Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Attribution is a United States based multi touch marketing attribution platform that tracks users across touchpoints to measure which channels drive conversions.
Attribution is a United States based multi touch marketing attribution platform. It stitches together a visitor journey across ads, emails, landing pages and other touchpoints to show which channels and campaigns actually drive conversions. Marketing teams use it to allocate budget based on full funnel performance rather than last click alone.
Attribution sets first and third party cookies and processes online identifiers, page views, campaign parameters, referrers and conversion events. To connect touchpoints over time it builds a persistent profile of each user across sessions and channels. This sustained cross channel linkage is what makes the data both valuable and sensitive under data protection law.
Because Attribution tracks individuals across touchpoints and builds profiles, it processes personal data and engages the profiling provisions of the GDPR. The ePrivacy Directive requires prior consent before its cookies and identifiers are placed on a device. The cross channel nature of the tracking raises the risk level and the transparency burden on the controller.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Marketing attribution that profiles users requires freely given, specific, informed and unambiguous consent before any tracking begins. The Attribution tag and cookies must stay blocked until the visitor opts in through your consent banner, and withdrawal must be as easy as giving consent. Because profiling is involved, legitimate interest is generally not an adequate basis here.
Attribution is hosted in the United States, so personal data including identifiers and touchpoint history leaves the European Union. Such transfers should rely on the EU US Data Privacy Framework where the vendor is certified, or on Standard Contractual Clauses with a documented transfer impact assessment. Record the safeguards and the signed data processing agreement in your accountability file.
Gate the Attribution tag behind a consent management platform so nothing fires before opt in, and connect it to Google Consent Mode where relevant. Complete a data protection impact assessment, verify the United States transfer mechanism and minimise the identifiers you send. Finally, document the profiling in your privacy policy, list the cookies and keep retention as short as your measurement needs allow.
Websites using Attribution must obtain user consent under GDPR regulations.
DPIA considerations
A data protection impact assessment is required because Attribution performs systematic cross channel tracking and profiling, a high risk activity under the GDPR. Assess the scope of identifiers collected, the profiling logic and the transfer of data to the United States.
Sample consent text
We use Attribution to track your interactions across marketing channels and measure which campaigns lead to conversions. This involves profiling and processing in the United States. Do you consent?
Third-party domains contacted
attributionapp.comapi.attributionapp.comtrack.attributionapp.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _attr_id | Marketing | 2 years | Stores a persistent identifier used to link a visitor across sessions and marketing touchpoints. |
| _attr_session | Marketing | 30 minutes | Identifies the current visit so events can be grouped into a single session for attribution. |
| _attr_ref | Marketing | 90 days | Captures the referring campaign and source so conversions can be credited to the right channel. |
Attribution collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Yes. Attribution sets first and third party cookies and processes online identifiers to connect a visitor across touchpoints and sessions. Run a cookie scan so you can list each cookie and its duration accurately.
Yes. Because Attribution tracks users across channels and builds profiles, you need prior, freely given consent before any tag or cookie loads. Keep it blocked until the visitor opts in.
The appropriate legal basis is consent under Article 6(1)(a) GDPR. Given the profiling involved, legitimate interest is generally not adequate for this kind of cross channel marketing measurement.
Yes. Attribution is United States based, so identifiers and touchpoint history are transferred there. Rely on the EU US Data Privacy Framework if the vendor is certified, otherwise on Standard Contractual Clauses with a transfer impact assessment.
Yes. Systematic cross channel tracking and profiling is high risk under the GDPR, so a data protection impact assessment is required. Document the identifiers collected, the profiling logic and the United States transfer.
Gate the tag behind a consent management platform, connect it to Google Consent Mode where relevant and minimise the identifiers you send. Complete a DPIA, verify the transfer mechanism and disclose the profiling in your privacy policy.
EU hosted or privacy first attribution and analytics tools, or consent aware server side measurement, can reduce transfer and profiling risk. Whatever you choose, apply consent, minimisation and documentation consistently.
Add Attribution to the marketing or analytics category, describe the cross touchpoint tracking and profiling, list the cookies and their durations and disclose the United States transfer. Refresh the notice whenever your setup changes.