Before entering the attribution market, work through this checklist

Market and buyer evidence

• State qualifying offer, buyer, geography, paid status, period
• Record recent buyer decision unresolved by existing process
• Separate official ONS context from purchase evidence
• Set disproof rule and name stop authority

• State the qualifying offer, buyer organisation, England geography rule, paid status and measurement period.
• Record a recent buyer decision that could not be resolved with the existing process. Interest in "better attribution" is not sufficient.
• Keep official context separate from purchase evidence. The ONS 2025 business release describes registered enterprises and local units, not attribution customers.
• Set a disproof rule, such as no verified buying event among the eligible sample, and name the person authorised to stop discovery. Worked example: sample 20 eligible accounts over 90 days; if zero record a verified buying event, stop and record the outcome.

• Classify the job as platform credit allocation, cross-system reconciliation, marketing mix modelling or causal incrementality.
• Define the outcome event, eligible population, period, timezone, source and correction process.
• If causality is claimed, obtain approval from an analyst with evaluation training for the counterfactual and analysis plan. HM Treasury's QPIE guide explains why outcome monitoring alone cannot identify the cause of change.
• Write known confounders, missing channels and incompatible identifiers beside the output.

• Map each field from collection to recipient, model, report, retention and deletion.
• Identify cookies, pixels, tags, link decoration or other storage and access technologies. Recheck the configured purpose against the ICO's April 2026 guidance.
• Keep the UK GDPR assessment and PECR analysis distinct. Do not choose a lawful basis generically through this checklist.
• Test withdrawal, objection, suppression and deletion routes with synthetic records before real data enter the service.

• Assign least-privilege user and service identities, privileged approval, access review and incident ownership.
• Assess the precise hosted configuration. The NCSC notes in its SaaS guidance that a customer remains responsible for use-specific configuration.
• Prove export, restore and reproducibility using authorised test data. Record file formats, keys, dependencies and recovery owner.

• Match each accuracy, lift, return or comparability claim to evidence for the same population and conditions. The ASA's substantiation advice requires evidence for objective claims capable of substantiation before distribution.
• Test the buyer's critical dashboard and export tasks for keyboard and assistive-technology use; do not infer accessibility from a badge or template. Use the GOV.UK accessibility guidance as the named UK reference.
• Record the legal party, exact service, price basis if any, term, acceptance, change process, support, data roles, sub-processors, liability, termination, export and deletion. Use the Crown Commercial Service contract management standards as the named UK reference.

• Set buyer-owned tolerances for reconciliation, missing data, reproducibility and review time. Leave them blank until approved.
• Predefine pause conditions for unexplained data loss, unsafe access, unreviewed tracking, unsupported claims or failed export.
• Issue a dated decision recordproceed, revise, retain the existing process or stop. A successful technical demonstration is not market validation.
• Worked example of a decision recordGate: buyer evidence. Date: 6 September 2026. Finding: 12 verified buying events in a sample of 20 eligible accounts. Decision: proceed. Owner: commercial lead. Next review: 6 October 2026.

• Buyer evidence.
• Question and inference.
• Data and tracking.
• Security and continuity.
• Claims, accessibility and contract.
• Trial decision.