What a real-time alert is actually detecting

Take apart an attribution alert that fired and you usually find one of four causes, and only one of them is a change in your marketing. Knowing the four turns a fire drill into a two-minute triage.

The four

Check them in that order, because the first two account for most firings and take seconds to rule out.

Sampling variation

If the estimate moved less than the width of its own confidence interval, nothing has been detected. The number is a draw from a distribution and it landed somewhere else this week. This is not a subtle statistical point; it is the single most common reason an attribution alert fires.

A collection change

Coverage moving at the same time as an estimate is the signature. A consent banner change, a tag misfiring, an app update that strips referrers, a bot filter adjustment: all of these change what your analytics sees without anything changing in your marketing.

The estimate then shifts because the input shifted. Check coverage first, every time. The concept is explained in the unassigned traffic problem.

A definition change

Somebody regrouped channels, changed a lookback, or a platform quietly updated its default attribution window. Your number moves and your business did not. This is the one that produces the longest investigations, because there is no trace of it in the marketing data at all.

The defence is a written, dated record of your definitions, which is the first step in automating attribution reporting in one afternoon.

An actual change

Last on the list because it is least common, not because it is unimportant. If the first three are ruled out and the timing lines up with a spend or creative change, you have found something real, and the right response is to design a test rather than to act immediately.

Why this list is an argument against alerting

If three of four firings are artefacts, an alerting scheme is mostly a machine for generating investigations. A recurring review with the four checks built into its agenda catches the same real changes and produces far fewer false ones. The case is in a weekly budget review instead of alerts.

What our read gives you for the triage

Every channel gets a data-health score from 0 to 100 that grades the read, not the channel, and a next step: raise, cut or hold, or fix tagging first. From a Google Analytics export, €99 for a first read, refundable within 30 days, no questions asked. No alerting layer and no automated budget action, as explained in why real-time attribution alerts mislead.

The triage in one line

Smaller than the interval, coverage moved, definitions changed, or something real. In that order, every time.

Related answers

• The cost of reacting to attribution noise
• Build a weekly budget review instead of alerts
• Own your alert rules, not the vendor defaults
• What continuous monitoring catches early