The Shopify pixel manager allows you to manage all your event tracking in one place. When a new app is installed, app pixels are automatically added to your pixel manager. You can also add custom pixels that collect customer data on your storefront, in checkout, and on the order status page, from the pixel manager. Data captured with pixels allows third-party services integrated with your store to optimize marketing and analytics.
Shopify uses a secure sandbox for pixels. A sandbox is an isolated environment that allows you to run scripts without affecting the rest of your online store. A sandboxed pixel has the freedom to run anywhere on your website, but is restricted to the data made available within the sandbox. This sandbox ensures that any pixels installed or created in the pixels manager can't collect or retrieve data outside the stated intent of the pixel, which could be a security risk.
There are two types of sandbox for pixels:
App pixels are loaded into a Strict sandbox environment. These pixels load in a web worker and can only access specific data as per the Shopify Pixels API. App pixels have restricted access to your online store, and are the safer option for using pixels to track customer events.
Custom pixels are loaded into a Lax sandbox environment. This sandbox loads the scripts in an iframe and allows for a traditional pixels setup where a script element is injected into a page. Custom pixels can be used when the service doesn't have an app that is fully integrated with Shopify's Pixels API, which uses a strict sandbox environment.
Each of these sandbox environments offer an additional layer of security for your online store to help mitigate any potential risks. For more information on the risks associated with pixels, refer to the Risks documentation.
App pixels are loaded into a strict sandbox environment. This sandbox load the scripts in a web worker environment, where Shopify will provide APIs to access specific capabilities (read/write cookies, make network requests), and will require partners to write completely new SDK specific to Shopify.
Custom pixels are loaded into a lax sandbox environment. This sandbox loads the scripts in an iframe and allows for a traditional pixel experience. Not every pixel will work in this environment, as the sandbox is completely isolated from the rest of your website. For example, a pixel that is designed to scrape content or pricing information is unable to see outside the sandbox, and can't access any unauthorized information. Use a custom pixel when the service you want to link to customer events isn't fully integrated with Shopify's Pixels API.
With any pixel, make sure that you understand what the code does before you copy it into your store, and only use code that is developed by a trustworthy source to avoid any risks to your online store performance or security.