Attribution and its limits: what the credit report can and cannot tell you

Attribution follows tracked people across digital touchpoints and shares the credit for a conversion among the ones that came before it. See attribution and multi-touch attribution in the glossary. The foundations piece measuring effectiveness introduces it; this piece is about using it well.

• The decision it informs day-to-day optimisation within digital channels: bids, keywords, placements, audiences, creative rotation.
• The models rules-based models share credit by a fixed rule; data-driven models estimate it from the account's own paths. As of 2026 Google Ads offers only last click and data-driven¹.
• What it cannot show whether the conversion would have happened anyway. Observational methods often fail to reproduce what experiments measure⁴.
• The state of tracking in 2026 Chrome keeps third-party cookies with its existing user choice, Google has retired most of its Privacy Sandbox technologies, and on Apple platforms app attribution runs through Apple's own frameworks^6, 7, 8.
• The rule use attribution inside channels; set budgets across channels with the mix model and experiments⁵.

Attribution is fast and granular. It can rank thousands of keywords or placements by the conversions that followed them, every day, which no mix model or experiment can do. That makes it the right tool for tactical decisions inside a channel whose conversions are tracked. The IPA's Making Effectiveness Work gives attribution its place alongside mix modelling and experiments, each with a role and limits, and its MESI loop ends by using what the experiments found to adjust attribution and the model⁵.

It is the wrong tool for deciding how much to spend on a channel, or whether a channel works at all. The rest of this piece explains why.

Rules-based models apply a fixed rule. Under last click, the final keyword in a path with several clicks receives all the credit¹. First click, linear, time decay and position-based models spread the credit in other fixed ways. In 2023 Google retired those four from Google Ads and Google Analytics 4, citing low adoption, and conversion actions that used them were moved to data-driven attribution; last click is still supported^1, 2, 3. Many other tools still offer the full set.

Data-driven attribution uses the account's own data to estimate how much each interaction contributed along the path, and Google makes it the default for most conversion actions¹. It is better than an arbitrary rule because it compares paths that converted with paths that did not. But it still learns only from what was tracked, inside one vendor's view, and it still estimates association. Google's model comparison report, which shows cost per acquisition and return on ad spend under different models, is useful precisely because it makes the sensitivity visible: a campaign that looks weak under last click may look stronger under another model¹.

The core problem is sequence versus cause. An attribution report records that someone saw or clicked an ad and then bought. It cannot say whether they would have bought without the ad. Targeting makes this worse: platforms show ads to the people most likely to buy, so the exposed group differs from the unexposed one before any ad runs. Lewis and Rao, working from 25 large field experiments, describe selection bias as a serious problem for observational methods for exactly this reason¹². Gordon and colleagues compared randomised experiments at Facebook with observational methods on the same campaigns and found that the observational estimates often failed to match the experimental ones, even with extensive demographic and behavioural data⁴.

Three practical consequences follow:

• Channels close to the sale look best Branded search and retargeting meet people who have already decided; they collect credit that television, out-of-home, PR or word of mouth created.
• What is not tracked gets nothing Offline media, a recommendation from a friend, a shop visit and most brand effects are invisible to a path report.
• Each platform grades its own work Two platforms can both claim the same sale; the totals across platforms often exceed actual sales.

The data attribution depends on has narrowed, but not in the way the industry expected for years. In April 2025 Google said it would keep its current approach to offering users third-party cookie choice in Chrome rather than roll out a new standalone prompt⁶. In October 2025 it announced that, after evaluating ecosystem feedback and in light of their low levels of adoption, it would retire further Privacy Sandbox technologies, among them the Attribution Reporting API, IP Protection, Protected Audience and Topics, while keeping CHIPS, FedCM and Private State Tokens⁷. So, as of October 2026, Chrome still has third-party cookies, but there is no browser-provided, privacy-preserving attribution API to replace them.

On Apple platforms, app-install attribution runs through Apple's own frameworks. Apple's documentation points developers to AdAttributionKit, which works with the App Store and alternative app marketplaces, while the older SKAdNetwork works with the App Store; the two interoperate, and an ad network can call both^8, 9. These frameworks report to ad networks through postbacks sent by the system⁸, not through a trail of individual touchpoints, so they do not feed a multi-touch report the way a cookie trail does.

Consent is the other gap. Google's consent mode has two implementations: in basic, tags do not load until the user consents; in advanced, tags load with consent denied by default and send cookieless signals, which Google uses to model conversions, with an advertiser-specific model rather than a general one¹⁰. Either way, part of the conversions in your reports are estimates, and the share changes with your consent rates. Treat consent management as part of measurement, not only compliance.

The IAB draws the strategic conclusion: privacy limits on identifiers and fragmented media delivery are among the reasons aggregate methods such as MMM have returned¹¹.

Start with the plumbing: consistent UTM tagging, one definition of a conversion, a declared attribution window and working consent signals. Then use the model for what it is good at, and treat any channel that wins big under one model and loses under another as a question for an experiment.

Across this track, the mix model sets budgets between channels, experiments establish cause and calibrate the other two, attribution optimises within channels, and brand tracking watches the effects that no path report can see. Attribution earns its place by speed; it loses it when it is asked to answer the budget question alone⁵.

Illustrative, with no real data. An online retailer ranks its campaigns by last-click revenue. Branded search and retargeting sit at the top; online video and a podcast sponsorship sit at the bottom, and the performance team proposes cutting them. The analyst switches to data-driven attribution and runs the model comparison: video gains some credit, the podcast still gets almost none (it is barely tracked). Instead of cutting, the team runs two tests: a holdout on retargeting, and a geo test pausing video in matched regions. The retargeting holdout shows that many of its "conversions" came from people who would have bought anyway; pausing video lowers branded searches in the test regions. The budget moves, but not in the direction the last-click report suggested.

1. Setting budgets across channels from attribution Channels are tracked unequally, so the comparison is biased before it starts.
2. Adding up platform-reported conversions Each platform claims its share; the sum is not your sales.
3. Changing the model every quarter Trends become impossible to read. Freeze it and annotate changes.
4. Ignoring consent rates A fall in reported conversions may be a fall in consent, not in sales.
5. Treating modelled conversions as observed They are estimates; read them as such.
6. Mistaking efficiency for growth Retargeting can look ever more efficient while adding few new buyers.

On Monday:

1. Write down the attribution model, window and conversion definition in use for each platform, and freeze them.
2. Audit the plumbing: UTM conventions, consent signals and the share of conversions that are modelled.
3. Run the model comparison and list the campaigns whose credit moves most; they go on the test list.
4. Stop summing platform-reported conversions in board reports; report actual sales alongside.
5. Book one holdout this quarter on the channel attribution credits most; see incrementality and experiments.
6. Agree that budgets between channels come from the mix model and tests, and record that rule in the measurement framework.
7. Share the rule with the performance marketer and agency teams who work in digital advertising and search.

• Google's help page on attribution models¹, and coverage of the 2023 changes^2, 3.
• Gordon and colleagues on experiments against observational methods⁴; Lewis and Rao on why advertising returns are hard to measure¹².
• The IPA's Making Effectiveness Work⁵ and the IAB on modernising MMM¹¹.
• Google on Chrome and the Privacy Sandbox^6, 7; Apple on AdAttributionKit and SKAdNetwork^8, 9; Google on consent mode¹⁰.
• On IMC Report: measuring effectiveness, objectives and KPIs, the conversion objective, and the glossary entries for first-party data and incrementality.