Cookieless attribution in the UK: is it actually possible?

What to take away

Cookieless attribution is possible in the UK, but only where the identifier stays inside your own systems or a processor's, under a basis you can document.
Third-party cookie loss removes one signal, not the legal test: UK GDPR still applies to data that can single out a person.
Deterministic, server-side and modelled measurement answer different questions, so match the route to the decision you must make.
Report ranges and assumptions rather than a single revenue figure, because the unobserved share is now larger.

What the cookie change removes

Third-party cookies gave marketers a shared identifier across sites. Their withdrawal removes that shared key, not the ability to connect a visit to a sale. Where your own site, checkout and CRM pass a stable reference, attribution still works.

The harder loss is cross-site reach. Without a shared key you cannot follow one person from a publisher page to your basket. That gap is filled by consented identity, by modelling, or by testing rather than tracking.

Where UK law bites

UK GDPR covers personal data, and an identifier that singles out one person usually counts even without a name. The definition sits in Article 4 of the UK GDPR, so pseudonymous IDs in your warehouse stay inside the law.

Storing or reading information on a device needs consent under PECR, apart from strictly necessary purposes. The ICO's guidance on direct marketing and privacy and electronic communications sets out that consent standard.

Consent is not the only lawful basis, but it is the safest for tracking. Legitimate interests can cover some analytics, and the ICO's UK GDPR guidance expects a documented balancing test rather than an assertion.

Three routes that survive without cookies

Cookieless attribution in the UK usually means one of three routes. Each answers a different question, so choose the route before the vendor.

Three cookieless attribution routes

First-party identity

Data source: Sign-in, email, loyalty
Match strength: Strongest
Main duty: Consent and retention
Speed: Fast
Cross-site ID: Not needed

Server-side + modelled

Data source: Own-domain events
Match strength: Estimated
Main duty: Label estimates
Speed: Fast
Cross-site ID: Not needed

Incrementality testing

Data source: Holdout and control
Match strength: Measured lift
Main duty: Pre-register metric
Speed: Slower per test
Cross-site ID: Not needed

First-party identitysign-in, email or loyalty data joined inside your own warehouse. Strongest match rates, heaviest duties on consent and retention.
Server-side and modelled conversioncollect events on your own domain, then let the platform estimate the unobserved share. Label every estimate as an estimate.
Incrementality testinghold out a group, compare against a control, and treat the measured lift as contribution. Slower per test, and it needs no cross-site identifier.

Last interaction, platform modelling and controlled incrementality produce different numbers from the same traffic. A side-by-side view of privacy first attribution models makes those gaps visible before you commit budget.

Comparing the routes

The table sets out what each route tells you, and what it leaves out. Read it against the decision you actually have to make.

Table comparing four attribution routes by use, limitation and record kept (Cookieless attribution in the UK: is it actually possible?) — Read the table against the decision you actually have to make, not against the vendor pitch. Image: Privacy Measurement

Best for

First-party identity: Known customers and repeat purchase
Server-side plus modelled conversion: Campaign optimisation at scale
Incrementality test: Proving lift on one budget line
Marketing mix modelling: Channel-level budget splits

Main limitation

First-party identity: No view of anonymous visitors
Server-side plus modelled conversion: Estimate varies by platform
Incrementality test: Time and cost per test
Marketing mix modelling: Too coarse for creative decisions

Record to keep

First-party identity: Consent state and join keys
Server-side plus modelled conversion: Model version and calibration window
Incrementality test: Holdout design and pre-registered metric
Marketing mix modelling: Spend, seasonality and coverage notes

Consent states change the arithmetic

Consent choices split your traffic into groups, and each group has different coverage. Visitors who reject analytics still convert, so an uncorrected report understates sales.

Flag the permission state on every event and report consented and unconsented totals separately. Modelling can fill the gap, but state that assumption in the same chart.

Consent rates also drift with banner design and season, so a month-on-month comparison belongs in the report rather than a footnote.

What to put in writing

Before switching anything on, record the lawful basis, the identifier, the retention period and the accountable person. A reviewer should follow the trail from an event to a report without asking you.

Server-side collection moves the tag onto your own domain, and a server-side tracking under UK GDPR checklist keeps the lawful basis beside the architecture. Reviews tend to fail at that join.

Common questions

Does the ICO ban probabilistic attribution?

No. The ICO's position is that data which singles out a person is personal data, whatever label the technique carries. Probabilistic matching can still be lawful with a valid basis and honest transparency.

Can we run Google Analytics 4 without consent?

Only where an exemption applies, and analytics cookies rarely count as strictly necessary. Most UK sites therefore ask for consent before GA4 sets identifiers, then set retention to match their policy.

Is server-side tracking a way around consent?

No. Moving collection to your own server changes who holds the data, not the test for storing or reading information on a device. The client-side write still needs a basis.

What should we report instead of exact revenue?

Report ranges with the assumptions attached. Name the model version, the calibration window and the share of conversions you could not observe.