Cookieless Attribution: Measuring in the ATT and Privacy Era

Cookieless attribution is measurement that works without third-party cookies or device identifiers: built instead on first-party data, privacy-preserving frameworks like Apple’s SKAdNetwork, and aggregate methods that never needed individual trails in the first place.

The honest shape of the era, stated once: Safari and Firefox block third-party cookies outright, Chrome has repeatedly scaled back their reach, and Apple’s App Tracking Transparency made mobile device IDs opt-in. Measurement built on watching individuals move across the internet is structurally over. Measurement itself is fine: it just has to be rebuilt on ground you own. This guide covers what broke, what holds, and how to build the stack that stops caring about the next privacy announcement.

What actually broke with cookies

What broke:

• Third-party cookies: cross-site journey stitching, retargeting audiences, and view-through measurement across the open web. The trail between sites is gone or going.
• Device IDs after ATT: Apple’s App Tracking Transparency made the IDFA opt-in, so deterministic mobile install attribution now covers only consenting users: a fraction of the old coverage.
• Cross-platform journeys: the walled gardens (Google, Meta, Amazon) keep their journeys internal, so the cross-garden view was never yours to keep.

In more detail what was the reasons behind cookieless measurement?

Browser-level blocking. Safari’s ITP and Firefox’s ETP started blocking or heavily truncating third-party cookies by default years ago, and Chrome (the last holdout, with roughly two-thirds of browser share) has been phasing them out too, although it’s not clear when Chorme will stop sharing cookie information. Once the majority of traffic can’t be tracked cross-site, cookie-based attribution simply has no data to work with for a growing share of users.

Regulatory and consent friction. GDPR, ePrivacy, and CCPA-style rules require explicit opt-in for tracking cookies. Consent rates for third-party tracking are often well below 50%, so even where the technology still works, a large chunk of real users decline to be tracked at all.

Structural mismatch with how people actually browse. Cookies live in one browser, on one device. They don’t survive someone switching from phone to laptop, clearing cookies, using incognito mode, or moving between apps and mobile web. Multi-touch, multi-device journeys (which is most journeys now) were never fully visible to cookie-based tracking to begin with. Now, think: how many devices are you using? Or furthermore, how many users are using the same device?

What did not break in a cookieless measurement enviroment?

• First-party cookies: your own site’s sessions, logins and carts work exactly as before.
• Server-side conversion tracking: events recorded on your infrastructure, unaffected by browser policy.
• UTM tagging: campaign labels on links are cookie-independent and still the last universal trail.
• Aggregate methods: anything working from totals rather than individuals never noticed the change.

The fact that we still have several ways to track individuals, doesn’t mean that we are capable of understanding what’s work and what’s not. The idea of modern marketing is multi and cross channel.

ATT and mobile: SKAN and probabilistic attribution

Mobile took the sharpest version of the change. Post-ATT, tracking a user across apps requires their explicit consent, and most users decline. The deterministic install trail: click ad, install app, match device ID, now exists only for the consenting minority.

What replaced it on iOS is SKAdNetwork (SKAN): Apple’s privacy-centric framework that sends ad networks aggregate, delayed conversion signals: postbacks arrive at least 24 hours later, carry limited conversion values, and apply privacy thresholds that suppress small campaigns’ data entirely. Campaign measurement, yes: user-level trails, no.

Alongside SKAN sits probabilistic attribution: statistically matching installs to campaigns from aggregate signals like timing and device characteristics, explicitly without individual identifiers. It’s an estimate with stated uncertainty rather than a followed trail, and done honestly, that’s not a weakness: it’s the same statistical reasoning the rest of modern measurement runs on.

For the mobile-specific tooling built around these constraints, see AppsFlyer attribution, explained.

First-party data: the ground that holds

First-party data is what users share directly with you, and it’s untouched by every change above because you collected it, with consent, on your own infrastructure.

The inventory: your site analytics, logged-in identity (the strongest cross-device stitch there is), server-side conversion events, CRM outcomes, and consented email relationships. A retailer with healthy first-party ground can still see most of what matters: which sessions convert, what logged-in customers do across devices, which campaigns’ UTM-tagged clicks turn into orders recorded server-side.

In practice, four moves build the ground: first-party identity (make logging in worth something), server-side conversion APIs feeding platforms cleanly, strict UTM discipline as the universal trail, and CRM outcomes joined to marketing activity. None of this is glamorous. All of it appreciates in value with every privacy announcement.

Aggregate methods: measurement that never needed the trail

Here’s the structural answer, and MarSci’s home ground: methods that estimate channel influence from aggregate data: totals by week and channel, were never touched by any of this, because they never read a cookie or a device ID in the first place. The cookieless attribution is not lacking methods. There are many and MarSci offers one of them with CDA (causal-driven atrribution). You can read more about our method and it’s differences with the rest of the industry here.

Building the post-cookie stack

The working architecture has three layers, each doing what it’s actually good at:

1. First-party trail: consented journey data on your own ground, for journey insight and conversion recording.
2. Platform-native tools: SKAN and conversion APIs for in-platform optimization, used with the knowledge that each platform grades its own homework.
3. Aggregate causal layer: MMM plus causal attribution over total outcomes, for budget truth across every channel including what no trail can see.

Cross-check the layers on a regular cadence, and let incrementality tests: controlled experiments that prove an effect is real, referee when they disagree.

The real payoff is psychological as much as technical: teams that rebuilt on this stack stopped caring about privacy announcements, because nothing in their budget process depends on the signals being deprecated. That’s the position worth building toward: see MarSci’s data-driven attribution solutions or talk to MarSci.

Frequently Asked Questions