Privacy-first attribution keeps customer data yours
A vendor that collects on your site becomes a holder of your customers' data. Three consequences that only become visible at the audit, or at the exit.
Three platforms, three answers, one budget to defend. Your GA4 export already holds the answer, and the first finding is free and never leaves your browser. Get your first finding free
By Joris van Huët, Founder & CEOUpdated 3 min read
A measurement vendor that collects on your site is holding your customers' data, and both your disclosure obligations and your exit costs follow from that. Neither becomes visible until an audit or a cancellation, which is why the question gets deferred.
Three consequences
| Consequence | When it surfaces | What it costs |
|---|---|---|
| Sub-processor disclosure | At the next privacy review | Administrative, until a specific question is asked |
| Liability surface | If the vendor has an incident | Yours to explain, whatever the contract says |
| Exit cost | At cancellation | The history stops being reproducible |
The second is the one worth thinking about. Your customers gave their data to you. A processing agreement allocates responsibility contractually, and it does not change who your customers believe they dealt with. When something goes wrong the explaining is yours.
The exit cost, specifically
If a vendor collected the underlying data, then the raw material of your measurement history is in their systems. You can usually export a summary. You cannot re-run last year through a different method, because the collection stops with the contract and the raw records were never in an account you controlled.
An export-based read has the opposite structure. The raw material is your own Google Analytics account, so any window you can still export you can re-read through any method, this year or later. Leaving costs you the tool, not the history. That argument in full is you do not own your attribution data.
What "we are GDPR compliant" does and does not tell you
It tells you the vendor has done the paperwork. It does not tell you where the data sits, who the onward sub-processors are, what the transfer basis is, or how long records are kept. Those are four separate questions and they have specific answers.
Ask for them in writing before the first invoice. A vendor with good answers will send them quickly, because they have written them before. The European specifics are in GDPR-compliant attribution for European ecommerce.
Our position, stated plainly
Causality Engine reads a CSV export you produce and adds nothing to your site: no tag, no cookie, no identifier, no additional collection from your visitors. The company is registered in the Netherlands, KVK 92226892, and the handling is documented in the privacy policy rather than described in a sales call.
The first read is €99 once, refundable within 30 days, no questions asked, and nothing remains on your storefront afterwards either way.
The question that clarifies everything
Ask a vendor: if we cancel tomorrow, what exactly can we take with us, and in what format? The precision of the answer tells you how the relationship is designed, and it takes one email to find out.
The wider point
Data minimisation is usually presented as a constraint imposed from outside. Treated as a design principle it is also a commercial advantage, because a vendor holding nothing of yours is a vendor you can leave, and a vendor you can leave has to keep earning the renewal.
Related answers
Frequently asked questions
Who is responsible if my attribution vendor has a data incident?
Contractually the responsibility is allocated by your processing agreement. Practically, your customers gave their data to you and will expect you to explain what happened, regardless of which company operated the system that failed.What should I ask a vendor about data handling?
Where the data physically sits, who the onward sub-processors are, what the transfer basis is, and how long records are retained. A statement that they are compliant answers none of those four, and a good vendor has the answers already written down.What can I take with me if I cancel an attribution tool?
Ask before signing, and get it in writing. If the vendor collected the underlying data, you can usually export summaries but cannot re-run past periods through another method. If the source data was always your own analytics export, you keep everything that matters.
Go deeper: Causal attribution, explained.
Sixty-second versions of these ideas: Causality Engine on YouTube Shorts.
Have an audience of ecommerce operators? Earn 20% recurring commission by recommending the €99 read.
Keep reading
Terms in this article
- AnalyticsAnalytics is the systematic computational analysis of data. It reveals customer behavior and measures campaign performance.
- AttributionAttribution identifies user actions that contribute to a desired outcome and assigns value to each. It reveals which marketing touchpoints drive conversions.
- CausalityCausality is the relationship where one event directly causes another, essential for identifying specific actions that drive desired outcomes in marketing.
- CookieCookie is a small piece of data stored on a user's computer by a web browser, used for tracking behavior, personalizing content, and remembering preferences.
- GDPRGDPR is a European Union regulation governing data protection and privacy, impacting how businesses collect and process customer data.
- Google AnalyticsGoogle Analytics is a web analytics service that tracks and reports website traffic.
- Multi-Touch AttributionMulti-Touch Attribution assigns credit to multiple marketing touchpoints across the customer journey. It provides a complete view of channel impact on conversions.
- Privacy PolicyPrivacy Policy is a statement disclosing how a website collects, uses, discloses, and manages customer data.