Matching attribution tools to jobs, and what each must show first

What to take away

Pick the job before the product

Write the decision in one sentence and choose the job that produces its evidence. Platform credit allocation, cross-system reconciliation, marketing mix modelling, experiment management and general analytics answer different questions, so no tool is judged until its job is fixed.

Record the outcome, eligible population, geography rule, period, channels, data sources and evidence standard. If the question is whether one intervention caused extra orders, a platform attribution report is no substitute for a credible counterfactual.

The buyer's existing spreadsheet, database queries and manual reconciliation belong in that matrix too. They may be slower, but they show whether a new supplier adds a needed capability or merely changes the interface.

Credit and reporting: GA4 and Adobe

Google Analytics 4 assigns credit under documented attribution models for a defined property. Its standard tier carries no licence fee, while the 360 tier is quote-based. The admission file must name the property and the model in use.

Adobe Customer Journey Analytics spans datasets in the Adobe Experience Platform and is licensed on ingested event volume. Ask which datasets feed the analysis and how the volume is counted, because that count sets the commercial unit.

Neither product turns credit into cause. HM Treasury's 2026 Magenta Book distinguishes process, impact and value-for-money evaluation in its public-sector context. Its logic is useful here without implying government approval of any commercial method.

Collection and analytics: Snowplow, Matomo and Piwik PRO

A free, self-hosted tool is not exempt from admission. Matomo On-Premise runs on the buyer's own servers, and Snowplow's open-source tracker can run in the buyer's cloud account. Both still need edition, support and connector evidence.

Ask where collected events land, who administers the environment and which connectors are supported. Collection tools show descriptive events and journeys within a specified collection design, so their coverage must be stated rather than assumed to be the whole population.

Piwik PRO publishes a free tier for small volumes. A free tier changes the price, not the evidence required, so the same file applies to it as to a paid plan.

Mobile and lead tracking: AppsFlyer, Adjust, Branch and Ruler

AppsFlyer, Adjust and Branch are mobile measurement partners. They cover app-install attribution and Apple's SKAdNetwork, and they are quote-based per app with monthly minimums. Ask which app, which unit and which minimum a quote covers.

Mobile measurement contracts show a pattern worth checking: billing, contracting and hosting can sit in different entities. Record each entity before any data flows, because the contracting party is not always the processing party.

Ruler Analytics ties calls, forms and chat to revenue, and suits lead-generation businesses on a monthly subscription. Ask which lead sources it ties to revenue and how an unmatched call or form is shown.

Modelling and experiments: Robyn, Meridian, Eppo and Optimizely

Meta's Robyn and Google's Meridian are open-source marketing mix modelling packages. Both are free to run, and neither comes with a supplier licence to procure. Open-source packages carry a licence, not a warranty, so validation belongs to the buyer.

For a modelled service, obtain the method name, version and change history. Ask for the training or calibration boundary, validation evidence, uncertainty output and known failure conditions. The buyer's statistics reviewer decides whether these support the stated decision.

Eppo and Optimizely cover experiment assignment and analysis in different deployment models: Eppo works inside the buyer's warehouse, while Optimizely runs as a hosted service. Ask where assignment data lives and who can read it.

Start every candidate with an admission file

A candidate should not enter comparison because its website uses the word attribution. Require a dated evidence pack for the legal entity and exact service, edition and proposed contract. England or UK availability needs an explicit supplier record or a written offer, not an inference from an English-language page.

Supplier documentation can establish what the supplier says. It does not independently prove accuracy, coverage, causal validity, security, accessibility or suitability. Tag each record as supplier claim, contract commitment, buyer test evidence, independent authority or unknown.

Check the entity behind the service

Record the contracting party's company number, registered jurisdiction, status and filing date where applicable. Companies House explains in its register search guidance what public company information its service provides. A register entry is identity evidence, not proof of product quality, solvency, control effectiveness or performance.

Ask which entity operates the service, invoices the buyer, processes data and supplies support. They may not be the same. Check incorporated documents and policy ownership, and record any mismatch for legal and procurement review rather than resolving it from branding.

Test data roles and collection routes

Map every processing operation before assigning controller, joint-controller or processor labels. Roles follow actual purposes and means, and the ICO's controllers and processors guide notes that controllers who jointly determine purposes and means are joint controllers under Article 26(1) of the UK GDPR.

Where a processor relationship exists, compare the proposed terms with the ICO's contract guidance. It covers instructions, confidentiality, security, sub-processors and rights assistance, with end-of-contract handling and audits. Neither the guide nor a supplier template decides the factual role.

Attribution often uses tags, pixels or other storage and access technologies. Examine each technology and purpose under PECR, then assess any personal-data processing separately. Calling a route first-party or server-side does not provide a universal answer.

A Meta pixel, a Google tag, an AppsFlyer SDK and a server-side container are four collection routes with four different PECR questions. Name each route and its purpose on the processing map, with the personal data and device rows beside it.

List sub-processors, remote support locations and onward recipients. The ICO published its current international transfers guide on 15 January 2026, and its transfer analysis applies to the proposed flow. A regional hosting option does not establish where all access or processing occurs.

Make security evidence testable

Ask for architecture, authentication and privileged-access controls for the exact edition. Then ask for encryption boundaries, audit logs, vulnerability handling and incident support. Backup and recovery evidence must cover the same edition.

Certification names such as ISO/IEC 27001 or SOC 2 need scope, auditor, date, exclusions and expiry. A document covering a parent company or a different service cannot silently fill a gap.

The NCSC's cloud security principles tell buyers to consider what evidence supports a provider's statements. Its SaaS configuration guidance also makes the customer's continuing responsibilities clear. Supplier security and buyer configuration are connected, but neither substitutes for the other.

Write buyer tests for account creation, least privilege, service identities, log export and privileged support access. Add incident evidence to the same test pack. Use synthetic data or specifically authorised fixtures, and do not expose live customer identifiers merely to complete procurement.

Test accessibility on configured tasks

An accessibility statement or conformance report is evidence to inspect, not a verdict. Define tasks: configuring an event, reviewing an unmatched-record report, changing access, exporting results and investigating an alert. State the browsers, assistive technologies, user needs and severity rule used for buyer testing.

GOV.UK's accessible technology procurement guidance discusses supplier declarations, EN 301 549 and WCAG 2.2 in its public-sector setting. Private buyers can use the evidence questions without claiming that public-sector duties or a standard automatically apply in the same way. Keep accessibility as a pass, fail or unresolved gate, not a weighted feature score.

Settle rights over data and models

Define ownership and permitted use for source data, identity tables, campaign taxonomies, configuration and model inputs. Cover derived features, outputs, reports and feedback in the same clause.

Ask whether any buyer or individual-level information is used to train or improve a supplier model, and under whose purpose. Record opt-out and deletion mechanics if offered, and do not infer them from general AI language.

A proprietary model may stay on procurement HOLD if the evidence is insufficient, even when contractual confidentiality is understandable.

Record starting points only when sourced

Do not copy a headline price into the matrix. Leave every value blank until a current first-party page or dated written quote supports the exact edition and geography. Publicly known starting points exist, quoted as typical figures for an England buyer.

A GA4 standard property carries no licence fee. Analytics 360 and Adobe Customer Journey Analytics are quote-based and typically quoted in the lower six figures a year. Matomo Cloud typically starts in the low tens of pounds a month per site, and Matomo On-Premise is free to self-host.

Supermetrics typically starts near £30 a month per connector on annual billing. AppsFlyer, Adjust and Ruler Analytics are quote-based with monthly minimums, usually a few hundred pounds. Record currency, VAT treatment, billing period, minimum term, renewal and exit assistance beside each figure.

HMRC's VAT guidance for businesses is an official starting point, not a tax answer for a particular supply. A tax adviser should confirm treatment.

Run one acceptance test, then plan rollback

Predeclare the test before giving a supplier data. Use the same authorised fixture, definitions and expected outputs for every admitted candidate. Test import validation, duplicate handling, missing identifiers, late events and model version display.

Role restrictions, log export, report export and deletion evidence belong in the same fixture. The same pack runs against Adobe Customer Journey Analytics, Snowplow, Eppo, AppsFlyer or any other admitted candidate. Record observed results separately from supplier explanations.

Acceptance thresholds, weights and service levels remain blank until the buyer approves them. A failure in privacy, PECR, security or accessibility is a gate. Contract, data rights, causal validity and exit failures count the same way, and a better interface score cannot compensate for any of them.

Create a versioned data map and event dictionary, and preserve the existing route while testing the candidate in a segregated environment. Reconcile candidate outputs with source records rather than forcing agreement.

The rollback record should state the trigger and the authorised decision-maker. It should list the configuration to restore and the data to quarantine. Rehearse export and restoration into a buyer-controlled format, because a promise that data can be exported is weaker than a successful controlled test.

Keep the decision record open until a candidate passes

The final record should show the buyer job, baseline and admitted candidates. It should list rejected candidates with reasons and the remaining unknowns. Controlled observations, independent reviews and non-compensating gate decisions go in the same record.

The names above come from supplier documentation, licence terms and published guidance, not from buyer testing. The named shortlist stays empty until a candidate passes this process.

On purchase day, reopen every source and supplier record. Confirm the legal entity, edition, geography and feature, then check sub-processors, terms, price basis and change date. If an essential field is still blank, keep the procurement decision on hold rather than filling it with marketing copy.

Before you act

Common questions

Which attribution tool fits which job?

Match the tool to the job. Google Analytics 4 and Adobe Customer Journey Analytics cover credit and reporting, with GA4 free at standard tier. Snowplow and Matomo cover collection, and Matomo is free to self-host. AppsFlyer and Adjust cover mobile. Robyn and Meridian cover modelling with no licence fee.

How should a buyer handle data roles and device collection?

Map every processing operation before assigning controller, joint-controller or processor labels. Roles follow actual purposes and means. For tags, pixels or other storage and access technologies, examine each technology and purpose under PECR, then assess any personal-data processing separately.

What security and accessibility evidence should a buyer require?

Ask for architecture, authentication and privileged-access controls for the exact edition, then encryption boundaries, audit logs, vulnerability handling and incident support. Certification names need scope, auditor, date, exclusions and expiry. For accessibility, define tasks and state the browsers, assistive technologies, user needs and severity rule.