Attribution PlaybookMeasurement that survives the browser

Sep 15, 2026 - Attribution Playbook

Why Your Attribution Broke: A Short History of Losing the Signal

Most ecommerce teams know their attribution is worse than it used to be. Fewer can say precisely why, which layer failed, or what a fix actually restores. The erosion came in three distinct waves, and each needs a different response.

Wave one: intelligent tracking prevention

Browser privacy features - led by Safari's ITP - capped the lifespan of cookies set by JavaScript. A shopper who clicked your ad on Monday and bought on Saturday suddenly looked like two different visitors, because the cookie that connected them expired mid-week. Effect: returning visitors were reclassified as new, and multi-touch journeys collapsed into single sessions.

Wave two: ad blockers and tracking protection

Browser extensions and built-in protections began blocking analytics and ad pixels outright. These sessions never appear in your data at all - not misattributed, just absent. Effect: reported traffic and conversions fell below reality, and the missing share skews toward technical, higher-income audiences.

Wave three: cookie deprecation and mobile identifiers

The long phase-out of third-party cookies and mobile ad IDs removed the connective tissue between platforms. Cross-site retargeting and view-through attribution - always the least reliable numbers - degraded most. Effect: platform-reported ROAS diverged further from anything a finance team can verify.

Which fix restores which loss

Wave one's fix is first-party, server-set identifiers with durable lifetimes. Wave two's fix is server-side collection - events sent from your own domain and infrastructure rather than third-party scripts the blocker recognizes. Wave three has no full fix; the honest response is first-party data plus modeled or incrementality-based measurement. The common thread: the closer tracking lives to your own infrastructure and the network edge, the more signal survives.

UTM Case Sensitivity: How Facebook and facebook Split Your Reporting

UTM parameters are case-sensitive. Facebook, facebook, and FACEBOOK are three different sources in your analytics, and the split is usually invisible until the numbers stop adding up.

A marketer builds a campaign link with utm_source=Facebook. Her colleague builds the next one with utm_source=facebook. The analytics tool treats them as two different sources, and the campaign report shows two rows where there should be one, each with half the traffic. Nobody notices for months, because each row looks plausible on its own.

UTM parameters are case-sensitive, and that single fact is responsible for more broken campaign reporting than any other avoidable error. The fix is a naming convention, enforced where the links are made, not where the reports are read.

Why the split happens

Analytics tools do not normalise UTM values. The source, medium, and campaign parameters are taken exactly as written, so Facebook, facebook, and FACEBOOK are three sources, and paid-social, Paid-Social, and paid_social are three mediums. The split is silent: the tool reports each variant faithfully, and the person reading the report has no way to know that two rows are the same campaign.

The damage is in the decisions. A campaign that looks like it underperformed may have half its traffic under a differently capitalised source. A channel that looks like it grew may have just absorbed a spelling variant. Budget moves on numbers that are wrong by a factor that nobody can see in the report itself.

A convention that holds

The convention is simple and strict: all UTM values lowercase, words separated by hyphens, no spaces, no underscores, no capital letters anywhere. Source is the platform, facebook, google, tiktok. Medium is the channel type, cpc, social, email. Campaign is the name and the date, spring-sale-2026, not Spring Sale 2026.

Write the convention down in one place, and put it where links are built. A shared link builder, a spreadsheet with data validation, or a UTM generator with lowercase enforced, all work. A convention that lives in a document nobody opens is not a convention. The enforcement has to be in the tool.

Cleaning up the history

The historical data cannot be fixed in the tool, but it can be fixed in the report. Build a mapping that rolls the variants into the canonical value, Facebook and FACEBOOK into facebook, and apply it in the reporting layer, not by editing the raw data. Keep the mapping in one place so the next person does not have to rediscover it.

Going forward, add a check to the campaign launch checklist: every link gets its UTM parameters checked against the convention before it goes live. The check takes thirty seconds per link. The cleanup after a quarter of split data takes a day, and the decisions made on the split data cannot be unmade.

Related reading: Glossary, About, Gift Orders Break Attribution: The Buyer Is Not the Customer Journey You Tracked.

Frequently asked questions

Are UTM parameters case-sensitive?

Yes. Analytics tools take UTM values exactly as written, so Facebook, facebook, and FACEBOOK are three different sources. The split is silent, because each variant looks plausible on its own in the report.

What UTM convention should a team use?

All values lowercase, words separated by hyphens, no spaces or underscores, no capital letters. Source is the platform, medium is the channel type, campaign is the name and date. Enforce it in the link builder, not in a document.

Can I fix historical UTM splits?

Not in the raw data, but you can fix the report. Build a mapping that rolls variants into the canonical value and apply it in the reporting layer. Keep the mapping in one place so it does not have to be rediscovered.

How do I stop the split happening again?

Add a UTM check to the campaign launch checklist, and enforce lowercase in the tool that builds the links. Thirty seconds per link at launch beats a day of cleanup after a quarter of split data.

Frequently asked questions

Why did attribution get so much worse so quickly?

Several supports fell at once: third party cookies declined, mobile platforms restricted tracking, consent rates cut the observable share, and journeys spread across devices. Each change removed signal the old models quietly depended on.

Is last click attribution still useful for anything?

As a rough operational signal for bottom funnel activity, cautiously. As a budget setting truth it misleads, because it credits the last touch for demand other channels created and cannot see the touches privacy changes hid.

What should replace a single attribution model?

A blend: platform data read with scepticism, controlled experiments and holdouts for big questions, and marketing mix thinking for budget level decisions. No single replacement carries the certainty the old dashboards pretended to.

How should teams talk about attribution uncertainty?

Openly, with ranges and confidence stated. Reports that admit what cannot be observed produce better budget decisions than precise numbers built on a shrinking, biased sample presented as complete.