What makes an attribution method privacy-first?

That its smallest required unit of data is an aggregate rather than an individual journey. A method that needs person-level sequences and anonymises them afterwards is minimising, which a later product decision can reverse. A method that never needed them cannot.

Do aggregate methods produce weaker estimates?

In principle a well-observed individual-level dataset supports tighter estimates. In practice that dataset no longer exists at full coverage for most brands, so the comparison is between an aggregate estimate with honest intervals and an individual-level estimate on a biased subset.

What a privacy-first attribution standard looks like

Privacy-first is either a property of the method or a sticker on the marketing site. Four tests that tell you which one you are being sold.

Three platforms, three answers, one budget to defend. Your GA4 export already holds the answer, and the first finding is free and never leaves your browser. Get your first finding free

By Joris van Huët, Founder & CEOUpdated 2026-10-063 min read

Privacy-first is a property of what a method needs, not a claim on a marketing page. A tool that requires individual-level journeys and then anonymises them is minimising after the fact. A tool that never needed them is a different design.

The distinction matters because minimisation can be reversed by a product decision and a design cannot.

Four tests

Test	Privacy-first answer	Minimised-afterwards answer
What is the smallest unit it needs?	Aggregate counts by channel and period	An individual journey
Does it work if consent drops to half?	Yes, with wider intervals	Coverage collapses
What does it add to your site?	Nothing	A tag, sometimes in checkout
Where does the data sit?	Named region, in the policy	"Global infrastructure"

If half your visitors refuse consent, half the sequences are unobservable, and the model runs on the consenting half while reporting as though it described everyone.

That is not a compliance failure. It is a validity failure that compliance happens to cause.

Why aggregates hold up

An aggregate method asks how orders moved when spend moved, across periods and regions. It never needs to know who anyone is. Consent refusal reduces the precision of the underlying counts a little; it does not remove the comparison. Ad blocking has the same limited effect for the same reason.

That robustness is the actual argument for aggregate methods, and it is a measurement argument rather than a legal one. The legal benefit is real and secondary. We laid out the European specifics in GDPR-compliant attribution for European ecommerce.

The honest limits of the aggregate approach

It cannot tell you about sequence, it cannot personalise, and it cannot answer questions about individuals. If your organisation needs those, an aggregate method is the wrong tool and no amount of privacy positioning changes that.

It also produces wider intervals than a well-observed individual-level dataset would in principle produce, which is a real statistical cost.

What to ask a vendor

Ask what happens to their output when consent rates fall by twenty points. A vendor with an aggregate design will describe wider intervals. A vendor with an individual-level design will describe modelling that fills the gap, and the follow-up question is what that modelling assumes about the people who refused.

The general vendor-questioning framework is in the checklist for vetting an attribution vendor.

Where we stand

Causality Engine estimates per-channel causal effect from a Google Analytics CSV export that you produce. The company is registered in the Netherlands and the handling is set out in the privacy policy.

First read is €99 once, refundable within 30 days, no questions asked.

The principle

Design for the data you can defend collecting, then find out what that data can answer.

Frequently asked questions

What makes an attribution method privacy-first?
That its smallest required unit of data is an aggregate rather than an individual journey. A method that needs person-level sequences and anonymises them afterwards is minimising, which a later product decision can reverse. A method that never needed them cannot.
What happens to multi-touch attribution when consent rates fall?
The observable sequences shrink to the consenting subset, and the model runs on that subset while reporting as though it described everyone. That is a validity problem caused by compliance rather than a compliance problem in itself.
Do aggregate methods produce weaker estimates?
In principle a well-observed individual-level dataset supports tighter estimates. In practice that dataset no longer exists at full coverage for most brands, so the comparison is between an aggregate estimate with honest intervals and an individual-level estimate on a biased subset.

Go deeper: Incrementality testing, explained.

Sixty-second versions of these ideas: Causality Engine on YouTube Shorts.

Have an audience of ecommerce operators? Earn 20% recurring commission by recommending the €99 read.

Keep reading

Terms in this article

Browse the full glossary