Shopify Attribution Cookies Explained: _shopify_sa_p, _shopify_sa_t, and UTM Tracking

Shopify Attribution Cookies Explained: _shopify_sa_p, _shopify_sa_t, and UTM Tracking

Shopify's built-in marketing attribution relies on two first-party cookies: _shopify_sa_p and _shopify_sa_t. These cookies capture where visitors come from, store that data in the browser, and connect it to purchases. For thousands of Shopify stores, these cookies are the entire attribution system. Understanding exactly what they do, what data they hold, and where they break is essential before you can decide whether to supplement or replace them.

The Two Cookies and Their Roles

_shopify_sa_p: The Persistent Cookie

This cookie records first-touch attribution data. When a visitor arrives at your store for the first time, Shopify's JavaScript writes source, medium, campaign, and referrer information into _shopify_sa_p. On subsequent visits from different sources, this cookie is not overwritten. It preserves the original acquisition channel.

If a customer first discovers your store through a Meta ad, _shopify_sa_p records facebook / cpc / summer_campaign. If that customer returns a week later through a Google Ads branded search click, the persistent cookie still shows Meta. It answers the question: what channel originally brought this person to us?

_shopify_sa_t: The Temporary Cookie

This cookie records last-touch data. Unlike the persistent cookie, it updates every time a visitor arrives from a new identifiable source. It always reflects the most recent marketing touchpoint. Shopify's default reporting uses this cookie to credit sales, which means whichever channel drove the final visit before purchase gets 100% of the revenue credit.

How UTM Parameters Feed the Cookies

Both cookies rely heavily on UTM parameters. When a visitor clicks a link containing utm_source, utm_medium, and utm_campaign, Shopify's JavaScript parses these values and writes them to the appropriate cookie. If no UTM parameters are present, Shopify falls back to referrer-based inference: it checks document.referrer, attempts to identify the source domain, and assigns a generic source and medium.

UTM parameters always take priority over referrer inference. This means a well-tagged Meta Ads campaign URL with utm_source=facebook&utm_medium=cpc&utm_campaign=prospecting_q3 produces clean attribution data. A link shared in a Facebook group without UTMs might be logged as facebook / referral or, if the referrer header is stripped, as direct / none.

The practical consequence is that UTM hygiene directly determines cookie quality. Inconsistent tagging across your Google Ads, Meta, email, and influencer campaigns creates attribution data that looks messy and undercounts channels that should be getting credit.

What Data Each Cookie Stores

Both cookies store a JSON-encoded string containing these fields:

The landing_page field is particularly useful for understanding which entry points perform best, but it is underutilized in default Shopify reporting.

A Real-World Attribution Journey

Consider a fashion brand customer with this journey:

1. Monday: Sees a Meta prospecting ad for a new collection. Clicks through. Both cookies set to facebook / cpc / new_collection_launch.
2. Wednesday: Sees a TikTok ad for the same collection. Clicks through. _shopify_sa_p unchanged (still Meta). _shopify_sa_t updates to tiktok / cpc / new_collection_launch.
3. Thursday: Receives a Klaviyo email with a 10% discount. Clicks through. _shopify_sa_p unchanged. _shopify_sa_t updates to klaviyo / email / welcome_series.
4. Thursday evening: Returns directly by typing the URL. _shopify_sa_p unchanged. _shopify_sa_t unchanged (direct visits do not overwrite). Customer purchases.

Shopify credits Klaviyo with the sale (last touch from _shopify_sa_t). The Meta ad that introduced the customer and the TikTok ad that reinforced interest receive zero credit. This is last-click attribution in practice, and it systematically overcredits bottom-funnel channels at the expense of top-funnel discovery.

Where These Cookies Break

Safari ITP: The 7-Day Wall

Apple's Intelligent Tracking Prevention limits JavaScript-set cookies to a maximum of 7 days in Safari. Since Shopify writes _shopify_sa_p and _shopify_sa_t via client-side JavaScript, any Safari visitor who returns after 7 days has their cookies wiped. The returning visitor appears as a brand-new direct visitor.

With Safari accounting for 25-35% of US e-commerce traffic depending on vertical, this creates a systematic blind spot. Beauty brands with mobile-heavy audiences are particularly affected, as Safari's mobile market share is even higher.

Cross-Device Blindness

Cookies are browser-specific. A customer who clicks your ad on their phone and purchases on their laptop has two separate cookie histories that Shopify cannot connect. For stores where 40-60% of traffic is mobile but a significant share of purchases happen on desktop, this creates a structural attribution gap that makes mobile acquisition channels appear less effective than they are.

No View-Through Attribution

These cookies are set only on clicks. If a customer sees your Meta ad five times, develops brand awareness, and later searches your brand name on Google, the cookies credit Google. The Meta impressions that created the demand are invisible to cookie-based tracking. This particularly affects view-through attribution for video-heavy campaigns on TikTok, Instagram Reels, and YouTube.

The 30-Day Expiration

Both cookies expire after 30 days. For products with longer research cycles, such as premium pet food, high-end skincare, or furniture, customers who take more than 30 days from first visit to purchase lose their attribution entirely. They appear as direct visitors regardless of which channel originally acquired them.

How to Overcome the Limitations

Server-Side Cookie Setting

The most impactful upgrade is setting attribution cookies via HTTP response headers from your server rather than via JavaScript. Server-set first-party cookies are not subject to Safari's 7-day cap and can persist for up to 400 days. This requires a server-side tracking setup, typically using a subdomain proxy, but it immediately recovers the 25-35% of journeys lost to ITP.

Enforce UTM Discipline

Create a centralized UTM taxonomy and enforce it across all channels. Every Meta Ads campaign, every Google Ads campaign, every email link, every influencer URL should follow the same naming convention. Document the taxonomy and audit it monthly. Clean input data is the prerequisite for meaningful attribution output.

Supplement with Multi-Touch or Causal Models

Shopify's cookies give you first-touch and last-touch data. To understand the full customer journey, you need a system that applies multi-touch attribution models or, better yet, causal inference methods that estimate what would have happened without each channel.

Platforms that integrate directly with Shopify can combine cookie data with ad platform APIs, email engagement data, and statistical models to produce a more complete picture. For stores spending over $20,000 per month on ads, the revenue lost to misattribution from cookie limitations alone typically exceeds the cost of a proper measurement platform.

Validate with Incrementality Tests

Run periodic incrementality tests on your top channels to ground-truth your attribution data. Turn off a channel in a test market for two weeks and compare revenue to a matched control market. The difference between your cookie-based attribution and the incrementality result tells you how much your current system is over- or under-crediting that channel.

Making the Most of What You Have

Shopify's attribution cookies provide a solid foundation for basic measurement. They are free, require no setup, and give you first-touch and last-touch data out of the box. For stores with simple channel mixes and lower ad spend, they may be sufficient.

But for growing brands, especially pet brands, beauty brands, and fashion brands with multi-channel strategies and significant ad budgets, these cookies are a starting point rather than a destination. Understand what they capture, acknowledge what they miss, and build toward a measurement system that matches your complexity.

To explore how causal attribution fills the gaps that cookie-based tracking leaves behind, get started or request a demo to see the difference in your own data.