> How Attribution tracks users across touchpoints under GDPR, why consent is required, the US data transfer, profiling risks and practical compliance steps. > > Canonical: https://www.flowconsent.com/en/services/analytics/attribution Analytics # Attribution Analytics Attribution is a United States based multi touch marketing attribution platform that tracks users across touchpoints to measure which channels drive conversions. [Block Attribution until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 3 - Third-party domains 3 - Servers United States Overview ## What does Attribution do? ## **What Attribution is** Attribution is a United States based multi touch marketing attribution platform. It stitches together a visitor journey across ads, emails, landing pages and other touchpoints to show which channels and campaigns actually drive conversions. Marketing teams use it to allocate budget based on full funnel performance rather than last click alone. ## **What data and cookies it collects** Attribution sets first and third party cookies and processes online identifiers, page views, campaign parameters, referrers and conversion events. To connect touchpoints over time it builds a persistent profile of each user across sessions and channels. This sustained cross channel linkage is what makes the data both valuable and sensitive under data protection law. ## **GDPR and ePrivacy implications** Because Attribution tracks individuals across touchpoints and builds profiles, it processes personal data and engages the profiling provisions of the GDPR. The ePrivacy Directive requires prior consent before its cookies and identifiers are placed on a device. The cross channel nature of the tracking raises the risk level and the transparency burden on the controller. ## **Consent requirements** Marketing attribution that profiles users requires freely given, specific, informed and unambiguous consent before any tracking begins. The Attribution tag and cookies must stay blocked until the visitor opts in through your consent banner, and withdrawal must be as easy as giving consent. Because profiling is involved, legitimate interest is generally not an adequate basis here. ## **Data transfers and hosting** Attribution is hosted in the United States, so personal data including identifiers and touchpoint history leaves the European Union. Such transfers should rely on the EU US Data Privacy Framework where the vendor is certified, or on Standard Contractual Clauses with a documented transfer impact assessment. Record the safeguards and the signed data processing agreement in your accountability file. ## **Practical compliance steps** Gate the Attribution tag behind a consent management platform so nothing fires before opt in, and connect it to Google Consent Mode where relevant. Complete a data protection impact assessment, verify the United States transfer mechanism and minimise the identifiers you send. Finally, document the profiling in your privacy policy, list the cookies and keep retention as short as your measurement needs allow. Compliance ## Attribution and the GDPR Attribution is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent under Article 6(1)(a) GDPR, required because the platform performs cross touchpoint tracking and profiling for marketing measurement - Risk level high - Applicable regulations GDPR, ePrivacy Directive, EU US Data Privacy Framework ### Impact assessment (DPIA) A data protection impact assessment is required because Attribution performs systematic cross channel tracking and profiling, a high risk activity under the GDPR. Assess the scope of identifiers collected, the profiling logic and the transfer of data to the United States. ### Sample text for your banner > We use Attribution to track your interactions across marketing channels and measure which campaigns lead to conversions. This involves profiling and processing in the United States. Do you consent? Cookies and trackers ## What Attribution sets and contacts - Tracking method JavaScript tag, first and third party cookies and server side event ingestion for multi touch attribution across marketing channels - Server location United States - Data transferred outside the EU Attribution is a United States based platform, so personal data including online identifiers and touchpoint history is transferred to the United States. Transfers rely on the EU US Data Privacy Framework where the vendor is certified, otherwise on Standard Contractual Clauses with supplementary measures. ### Cookies set (3) | Name | Type | Duration | Purpose | | --------------- | --------- | ---------- | ------------------------------------------------------------------------------------------------ | | \_attr\_id | Marketing | 2 years | Stores a persistent identifier used to link a visitor across sessions and marketing touchpoints. | | \_attr\_session | Marketing | 30 minutes | Identifies the current visit so events can be grouped into a single session for attribution. | | \_attr\_ref | Marketing | 90 days | Captures the referring campaign and source so conversions can be credited to the right channel. | ### Third-party domains contacted (3) - `attributionapp.com` - `api.attributionapp.com` - `track.attributionapp.com` Questions ## Frequently asked questions about Attribution Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Attribution set cookies? Yes. Attribution sets first and third party cookies and processes online identifiers to connect a visitor across touchpoints and sessions. Run a cookie scan so you can list each cookie and its duration accurately. ### Is consent required to use Attribution? Yes. Because Attribution tracks users across channels and builds profiles, you need prior, freely given consent before any tag or cookie loads. Keep it blocked until the visitor opts in. ### What is the legal basis for Attribution? The appropriate legal basis is consent under Article 6(1)(a) GDPR. Given the profiling involved, legitimate interest is generally not adequate for this kind of cross channel marketing measurement. ### Does Attribution transfer data to the United States? Yes. Attribution is United States based, so identifiers and touchpoint history are transferred there. Rely on the EU US Data Privacy Framework if the vendor is certified, otherwise on Standard Contractual Clauses with a transfer impact assessment. ### Do I need a DPIA for Attribution? Yes. Systematic cross channel tracking and profiling is high risk under the GDPR, so a data protection impact assessment is required. Document the identifiers collected, the profiling logic and the United States transfer. ### How do I implement Attribution compliantly? Gate the tag behind a consent management platform, connect it to Google Consent Mode where relevant and minimise the identifiers you send. Complete a DPIA, verify the transfer mechanism and disclose the profiling in your privacy policy. ### What are the alternatives to Attribution? EU hosted or privacy first attribution and analytics tools, or consent aware server side measurement, can reduce transfer and profiling risk. Whatever you choose, apply consent, minimisation and documentation consistently. ### How do I update my cookie policy for Attribution? Add Attribution to the marketing or analytics category, describe the cross touchpoint tracking and profiling, list the cookies and their durations and disclose the United States transfer. Refresh the notice whenever your setup changes. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Actirise](https://www.flowconsent.com/en/services/analytics/actirise) [Actirise is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Actirise supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Actirise enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/actirise) [Analytics](https://www.flowconsent.com/en/services/analytics/actirise) · ### [Simon](https://www.flowconsent.com/en/services/analytics/simon) [Simon is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Simon supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Simon enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/simon) [Analytics](https://www.flowconsent.com/en/services/analytics/simon) · ### [SniperFast](https://www.flowconsent.com/en/services/analytics/sniperfast) [SniperFast is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. SniperFast offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, SniperFast empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/sniperfast) [Analytics](https://www.flowconsent.com/en/services/analytics/sniperfast) · ### [Tealium AudienceStream](https://www.flowconsent.com/en/services/analytics/tealium-audiencestream) [Tealium AudienceStream is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Tealium AudienceStream supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Tealium AudienceStream ensures your website delivers a smooth, uninterrupted experience to every visitor and.](https://www.flowconsent.com/en/services/analytics/tealium-audiencestream) [Analytics](https://www.flowconsent.com/en/services/analytics/tealium-audiencestream) · ### [Crazy Egg](https://www.flowconsent.com/en/services/analytics/crazy-egg) [Crazy Egg is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Crazy Egg offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Crazy Egg empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/crazy-egg) [Analytics](https://www.flowconsent.com/en/services/analytics/crazy-egg) · ### [Microsoft Power BI](https://www.flowconsent.com/en/services/analytics/microsoft-power-bi) [Microsoft Power BI is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Microsoft Power BI supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Microsoft Power BI enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/microsoft-power-bi) [Analytics](https://www.flowconsent.com/en/services/analytics/microsoft-power-bi) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)