How to measure social media ROI without third-party cookies

What to take away

Where platform data still helps

Social platforms still return usable numbers. Meta's Conversions API and TikTok's Events API pass server-side events from your own systems. What comes back is modelled and deduplicated, not observed end to end. Treat platform ROAS as directional and corroborate it before you set budget on it.

The bigger loss is cross-platform comparison. Each platform credits itself for the same purchase, and none sees the sale that arrived by phone. That overlap is why a single blended ROAS figure misleads boards.

What UK rules require before you count a click

PECR requires consent to store or read information on a visitor's device, unless the storage is strictly necessary for the service they asked for. Consent rules come before any measurement question.

Analytics and advertising pixels do not meet that test, so a reject-all choice must stop them firing. The ICO's direct marketing and privacy and electronic communications guidance explains valid consent.

Personal data in the event stream is also covered by UK GDPR, which the Data Protection Act 2018 supplements. A hashed email address is still personal data when you can link it back to a person, so record a lawful basis and a retention period for every field you send server-side. The ICO's UK GDPR guide is the starting reference.

Consent records need a timestamp and the version of the notice shown. If a template changes, the old consent does not carry forward.

Keep the permission layer and the arithmetic apart. A measurement register that keeps permission logic outside the arithmetic shows how to record consent state once and reference it from every calculation, so a withdrawal removes the row without changing the method.

A three-signal model for social ROI

Use all three in the same report and label each one. First-party events carry the counted number. Platform data explains which creative and audience did the work. The holdout tells you how much of that counted number the spend actually caused.

Worked example with a £20,000 social budget

An illustrative UK retailer spends £20,000 on Meta and TikTok across eight weeks. Consented first-party analytics record 480 purchases from paid social at an average order value of £108, giving £51,840, which looks like a 2.6 return. Assume a holdout in one region shows roughly a quarter of those buyers would have purchased anyway.

Strip that quarter out and the incremental figure sits near £38,880, a return of about 1.9. Report the range as £34,000 to £48,000 of incremental revenue, or 1.7 to 2.4, and state that these figures are illustrative rather than measured.

Where marketing mix modelling fits

Platform exports get thinner every year, which pushes longer-running social budgets towards aggregate methods. Marketing mix modelling regresses sales on media spend and other drivers over many months, so it can estimate social contribution without tracking anyone. It needs clean spend data and at least two years of history, and it cannot judge a single creative.

Teams that want this argued through before committing budget can read whether cookieless attribution works in practice, which sets out what can and cannot be closed from first-party data alone.

Common questions

Can we measure social at all without consent?

Partly. You can count events from people who agreed, and you can use aggregate or modelled data that does not identify anyone. What you cannot do is set a pixel for a visitor who declined and then call the result coverage.

Is Meta's reported ROAS worth reading?

Yes, but only as creative and audience direction. It is modelled, it double-counts across platforms, and it rarely reflects refunds. Use it to compare campaigns, never to justify a budget on its own.

How long should a social holdout test run?

Long enough to gather a stable conversion count in both cells, which for most UK advertisers means four to eight weeks. Shorter tests measure weekday noise more than they measure lift.