Attribution models: what to believe after the cookie

The industry spent five years preparing for a date, and the date moved and then dissolved. On 22 April 2025 Google announced it would keep its existing approach to third-party cookie choice in Chrome and would not ship the standalone prompt it had been trailing, pointing users instead at Chrome’s existing privacy settings. Third-party cookies are still there for most of your Chrome traffic.

Safari is a different story entirely, and has been for years. WebKit’s position is blunt: cookies for cross-site resources are blocked by default, and a site’s script-writable storage is deleted after seven days of Safari use without user interaction. That second clause is the one that quietly destroys long-window attribution, because it takes first-party storage with it — the cookie your own analytics set is gone if the visitor does not come back within the week.

Put the two together and the practical conclusion is not “attribution is dead”. It is that your measurement gap is the shape of your browser mix. A store whose customers are mostly on iPhones has been living in the post-cookie world for years and its historical data already reflects that. A store selling to desktop Chrome users in a business context has lost much less than the conference talks suggest.

That is the first thing to check, and almost nobody checks it: what proportion of your sessions come from browsers that materially restrict this, and what does your longest plausible consideration window look like against a seven-day storage cap?

The reason your reports disagree is not that one is broken. It is that each answers a different question with a different rule, and each is internally consistent.

Shopify attributes by session against the orders it actually processed. Its default for marketing activity is last non-direct click — all the credit to the last channel before purchase, excluding direct visits — and it also offers last click, first click, any click and linear. Two mechanics are worth knowing because they bound what it can see: the first-interaction referrer is reset if a visitor does not buy within 30 days of the session, and sessions end after 30 minutes of inactivity and at midnight UTC. So a customer who first found you eight weeks ago is not being credited to that discovery, whatever model you choose.

GA4 answers the behavioural question, and its model list is now short. As of November 2023 the first click, linear, time decay and position-based models were removed; what remains is data-driven attribution, paid and organic last click, and Google paid channels last click. The data-driven model is the default in most properties and it is a black box by design — useful for ranking channels, unhelpful when the finance director asks how a number was produced.

The ad platforms each count conversions they believe they influenced, within their own windows, including view-through in some cases. They are marking their own homework, and the arithmetic gives it away: add up the conversions claimed across your accounts and the total will exceed the orders in Shopify. Nothing is malfunctioning. Two platforms both touched the same purchase and both counted it.

Your warehouse, if you have one, answers whatever you ask it. That is a feature and a trap, because a model you wrote yourself is a model nobody else can audit.

The single most useful decision here is organisational rather than technical: name one number as the ledger, and get everyone to argue about the same one.

For most Shopify merchants that should be Shopify’s own reporting. It is joined to the orders, so it cannot drift from revenue; it applies the same rule to every channel, so channels are comparable; and it is visible to finance and marketing at once. Last non-direct click is a defensible default — not because it is true, but because it is consistent, and consistency is what makes a trend readable.

Everything else becomes a diagnostic. GA4 tells you about on-site behaviour and where traffic entered. Platform reporting tells you which creative and audience got engagement — which is genuinely what it is good at. Neither gets a vote on how much revenue a channel produced.

If you want a second lens, use first click alongside your ledger rather than instead of it. The gap between them is informative: channels that look large under first click and small under last non-direct click are doing discovery work that last-touch reporting will always undervalue, and cutting them on last-touch numbers is the classic way to lose a quarter of your new customers and be surprised.

What to stop doing is reconciliation. Hours spent explaining why Meta reports one figure and Shopify another are hours spent on a question with no answer — the two are measuring different things on purpose.

The engineering work that improves measurement is unglamorous and mostly not about models.

Fix your UTMs first. Most attribution problems that get diagnosed as cookie loss are inconsistent tagging: three spellings of a source, campaigns with no medium, links from email that arrive as direct. A published tagging convention that everyone follows will improve your reporting more than any tool you could buy this year.

Capture identity at the first opportunity you legitimately have. An email address at signup, a logged-in customer account, an order — each one stitches sessions together in a way that survives storage caps, because it does not depend on a browser remembering anything. This is the durable answer to the seven-day problem, and it is also just good practice.

Send events server-side where it is worth it. It removes a class of loss from blockers and storage limits. It does not make you exempt from consent, and it is not free to run — so do it for the events that decide money, not for all forty.

Respect consent properly. Shopify’s Customer Privacy API exists so that tracking can be conditioned on consent, and a measurement setup that ignores it is a compliance problem wearing an analytics hat. Missing data from people who declined is not a bug to be engineered around.

Only then consider a warehouse or a mix model. Both are real answers at scale and both are expensive to run. A store doing a few million in revenue is better served by clean tagging, a single ledger and two holdout tests a year.

And keep the site itself in the frame. Attribution arguments are about where traffic came from; the rate at which that traffic converts is usually the larger lever and is measurable without any of this. It is the reason most of our [conversion work](/services/optimize/shopify-conversion-rate-optimization) starts on the page rather than in the reporting.

Attribution is not a measurement problem with a solution you have not bought yet. It is a structural limitation: people encounter brands in places that cannot be instrumented, and the closer your reporting gets to precision, the more confidently wrong it becomes.

So run it as a decision system rather than an accounting system. One consistent ledger for trends. A second model as a check on whether you are starving discovery. Experiments for the questions that move real money. And a standing scepticism towards any number that arrives from the party being paid.

Teams that adopt that posture spend far less time in reporting meetings and make better decisions, mostly because they have stopped trying to settle with data a question that only an experiment can settle.

• Shopify conversion rate optimization
• The data warehouse question
• CDPs, ESPs and the customer record