widget Script

The Gorgias chat widget loads from config.gorgias.chat/applications/{account-id}/onload.js. This script renders an interactive chat button in the corner of the storefront. On click, it expands into a full chat panel connected to Gorgias's agent workspace in real time via WebSockets.

Order Data Enrichment

When a customer initiates a chat, Gorgias's Shopify integration retrieves the customer's order history via the Shopify API (server-side) and surfaces it to the support agent. The chat widget itself does not directly access order data — it sends a customer identification event to the Gorgias API, which then fetches order context server-side.

Contact Identification

If the customer is logged into the store, the widget can be initialized with a signed customer token that identifies the visitor as a known account. This allows Gorgias to match the chat session to an existing customer record without the customer needing to re-enter their details.

Cookies Set

• gorgias-session — First-party session cookie. Stores the active chat session token for widget state continuity. Duration: session.
• gorgias-vid — First-party persistent cookie. Stores an anonymous visitor identifier for returning visitor recognition. Duration: 1 year.
• gorgias-chat-open — First-party session cookie. Stores the open/closed state of the chat widget. Duration: session.

Domains Contacted

• config.gorgias.chat — Serves the widget loader JavaScript and configuration payload.
• us.gorgias.com / eu.gorgias.com — Regional API endpoints for message delivery, agent assignment, and customer lookup.
• WebSocket connection to Gorgias infrastructure for real-time chat message delivery.

Data Collected Per Interaction

• Page URL when chat is initiated
• Browser user-agent and screen dimensions
• Customer email, name, and order number if the customer provides them or is identified from the logged-in session
• Full chat transcript (messages between customer and agent)
• Customer satisfaction rating if the post-chat CSAT survey is enabled
• IP address at connection time

Consent & Compliance

GDPR / ePrivacy: Gorgias processes personal data (name, email, order history, IP) as a data processor on behalf of the merchant. The chat functionality is a service explicitly requested by the user when they open the widget. This falls under GDPR Article 6(1)(b) (performance of a contract) or Article 6(1)(a) (consent by initiating the conversation). The gorgias-vid persistent cookie used for returning visitor recognition is functional. Merchants must include Gorgias in their privacy policy as a sub-processor.

CCPA / CPRA: Gorgias processes customer personal information under a merchant data processing agreement, qualifying it as a service provider. This is not a sale under CCPA. Merchants must disclose Gorgias in their privacy policy.

EU-US Data Privacy Framework: Gorgias offers EU-region data hosting (eu.gorgias.com) for merchants requiring data residency within the EU. EU merchants should select the EU region and confirm Gorgias's DPA is in place.

Consent Category: Functional. Gorgias is a customer support tool with no advertising or behavioral marketing functions.

Should You Block This Without Consent?

No. Gorgias is a customer support widget that provides a service explicitly requested by users who choose to open the chat. It does not perform advertising tracking or behavioral profiling. The persistent visitor cookie is functional (returning visitor recognition for support context). Blocking Gorgias without consent is not required by GDPR or CCPA. Merchants should ensure the chat is listed in their privacy policy as a sub-processor.