Back to the blog Marketing

First-party measurement: attribution with your own data

Third-party cookies no longer hold up measurement, and in Chile Law 21.719 changes the rules on consent. How to attribute your campaigns with your own data, step by step.

David López · CEO - Fundador November 4, 2026 10 min read

For years, measuring campaigns was almost automatic: one pixel per platform, third-party cookies and a report that split the credit. That setup has lost reliability. Safari blocks all third-party cookies, Firefox isolates them per site, and Chrome, while keeping them, lets each user block them.

Regulation adds to this. In Chile, Law 21.719 rewrites the rules for processing personal data and creates an agency to enforce them. Measurement is no longer just a technical matter: you also need to be able to explain what data you collect, why, and on what legal basis.

The practical way forward is first-party measurement: attributing results with data your company collects on its own website, forms and CRM, with consent and clear rules.

First-party and third-party

According to MDN, a cookie is first-party when its domain and scheme match the page the user sees in the address bar; if they don't match, it is a third-party cookie.

The same applies to data. You collect first-party data in your own channels: your website, forms, purchases, CRM. Third-party data is collected by another company on sites that aren't yours. You control the first and can explain where it came from; not the second.

Third-party cookies: status as of November 2026

Browser	Current situation
Chrome	Does not block them by default. Users can block them in settings, and Incognito mode blocks them by default.
Safari	ITP blocks all third-party cookies, with no exceptions, and deletes cookies created in JavaScript after 7 days without user interaction with the site.
Firefox	Total Cookie Protection, on by default, keeps each site's cookies separate and prevents tracking users across sites.

In Chrome, two Google announcements apply. In April 2025 Google said it will keep its approach of leaving the choice to users and will not roll out a standalone prompt for third-party cookies. In October 2025 it announced it is retiring several Privacy Sandbox technologies, including the Attribution Reporting API, Topics and Protected Audience.

Safari keeps tightening its protections. It has blocked third-party cookies by default since March 2020. With Safari 26, known fingerprinting scripts can no longer read URL query parameters or the referrer. And in October 2026 WebKit announced that its 27 releases block network access to "identity resolution" infrastructure: third parties that capture the email address on sign-up or login forms to turn it into a persistent identifier. WebKit makes clear that first-party personalization is not tracking.

Bottom line: your measurement should not depend on third-party cookies or on outside scripts that capture identifiers in your forms.

The limits of last click

Google Analytics 4 offers three attribution models: data-driven, paid and organic last click (ignores direct traffic and gives 100% of the value to the last channel), and Google paid channels last click. The first click, linear, time decay and position-based models stopped being available in November 2023.

Last click has clear limits:

It rewards whatever comes at the end of the journey, such as a search for your brand, and gives no credit to what created the demand.
It describes a path, not a cause: it doesn't tell you whether the sale would have happened anyway without the ad.
Each platform attributes with its own data, so the numbers from Google, Meta and your CRM may not match.

The data-driven model uses machine learning, but it is still a model. To make budget decisions you need your own data and, from time to time, an experiment.

Concrete practices

1. A UTM convention

In GA4, UTM values are case sensitive: google and Google are different sources. Google recommends using lowercase and filling in at least utm_source, utm_medium, utm_campaign and utm_id; anything missing shows up as (not set). The default channel groups depend on the medium: email goes to Email; cpc or a medium starting with paid, together with a recognized source, goes to paid channels.

Write the convention down and always use it:

utm_source   = google | facebook | instagram | linkedin | newsletter
utm_medium   = cpc | paid_social | social | email | referral
utm_campaign = yyyy-mm_objective_product   (e.g.: 2026-11_leads_sme-plan)
utm_content  = ad or link variant (e.g.: video-15s)
utm_id       = campaign ID in your campaign sheet

In Google Ads, auto-tagging adds the GCLID click identifier to the URL. Google describes it as required to measure conversions, including offline ones, and in GA4 it takes priority over manual tagging.

2. Your own conversion events

Define a few events with business meaning. GA4 has recommended events for the lead lifecycle: generate_lead, qualify_lead, close_convert_lead and purchase, which requires transaction_id and items. The important ones are marked as key events and can be imported into Google Ads as conversions. For each one, write down what triggers it, what it is worth and who owns it.

3. Forms and CRM as the source of truth

In the form, the visitor becomes a contact. Store in hidden fields the UTMs, the GCLID and the _fbc and _fbp values that Meta stores in cookies on your own domain. Also record consent: what text the person accepted, when, and for which purposes.

Then send the CRM stages back to your tools. The GA4 Measurement Protocol sends events server to server, including offline conversions, as a complement to tagging and not a replacement. For offline conversions in Google Ads, Google says to use the Data Manager API for new integrations.

4. Server-side tagging

With Google Tag Manager server-side tagging, the container runs on a server you control, for example in your Google Cloud project. According to Google, only you have access to the data until you choose to send it elsewhere. Google recommends installing it on your first-party domain.

It is not a way around protections: WebKit caps cookies set in the HTTP response to 7 days when it detects third-party CNAME or IP address cloaking. Use it to control which data goes to each platform, and factor in its operating cost.

5. Conversion APIs

Google Ads. Enhanced conversions add first-party data (email, phone, name, address), hashed with SHA256, to your conversions. The version for leads matches that data with sales you close outside the website.
Meta. The Conversions API connects data from your server, website, app or CRM with Meta. Meta recommends using it alongside the Pixel and deduplicating: the Pixel's eventID must match the server's event_id, with the same event name, and events are only deduplicated within 48 hours. Email and phone are normalized and hashed; the phone number must include the country code.

A hashed email exists precisely so the platform can recognize a person. Handle it with the same care as the original data.

Google's consent mode adjusts tags based on the user's choice, with four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. In the basic implementation, tags don't load until the user interacts with the banner. In the advanced one, they load with denied defaults and, without consent, send cookieless pings that Google uses to model metrics. It is a technical mechanism: it doesn't replace your policy or define what the law requires.

7. Incrementality without a lab

Attribution splits credit; an experiment measures effect. Google Ads offers Conversion Lift, which compares a group that sees the ads with one that doesn't, by users or by geographic area, although it isn't available to all accounts.

A simple version: define the hypothesis and the metric in advance (qualified leads in the CRM, not clicks), turn the campaign off only in some comparable areas for a period that covers your sales cycle, and compare how each group changed. Change one variable at a time and log every test.

Chile: what Law 21.719 says

This is not legal advice; it is a summary of the text published on LeyChile.

What it is. It was published in the Diario Oficial on December 13, 2024, amends Law 19.628 and creates the Personal Data Protection Agency.
Entry into force. Under its first transitory article, its amendments take effect on the first day of the twenty-fourth month after publication: December 1, 2026. A government bill (bulletin 18.623-07) seeks to postpone it: the Senate approved it on October 28, 2026 with a new entry-into-force date of October 15, 2027, and as of November 4 it is in its second reading in the Chamber of Deputies. Until it is enacted, the date in force remains December 1, 2026; check its status.
Consent. It must be free, informed, specific as to its purpose, prior and unambiguous. The data subject can withdraw it at any time, and the controller must prove it obtained it (article 12).
Other legal bases. Without consent, processing is lawful, among other cases, when it is necessary for a contract or for pre-contractual steps requested by the data subject, to meet a legal obligation, or for a legitimate interest that does not affect the data subject's rights (article 13).
Purpose and proportionality. Specific and explicit purposes, only the data needed and only for as long as needed (article 3).
Objection. The data subject can object to processing carried out exclusively for direct marketing, including profiling (article 8).
Transparency. You must publish a data processing policy with purposes, legal basis and retention period, among other information (article 14 ter).
The Agency. It is an autonomous public-law corporation that enforces compliance with the law (article 30). During the first twelve months in force, it may sanction smaller companies with a written warning (sixth transitory article).

The text does not mention cookies by name. How it applies to each tag on your website is a question for your legal counsel.

Phased implementation plan

Inventory. List the tags, cookies, forms and platforms that receive data. Remove what nobody uses.
Order. Publish the UTM convention and the event catalog.
Own capture. Add hidden fields, connect the CRM and record consent.
Connection. Set up consent mode, enhanced conversions and the Conversions API with deduplication.
Server. Evaluate server-side tagging if your volume and your team justify the cost.
Experiments. Run periodic incrementality tests on your most expensive channel.

Checklist

The UTM convention is written down and active campaigns follow it.
Each key event has a definition, a value and an owner.
Forms store UTMs, click identifiers and a consent record.
The CRM sends qualified leads and sales back to GA4 and the platforms.
Meta's Pixel and Conversions API share the event identifier.
The published policy states purposes, legal basis and retention period.
No third-party script receives emails or phone numbers without a disclosed purpose.
An incrementality experiment is planned, and consent mode reflects the user's actual choice.

Sources

If you'd like to review how you measure your campaigns, let's talk.