Reviews
Part of The honest guide to marketing attribution
What a serious marketing attribution checklist covers
Use this marketing attribution checklist to test model choice, conversion windows, identity matching, deduplication, privacy duties, and incrementality.
What to take away
- Approve the intended use and prohibited claims before analysis.
- Identity data needs minimization, access, retention, deletion, and incident controls.
- No attribution result is release-ready until eligible outcomes reconcile.
A marketing attribution checklist should be completed when a model is introduced, a material setting changes, a new outcome is connected, or a result is used for an external claim or major budget decision.
Definition and method gate
| Check | Required record |
|---|---|
| Purpose | Decision, user, owner, cadence, and prohibited use |
| Outcome | Event, source, counting, value, reversal, and maturity |
| Touchpoint | Eligible interaction, taxonomy, exclusions, and deduplication |
| Identity | Unit, identifier, match method, coverage, and collision handling |
| Window | Container, duration, event basis, and reason |
| Model | Family, version, inputs, change behavior, and limitation |
| Reconciliation | Eligible source total, attributed total, and explained difference |
- Outcome and counting:Pass only when the canonical event, source of truth, counting unit, value, reversal treatment, and maturity rule are documented and test records follow those rules.
- Model:Name the model family and implementation. Examples include last-click, linear, time-decay, Markov, and Shapley. Document how the model assigns credit, its inputs, version, and limitations; do not present allocated credit alone as proof of incremental impact.
- Window:Record the configured attribution-window length, whether it applies to clicks, views, or both, and the time zone. Check that the setting matches the decision being made and the observed conversion lag. There is no universal correct window.
- Identity:Record whether matching is deterministic or probabilistic, which identifiers and joins are used, and how cross-device resolution is handled. Report match coverage and missed or incorrect matches against limits set before evaluating results.
Privacy and security gate
The FTC's business guide to protecting personal information recommends assessing what data are kept, retaining only what is needed, protecting it, disposing of it securely, and planning for incidents. Legal duties depend on the organization and jurisdiction. Those duties decide which identifiers measuring marketing attribution is allowed to use at all.
The UK Information Commissioner's Office explains the data protection principles in its regulatory context, including purpose, minimization, accuracy, storage, security, and accountability. It is not legal advice for every market.
For U.S. work, assess whether the California Consumer Privacy Act, as amended by the California Privacy Rights Act, or another state privacy law applies to the data and use. For EU or UK personal data, assess the GDPR or UK GDPR and the Data Protection Act 2018 as applicable. Document the relevant notice, consent, opt-out, retention, and deletion requirements. Where applicable, determine whether a Data Protection Impact Assessment, records of processing activities, or a data processing agreement is required.
- Document purpose and authority for each identifier and outcome
- Limit raw access and prevent unauthorized activation
- Measure match coverage without exposing individuals
- Honor applicable deletion and objection workflows
- Set retention by purpose and obligation
- Test vendor exit, breach response, and deletion confirmation
- For identity resolution or a data clean room, document the join keys, permitted purpose, access controls, and output restrictions. Test that unauthorized joins and exports are blocked.
- If Google Consent Mode or the IAB Europe Transparency and Consent Framework is used, test the signals sent to each destination and behavior when consent is denied or withdrawn. Keep modeled or estimated results distinguishable from observed results.
Release gate
| Area | Pass question |
|---|---|
| Quality | Are missing, late, duplicate, invalid, and modeled records visible? |
| Economics | Are cost and value on the same population and maturity? |
| Sensitivity | Would another plausible model reverse the decision? |
| Causality | Does wording stay within attribution evidence? |
| Change | Are model, window, taxonomy, and identity versions dated? |
| Correction | Can affected users and decisions be traced? |
- Quality and reconciliation:Compare platform records with the defined source of truth at the same event, date, and value scope. Set a reconciliation tolerance before reviewing results, show the observed difference, and explain duplicates, missing or late records, and modeled conversions.
- Deduplication:Document the rule for counting a conversion reported by more than one channel. Test that duplicate records are handled according to that rule in the consolidated report.
- Economics:Match cost and outcome value to the same period, channel, and scope. Document included costs and set any budget decision threshold before assessing the result.
- Sensitivity:Re-run the analysis using relevant alternative models and windows. Record whether the ranking of channels or proposed budget decision changes.
- Causality:Do not infer incremental impact from attributed shares alone. Where feasible, validate with a randomized holdout or other incrementality experiment; document assignment, outcome measurement, and potential contamination. For marketing mix modeling (MMM), document its inputs, controls, assumptions, and validation against experiments or other independent evidence.
- Change and correction:Version the configuration and record which changes trigger a new test. Keep a traceable correction history for reports and decisions.
Store the signed checklist with the model card, data contract, test output, approval, report, decision, and correction history. An exception needs an owner, deadline, temporary control, and a clear statement of what the result may not be used for. Unlogged exceptions are among the costliest marketing attribution mistakes.
Date every approval and exception.
Record the gate result
For every checklist item, record pass, fail, not applicable, or accepted exception. Add the evidence location, reviewer, decision date, and next review. A checked box without proof cannot protect a release. Stop the work when a mandatory privacy, security, data-quality, accessibility, or correction condition fails, even if the remaining score looks favorable.
For a deployment using GA4, record the key-event definition, reporting attribution model, and lookback-window setting. For Google Ads, record the conversion action, counting setting, attribution model, and click-through conversion window. Check the actual configuration in each system rather than assuming its reported conversions are comparable.
For Meta Pixel and Conversions API, verify that browser and server events use the required matching event details for deduplication, including the event ID. Record the tested result and keep platform-reported conversions distinct from the deduplicated cross-channel total.
Keep the evidence record beside the decision so a reviewer can reproduce the reasoning without relying on memory. Set the next review date and name the change that would trigger an earlier check.
Record rejected options and the chosen path, because the original constraint may change. The same record makes marketing attribution benchmarks auditable months later.
Common questions
Does every attribution project need legal review?
Review needs depend on identity data, jurisdictions, contracts, purposes, claims, sharing, and risk. Escalate material uncertainty.
Should an unreconciled report be published?
No. Quarantine the result or narrow the claim until the material difference is explained.
When is the checklist repeated?
Repeat it after material outcome, source, identity, model, window, channel, vendor, privacy, or decision changes.
