Privacy-first attribution keeps customer data yours: A vendor that collects on your site becomes a holder of your customers' data. Three consequences that only become visible at the audit, or at the exit.
Read the full article below for detailed insights and actionable strategies.
The attribution problem
One sale. Four channels. 400% credit claimed.
Reported revenue: €400 · Actual revenue: €100 · Gap: €300
A measurement vendor that collects on your site is holding your customers' data, and both your disclosure obligations and your exit costs follow from that. Neither becomes visible until an audit or a cancellation, which is why the question gets deferred.
Three consequences
| Consequence | When it surfaces | What it costs |
|---|---|---|
| Sub-processor disclosure | At the next privacy review | Administrative, until a specific question is asked |
| Liability surface | If the vendor has an incident | Yours to explain, whatever the contract says |
| Exit cost | At cancellation | The history stops being reproducible |
The second is the one worth thinking about. Your customers gave their data to you. A processing agreement allocates responsibility contractually, and it does not change who your customers believe they dealt with. When something goes wrong the explaining is yours.
The exit cost, specifically
If a vendor collected the underlying data, then the raw material of your measurement history is in their systems. You can usually export a summary. You cannot re-run last year through a different method, because the collection stops with the contract and the raw records were never in an account you controlled.
An export-based read has the opposite structure. The raw material is your own Google Analytics account, so any window you can still export you can re-read through any method, this year or later. Leaving costs you the tool, not the history. That argument in full is you do not own your attribution data.
What "we are GDPR compliant" does and does not tell you
It tells you the vendor has done the paperwork. It does not tell you where the data sits, who the onward sub-processors are, what the transfer basis is, or how long records are kept. Those are four separate questions and they have specific answers.
Ask for them in writing before the first invoice. A vendor with good answers will send them quickly, because they have written them before. The European specifics are in GDPR-compliant attribution for European ecommerce.
Our position, stated plainly
Causality Engine reads a CSV export you produce and adds nothing to your site: no tag, no cookie, no identifier, no additional collection from your visitors. The company is registered in the Netherlands, KVK 92226892, and the handling is documented in the privacy policy rather than described in a sales call.
The first read is €99 once, refundable if it does not move a budget decision, and nothing remains on your storefront afterwards either way. Unlimited uploads, direct integrations, developer API keys and the MCP server sit on Pro at €299 a month.
The question that clarifies everything
Ask a vendor: if we cancel tomorrow, what exactly can we take with us, and in what format? The precision of the answer tells you how the relationship is designed, and it takes one email to find out.
The wider point
Data minimisation is usually presented as a constraint imposed from outside. Treated as a design principle it is also a commercial advantage, because a vendor holding nothing of yours is a vendor you can leave, and a vendor you can leave has to keep earning the renewal.
Related answers
Get attribution insights in your inbox
One email per week. No spam. Unsubscribe anytime.
Key Terms in This Article
Analytics
Analytics is the systematic computational analysis of data. It reveals customer behavior and measures campaign performance.
Attribution
Attribution identifies user actions that contribute to a desired outcome and assigns value to each. It reveals which marketing touchpoints drive conversions.
Causality
Causality is the relationship where one event directly causes another, essential for identifying specific actions that drive desired outcomes in marketing.
Cookie
Cookie is a small piece of data stored on a user's computer by a web browser, used for tracking behavior, personalizing content, and remembering preferences.
GDPR
GDPR is a European Union regulation governing data protection and privacy, impacting how businesses collect and process customer data.
Google Analytics
Google Analytics is a web analytics service that tracks and reports website traffic.
Multi-Touch Attribution
Multi-Touch Attribution assigns credit to multiple marketing touchpoints across the customer journey. It provides a comprehensive view of channel impact on conversions.
Privacy Policy
Privacy Policy is a statement disclosing how a website collects, uses, discloses, and manages customer data.
Related Articles
Sixty-second versions of these ideas: Causality Engine on YouTube Shorts.
Ready to see your real numbers?
Own the budget? Upload your GA4 export and see which channels drive incremental sales, with confidence intervals, in minutes. Have to defend it? Start with the live demo and take the read to your CFO.
Full refund if you don't see value.
Stay ahead of the attribution curve
Weekly insights on marketing attribution, incrementality testing, and data-driven growth. Written for the person who owns the budget and the person who has to defend it.
No spam. Unsubscribe anytime. We respect your data.