Four anonymised privacy first marketing measurement blueprints for UK businesses

What to take away

Privacy first marketing measurement starts with a decision, not a tool.
Named UK brands now publish first-party measurement products. They include Tesco, Boots, Sainsbury's and M&S.
Ocado, ASOS, the Financial Times, Sky and ITV also run public first-party measurement.
Four anonymised blueprints followa homeware retailer, a B2B consultancy, a subscription operator and a professional body, all based in England and trading across the UK.
Each avoids user-level identifiers, working from order records, cohorts, holdout groups or modelled aggregates.
Every figure in the blueprints is labelled illustrative, because the method matters more than a borrowed number.
Each blueprint says what the business gave up, which is the part usually left out.

Named UK brands and why four blueprints stay anonymised

Named UK brands

UK brand	Public measurement product	First-party signal	Requirement or limit
Tesco	Tesco Media and Insight Platform	Clubcard purchase data	Closed-loop sales uplift; based in Welwyn Garden City
Boots	Boots Media Group	Advantage Card data	Retail media measurement; based in Nottingham
Sainsbury's	Nectar360	Nectar loyalty data	Closed-loop reporting; based in London
M&S	M&S Media Network	Sparks loyalty data	Retail media; based in London
Ocado	Ocado Retail Media	Ocado online grocery data	Sponsored product measurement; based in Hatfield
ASOS	ASOS Media Group	ASOS shopper first-party data	Fashion and beauty campaigns; based in London
Financial Times	FT Smart Match	FT reading and subscription data	No third-party cookies; based in London
Sky	Sky Media AdSmart	Sky set-top box data	Addressable TV reach; based in Isleworth
ITV	ITV Planet V	ITVX registered user data	Addressable advertising; based in London

These brands run measurement from data they already hold: loyalty cards, subscriptions or registered accounts. The common thread is a permission state and an aggregate output.

UK brands and first-party signals

Brand

Tesco: Media and Insight
Boots: Boots Media Group
Sainsbury's: Nectar360
M&S: M&S Media Network
Ocado: Ocado Retail Media
ASOS: ASOS Media Group

Measurement product

Tesco: Clubcard data
Boots: Advantage Card
Sainsbury's: Nectar loyalty
M&S: Sparks loyalty
Ocado: Online grocery data
ASOS: Shopper data

First-party signal

Tesco
Boots
Sainsbury's
M&S
Ocado
ASOS

Attribution work sits close to margins and customer records, so the four blueprints below stay anonymised and their figures are illustrative. The shapes come from work English firms commission.

Read them as blueprints. Pick the one that matches your decision cycle, then test whether your consent records and retention rules could support it.

Example one: a homeware retailer captures purchases on its own server

A homeware retailer sold through its own store and two marketplaces. The link between ad clicks and checkout had broken, because browser storage no longer survived the journey.

Server-side purchase capture

Ad click on marketplace
Browser storage breaks
Server captures purchase event
30-day retention, no cross-site IDs
Order value, channel, consent flag

Its fix was server-side capture of purchase events from its own domain, with a 30-day retention window and no cross-site identifiers. Order value, first-touch channel and a consent flag travelled together.

The ICO guide to the UK GDPR is the reference point for minimisation and retention. The record a reviewer will ask for is set out in our guide to server-side tracking under UK GDPR.

It gave up browsing trails across other sites. It kept a defensible count of purchases by channel.

Example two: a B2B consultancy models contribution instead

A consultancy with nine-month sales cycles could not test clicks. Enquiries arrived by phone, form and referral, so user-level attribution had nothing to attach to.

Modelling output is a range

Range per channel

Monthly spend, pipeline, win rates

Three years of history

Assumptions published

It moved to marketing mix modelling: monthly spend, pipeline value and win rates, regressed over three years of history. Wikipedia's outline of marketing mix modelling is a fair starting point if the method is new to you.

The output is a contribution range per channel rather than a precise number. The consultancy publishes the range and names its assumptions.

Example three: a subscription operator runs a holdout test

A subscription operator wanted to know whether an illustrative £12,000 a month on paid social added subscribers, or merely reached people who would have signed up anyway.

Matched-region holdout test

Control region

Paid social spend: Paused
Duration: Eight weeks
Sign-up measurement: After test
Monthly spend: £12,000 paused

Test region

Paid social spend: Kept
Duration: Eight weeks
Sign-up measurement: After test
Monthly spend: £12,000 kept

It split two matched regions. One kept the spend; the other paused it for eight weeks. Sign-up rates were compared afterwards, not during the test.

The method matches our guide to incrementality testing for UK campaigns, and it needs a business willing to forgo sales in the control region.

Example four: a professional body reports by permission state

A professional body could not treat all members alike. Some had consented to marketing, some to service messages only, and some had withdrawn everything.

Its dashboard splits every metric by permission state, so a fall in email-driven conversions is read against the size of the consented audience, not against last month.

No identifiers reach the reporting layer, and counts below 30 are suppressed.

The four cases side by side

Question

Homeware retailer: Which channel drives checkout?
B2B consultancy: Where should next year's budget go?
Subscription operator: Does paid social add subscribers?
Professional body: Is engagement falling, or is consent shrinking?

Method

Homeware retailer: Server-side purchase events
B2B consultancy: Marketing mix modelling
Subscription operator: Matched-region holdout
Professional body: Permission-state reporting

Kept

Homeware retailer: Order value, channel, consent flag
B2B consultancy: Monthly spend and pipeline
Subscription operator: Incrementality estimate
Professional body: Segmented counts

Given up

Homeware retailer: Cross-site browsing trails
B2B consultancy: User-level journeys
Subscription operator: Sales in the control region
Professional body: Individual email histories

The five steps all four followed

Write down the decision the measurement must settle, and the date it is needed.
List the fields the decision needs, then delete every field it does not.
Fix the lawful basis and retention period before any event is collected.
Build a controla holdout, a baseline month or a matched region.
Publish the uncertainty alongside the number, including the range and the assumptions.

Where the rules bite

Device storage and access still need consent under the Privacy and Electronic Communications Regulations. The ICO's direct marketing and privacy guidance is the working reference for that.

Server-side capture does not remove the need for a lawful basis. Measurement data about a person is personal data, so the ICO's UK GDPR guidance sits behind every example above.

Common questions

Do these examples need consent for analytics?

In most cases, yes. Storing or reading information on a device needs consent under PECR, and a lawful basis question follows separately.

Can a small English firm copy one without a data team?

Yes. Example four is a query change inside the existing reporting tool, and example one's event work can sit with an agency on a fixed scope.

How long before the numbers are usable?

Allow six to twelve weeks of clean data for the server-side case. A holdout test needs its full window before anyone reads a result.

What if the measurement disagrees with the platform report?

Expect it. Platforms count their own view of the same events. Your internal figure ties to order records, so report both and explain the gap.