24-06-2025
How Do We Make Attribution Work In A World Of Data Privacy?
John Readman is the CEO of ASK BOSCO, which gives online retailers and marketing agencies the power of AI predictive marketing analytics.
How we track, measure and attribute the success of marketing activity puts many marketers in a cold sweat—whether we're talking about top-level marketing mix models dating back to the 1950s or the complex, hyperpersonalized multichannel attribution models of today.
The shift to digital has, of course, helped. With tools that can track customers throughout their journey, the process looks easier on the surface. But the truth is that the landscape has become even more complex. There's a skill shortage in attribution, and data privacy poses even more complex challenges. Data privacy laws already make handling consumer data a minefield, and there is little optimism that it will become easier. A 2025 Supermetrics survey of 200 marketers from around the globe revealed that 57% predict more difficulty in marketing attribution in the future.
Why Attribution Is So Important Today
It's worth emphasizing why attribution is more vital today than ever. Perceived wisdom, guided by the marketing rule of seven, has taught us that customers typically need to interact with a brand at least seven times before they decide to make a purchase. Today, however, the digital advertising landscape means customers interact with your brand much more often. Data compiled earlier this year shows that customers interact with a brand 28.87 times on average before a conversion.
With that many touchpoints, it's impossible to understand your successes and failures without an effective attribution model. Attribution helps us understand how customers interact at each touchpoint and enables us to determine the effectiveness of each marketing method. With analysis, we can see which aid conversion and then decide how to spend money and resources more effectively in the future.
The Challenges Of Attribution
Historically, access to data has been a stumbling block for many marketers. You may be unable to access data because you're on a small budget, which prevents you from accessing the right measurement software, or you may have a team that lacks the knowledge to implement what you have. Or there may be a disconnect between sales and marketing—creating data silos that prevent useful data from being used to make smarter marketing decisions.
Access to data is also changing due to user behavior. Nearly 33% of internet users now use ad blockers, which, along with blocking ads, also block cookies that allow us to collect and analyze user data.
Data quality is holding many marketers back as well. Research by the Chief Marketing Officer (CMO) Council and GfK in 2022 found that 62% of global marketers are only moderately confident—or worse—about their data.
How Data Privacy Has Affected Attribution
Since its implementation in 2018, the General Data Protection Regulation has radically changed how European marketers use customer data. There are currently no federal laws in the U.S. that are as comprehensive as the GDPR. However, laws like the California Consumer Privacy Act have started an inevitable shift toward increased data privacy. Legislation like this makes businesses legally obligated to process data securely and limit how they share or use it with other organizations. That means considering things like data processing agreements, which establish your roles and obligations as well as those of any organizations you share data with. It also means implementing robust data governance—ensuring all of your consumer data is clean, reliable and consistent. While essential for consumers, these are all things that take extra time and resources for businesses to implement.
There are also other areas of GDPR legislation that companies risk violating. One of the key tenets of GDPR is that data requests from users should be explicit and specific. Bundling together your requests with one checkbox is not considered compliant data collection. And the challenge of data collection post-GDPR doesn't just come from the legislation itself; it comes from users, too. According to GWI data from 2024, 34.5% of adult internet users globally now reject cookies at least some of the time.
Attribution In A Privacy-Focused World
The key to accurate attribution is still first-party data. Collecting your own customer data gives you control over compliance and privacy. While there are still gray areas with uncertainty about how GDPR legislation should be interpreted, this will improve as regulators provide more specific guidelines and enforcement increases. Businesses can ensure compliance in the meantime by implementing robust consent mechanisms, providing clear privacy policies and offering easy opt-out options for users.
Once you have that data, the next challenge is using it. Like attribution, data aggregation has always been complex for businesses with smaller marketing budgets. But technology could hold the answer. Data lakes, for example, can make it easier for organizations to store, manage and analyze large, unstructured datasets. They can also ease privacy concerns by anonymizing data for analysis. While this advanced technology still requires time, money and expertise to use effectively today, artificial intelligence is making it more accessible for companies now and in the future.
Machine learning algorithms can also help evaluate converting and nonconverting paths, giving relative value to each and making it easier for marketers to make decisions based on their data. AI can make working with different attribution models easier by combining deterministic data (e.g., logged-in user behavior) with probabilistic models to create a hybrid approach that better estimates cross-device behavior. It can spot patterns that may not have been visible to you before, and with the introduction of agentic models, it can apply insights to adjust budgets in real time and even make decisions on your behalf.
So, while data privacy makes attribution more challenging than ever, it's a welcome challenge for those who value its intentions. Compliant data collection gives users greater control over their data and helps build trust that is sorely lacking in the modern consumer. Combine that with first-party data and new technology, and we can spend marketing budgets more effectively and deliver experiences to consumers that are truly personalized to their behavior, not just based on assumptions.
Forbes Agency Council is an invitation-only community for executives in successful public relations, media strategy, creative and advertising agencies. Do I qualify?
