Attribution
Attribution is a United States based multi touch marketing attribution platform that tracks users across touchpoints to measure which channels drive conversions.
What does Attribution do?
What Attribution is
Attribution is a United States based multi touch marketing attribution platform. It stitches together a visitor journey across ads, emails, landing pages and other touchpoints to show which channels and campaigns actually drive conversions. Marketing teams use it to allocate budget based on full funnel performance rather than last click alone.
What data and cookies it collects
Attribution sets first and third party cookies and processes online identifiers, page views, campaign parameters, referrers and conversion events. To connect touchpoints over time it builds a persistent profile of each user across sessions and channels. This sustained cross channel linkage is what makes the data both valuable and sensitive under data protection law.
GDPR and ePrivacy implications
Because Attribution tracks individuals across touchpoints and builds profiles, it processes personal data and engages the profiling provisions of the GDPR. The ePrivacy Directive requires prior consent before its cookies and identifiers are placed on a device. The cross channel nature of the tracking raises the risk level and the transparency burden on the controller.
Consent requirements
Marketing attribution that profiles users requires freely given, specific, informed and unambiguous consent before any tracking begins. The Attribution tag and cookies must stay blocked until the visitor opts in through your consent banner, and withdrawal must be as easy as giving consent. Because profiling is involved, legitimate interest is generally not an adequate basis here.
Data transfers and hosting
Attribution is hosted in the United States, so personal data including identifiers and touchpoint history leaves the European Union. Such transfers should rely on the EU US Data Privacy Framework where the vendor is certified, or on Standard Contractual Clauses with a documented transfer impact assessment. Record the safeguards and the signed data processing agreement in your accountability file.
Practical compliance steps
Gate the Attribution tag behind a consent management platform so nothing fires before opt in, and connect it to Google Consent Mode where relevant. Complete a data protection impact assessment, verify the United States transfer mechanism and minimise the identifiers you send. Finally, document the profiling in your privacy policy, list the cookies and keep retention as short as your measurement needs allow.
Attribution and the GDPR
Attribution is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Consent under Article 6(1)(a) GDPR, required because the platform performs cross touchpoint tracking and profiling for marketing measurement
- Risk level
- high
- Applicable regulations
- GDPR, ePrivacy Directive, EU US Data Privacy Framework
Impact assessment (DPIA)
A data protection impact assessment is required because Attribution performs systematic cross channel tracking and profiling, a high risk activity under the GDPR. Assess the scope of identifiers collected, the profiling logic and the transfer of data to the United States.
Sample text for your banner
We use Attribution to track your interactions across marketing channels and measure which campaigns lead to conversions. This involves profiling and processing in the United States. Do you consent?
What Attribution sets and contacts
- Tracking method
- JavaScript tag, first and third party cookies and server side event ingestion for multi touch attribution across marketing channels
- Server location
- United States
- Data transferred outside the EU
- Attribution is a United States based platform, so personal data including online identifiers and touchpoint history is transferred to the United States. Transfers rely on the EU US Data Privacy Framework where the vendor is certified, otherwise on Standard Contractual Clauses with supplementary measures.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _attr_id | Marketing | 2 years | Stores a persistent identifier used to link a visitor across sessions and marketing touchpoints. |
| _attr_session | Marketing | 30 minutes | Identifies the current visit so events can be grouped into a single session for attribution. |
| _attr_ref | Marketing | 90 days | Captures the referring campaign and source so conversions can be credited to the right channel. |
Third-party domains contacted (3)
attributionapp.comapi.attributionapp.comtrack.attributionapp.com
Frequently asked questions about Attribution
Can't find your question? Write to us, we answer fast.
Does Attribution set cookies?
Yes. Attribution sets first and third party cookies and processes online identifiers to connect a visitor across touchpoints and sessions. Run a cookie scan so you can list each cookie and its duration accurately.
Is consent required to use Attribution?
Yes. Because Attribution tracks users across channels and builds profiles, you need prior, freely given consent before any tag or cookie loads. Keep it blocked until the visitor opts in.
What is the legal basis for Attribution?
The appropriate legal basis is consent under Article 6(1)(a) GDPR. Given the profiling involved, legitimate interest is generally not adequate for this kind of cross channel marketing measurement.
Does Attribution transfer data to the United States?
Yes. Attribution is United States based, so identifiers and touchpoint history are transferred there. Rely on the EU US Data Privacy Framework if the vendor is certified, otherwise on Standard Contractual Clauses with a transfer impact assessment.
Do I need a DPIA for Attribution?
Yes. Systematic cross channel tracking and profiling is high risk under the GDPR, so a data protection impact assessment is required. Document the identifiers collected, the profiling logic and the United States transfer.
How do I implement Attribution compliantly?
Gate the tag behind a consent management platform, connect it to Google Consent Mode where relevant and minimise the identifiers you send. Complete a DPIA, verify the transfer mechanism and disclose the profiling in your privacy policy.
What are the alternatives to Attribution?
EU hosted or privacy first attribution and analytics tools, or consent aware server side measurement, can reduce transfer and profiling risk. Whatever you choose, apply consent, minimisation and documentation consistently.
How do I update my cookie policy for Attribution?
Add Attribution to the marketing or analytics category, describe the cross touchpoint tracking and profiling, list the cookies and their durations and disclose the United States transfer. Refresh the notice whenever your setup changes.
Actirise
Actirise is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Actirise supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Actirise enables informed decisions that improve experience and drive results.
Simon
Simon is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Simon supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Simon enables informed decisions that improve experience and drive results.
SniperFast
SniperFast is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SniperFast offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SniperFast empowers organizations to optimize strategy and maximize return on investment.
Tealium AudienceStream
Tealium AudienceStream is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Tealium AudienceStream supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Tealium AudienceStream ensures your website delivers a smooth, uninterrupted experience to every visitor and.
Crazy Egg
Crazy Egg is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Crazy Egg offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Crazy Egg empowers organizations to optimize strategy and maximize return on investment.
Microsoft Power BI
Microsoft Power BI is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Microsoft Power BI supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Microsoft Power BI enables informed decisions that improve experience and drive results.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.