Marketing analytics governance in GA4 for Scottish campaigns

What to take away

Scottish governance requirements for marketing analytics platforms

Attribution in Scotland sits inside the UK's single data protection regime. UK GDPR and the Data Protection Act 2018 apply in Edinburgh exactly as they apply in Manchester. PECR adds rules for electronic marketing on top. The Information Commissioner's Office regulates all of it.

Scottish public bodies include the Scottish Government, local authorities such as the City of Edinburgh Council and Glasgow City Council, health boards, and the growing set of non-departmental public bodies. Each has its own records management plan, retention schedule and information governance sign-off. The Public Records (Scotland) Act 2011 requires covered authorities to have a records management plan agreed by the Keeper of the Records of Scotland.

An attribution model that ignores those schedules will produce figures nobody can defend.

For any Scottish public body, document the attribution model and its assumptions alongside the records plan. A campaign return without supporting evidence is difficult to defend.

Governance starts with the claim itself. Write down what the number asserts, which population it covers, and which channels sit inside the boundary. That discipline is set out in the related attribution operations and delivery guide, and it is the cheapest control available.

Lawful basis is the second control. Public task, consent and legitimate interests carry different evidence burdens. A Scottish public body relying on public task for a campaign evaluation still needs to show the processing is necessary and proportionate, and it must record that decision.

Retention is the third. Campaign contact data, click data and survey responses often carry different retention periods. If the attribution window runs longer than the shortest retention period, the model is built on data that should already have been deleted.

The fourth control is the publication route. Who signs off the figure, who can correct it, and how a correction is communicated. A versioned disclosure process solves most of this before the first draft circulates.

Scottish public sector data also carries a distinct freedom of information dimension. The Freedom of Information (Scotland) Act 2002 (FOISA) applies to information held by Scottish public authorities, and the Scottish Information Commissioner oversees its operation. Requests for campaign evaluation material are common, and working papers can fall within scope. Write every note as though it will be read by someone outside the team.

Applying governance controls in GA4

Treat the GA4 property as a governed part of the campaign data flow, not a neutral reporting screen. In GA4 Admin, identify the property owner and campaign web data stream, and restrict property access to staff who need it. Record who can change events, key events, integrations and reporting settings.

Before launch, define campaign events and parameters in a specification that maps each event to the claim boundary and the purpose recorded for processing. Collect only fields needed for that purpose; do not put names, email addresses, phone numbers or other directly identifying personal data in event names, parameters or page URLs.

Set GA4’s data-retention setting in line with the approved retention decision and document what it covers. It does not replace the body’s wider deletion, records-management or partner-data controls. Test tag and consent behaviour before launch and after changes, including what is sent when consent is not given.

Keep dated evidence of the property, data stream, event and key-event definitions, retention choice, access, integrations, consent tests and attribution settings used in published reports. State what the GA4 report supports: observed event paths and attributed outcomes under the selected reporting model, not a counterfactual or causal claim by itself.

What Scottish public campaigns should document in their analytics platform

Scottish public campaigns use public money and face public scrutiny. Their documentation needs to show how the evaluation was planned, carried out and checked.

Start with a campaign record that survives staff turnover. It should name the objective, the audience, the channels, the spend, the delivery dates and the evaluation method. For GA4, record the property and data stream used. Two pages is enough if the content is honest.

Next, a channel inventory. List every place a message appeared and every place a response could be recorded. Include partner activity, paid placements, owned channels and any earned coverage. Attribution fails most often because a channel was never listed.

Then a data map. For each data source, record the lawful basis, the collection point, the retention period, the system of record and the person accountable. For GA4, include the property and data stream, event names and parameters, and the retention setting. This is the document an ICO enquiry would ask for first.

Finally, a decision log. Note when the evaluation method changed and why, including any mid-campaign changes to GA4 events, key events, tags or consent behaviour. Scottish public campaigns rarely run unchanged for a full financial year, and a mid-campaign change to tracking will move the numbers.

Glasgow campaigns often run through arms-length organisations and city partnerships. That adds a data-sharing step. A written data sharing agreement, or a documented controller and processor split, is needed before any partner-level data enters the model. The ICO's Data sharing: a code of practice can help teams structure that agreement.

Edinburgh campaigns frequently involve universities, festivals and tourism bodies. Those partners may hold data under their own notices. Aggregating it into one campaign return without checking each notice is a common error.

Record each data flow, the applicable UK GDPR or PECR considerations, access, retention and publication controls. For GA4, include the relevant property configuration and the consent tests for the campaign. The related UK attribution rules and compliance guide offers further context, but the records for this campaign should set out those details directly.

The checklist below covers the minimum before an evaluation begins.

Direct marketing rules for Scottish public bodies

PECR governs electronic direct marketing. The ICO's guidance, Direct marketing and the public sector, covers how Scottish and Welsh public bodies should approach consent, soft opt-in and the use of personal data for promotional messages.

The practical effect is that a campaign email or text sent to residents is direct marketing, even when the message is civic rather than commercial. Consent records must be specific, and the purpose must be explained at the point of collection. Where consent is the basis, keep a consent log recording the consent status, wording shown and collection point.

Phone contact carries its own rules. Screening against the Telephone Preference Service is expected unless a valid consent exists. Corporate subscribers sit under different rules from individual subscribers, and public bodies contacting businesses still need to check.

Political campaigning guidance matters more than many communications teams expect. The ICO's Guidance for the use of personal data in political campaigning sets out how data may be used to target messages and to evaluate campaign activity. Scottish public campaigns that touch policy debates, referendums or elections fall close to this territory.

The safe position is to treat any campaign that seeks to influence opinion as political for data purposes, and to document the assessment. That does not ban the activity. It forces the reasoning to be written down.

Profiling deserves separate attention. If the model scores individuals or households to decide who receives a message, that is profiling under UK GDPR and may require a data protection impact assessment. The ICO's Data protection impact assessments guidance can inform the assessment; use the public body's approved DPIA form before the campaign, not after.

Evidence a Scottish public campaign needs before claiming return

The core requirement is a counterfactual. A return figure is a comparison between what happened and what would have happened without the campaign. If the second half of that comparison is missing, the number is a description, not a return.

Acceptable counterfactuals include a matched control area, a holdout group, a pre-period comparison with seasonality accounted for, or a modelled baseline with stated assumptions. Each has limits, and the limits belong in the published note.

Uncertainty must be stated. A point estimate with no range invites overclaiming. Give an interval, explain how it was derived, and say what would change it.

Attribution method matters less than consistency. Last click, first click, linear and modelled approaches all produce different splits. In a platform such as Google Analytics 4 (GA4), event and conversion reporting can describe observed journeys, but it does not itself supply a counterfactual or prove campaign causation. Record the reporting model used and check that event and key-event definitions match the claim boundary. The question reviewers ask is whether the method was chosen before the results were seen.

The following illustration is a reporting template, not a measured result.

Illustrative reporting template: a winter health campaign in Glasgow

That structure shows what an evidence-led report should contain. It is unglamorous and it supports scrutiny.

A further test is reproducibility. Could another analyst, given the same data and the same note, reach the same figure? If not, the claim is not ready.

Public campaign return evidence also needs a stated shelf life. A figure that described an eight-week winter push should not be quoted two years later as though it still held.

Where official statistics can and cannot support the claim

The Office for National Statistics produces the UK's core official statistics, and its independence rests on a statutory footing set by the Statistics and Registration Service Act 2007. That Act established the UK Statistics Authority and the Office for Statistics Regulation.

The OSR reviews how official statistics are produced and presented, and its Publications Archive - Office for Statistics Regulation records those reviews. The relevant lesson for campaign teams is that presentation standards exist because numbers can mislead even when they are accurate.

Where official statistics help: population denominators, deprivation measures, health and education baselines, and local authority area profiles. For Scottish baselines, relevant producers include National Records of Scotland (NRS), Public Health Scotland and Scottish Government statistics. Select sources with geography and reference periods that match the campaign. These are legitimate inputs to a counterfactual or a weighting scheme.

Where they cannot help: proving that a specific campaign caused a specific change. National and regional statistics are not designed as campaign controls. Using them that way produces a comparison that is too coarse to support the claim.

A common error is to cite a national trend as the counterfactual. If vaccination uptake rose across the UK, that does not tell you what would have happened in three Glasgow wards without the campaign.

The second error is presentation. Quoting an official figure without its source, reference period and definition breaches the spirit of the OSR's standards, and it will be spotted by anyone who works with the data.

Scottish public bodies also hold their own statistics. Where a body publishes experimental or management information, label it as such. The distinction between official statistics and management information is not decorative.

Keep governance checks local to Scotland throughout the reporting stack; an England-focused guide is further reading, not a substitute for Scottish requirements. The linked attribution measurement guide for England provides wider reporting context.

Common questions