Analytics & Attribution Playbook (B2C edition)

To see what drives profit at a consumer brand, count orders in your store, judge every channel against the return it needs to break even, and test what the ad platforms claim before you move budget. Tracking that holds up under consent rules and Apple’s privacy changes keeps those inputs honest.

This playbook is for DTC brands, online stores, consumer subscriptions and B2C apps that spend on paid channels such as Meta, Google, TikTok, creators and affiliates. The usual symptom: the ad platforms report different numbers from your store and from GA4, attribution has felt messy since Apple’s privacy changes, and budget decisions fall back on last click or gut feel. If you sell to businesses through a sales team, the B2B edition follows leads and pipeline instead.

Settle three things in writing before you touch a tag. The first is the revenue event: an online purchase, a subscription start or a first in-app purchase. The second is the source of truth for revenue: the store platform, billing system or app backend that records every order, refund and renewal. Analytics tools and ad platforms estimate; this system counts, and every other number is checked against it (Step 6).

The third is what an order is worth after the costs that rise with it. Return on ad spend (ROAS) measured on revenue ignores those costs, so a channel can look profitable on the dashboard and lose money on every order. Take an order’s revenue and subtract product cost, pick, pack and shipping, payment fees, and the discounts and returns it carries: what is left is its contribution margin. Revenue divided by contribution is your break-even ROAS. Profit on ad spend (POAS) states the same test as contribution divided by spend, which breaks even at 1.

If repeat orders carry your profit, as they do for most subscriptions, decide how long you are willing to wait for an ad to pay back, and set the line on the contribution earned over that period rather than on the first order alone. The Unit Economics Calculator works out payback from your own retention.

Name each stage of the shopping journey after the event that records it, so every report counts the same thing. Google Analytics 4 has a recommended ecommerce event for each stage, from view_item_list on a collection page through view_item, add_to_cart, begin_checkout and add_payment_info to purchase (Google for Developers^[1]; Figure 2).

The purchase event carries the most weight. Google requires a transaction_id with it, and that ID is what lets GA4 drop a second copy of the same order, for example when a shopper reloads the confirmation page. Use the order number: one fixed or empty ID makes GA4 merge different orders and undercount them. Set value to the items’ price times quantity, without shipping or tax, and always send currency with it, or revenue is not computed correctly^[2],[3]. Deduplication by transaction ID works for web data streams, not app streams, so an app needs its own check.

Then tag every link you control with UTM parameters under one written rule, so a channel is spelled the same way every time. The tracking setup post walks through the GA4 settings.

In the EU, storing or reading information on a visitor’s device needs their consent unless it is strictly necessary for a service they asked for, and the European Data Protection Board’s guidelines make clear that the rule covers similar technologies as well as cookies^[4]. Analytics and advertising tags fall under it.

Google adds its own requirement. Since March 2024, to keep using measurement, ad personalization and remarketing features for visitors in the European Economic Area, advertisers must collect their consent and pass it to Google^[5]. Consent mode does the passing. Its second version sends four signals, adding ad_user_data and ad_personalization to the original ad_storage and analytics_storage (Figure 3).

It runs in one of two ways. In basic mode Google’s tags do not load until the visitor chooses, and a reject sends nothing. In advanced mode the tags load with consent denied by default and send measurements without cookies until the visitor agrees, and Google models the missing conversions with a model specific to your account rather than a general one^[6]. Advanced mode recovers more of the picture, but it sends data before anyone has said yes, so the choice is a legal judgment as much as a technical one.

A browser pixel misses orders: ad blockers and browser privacy settings stop some of them before they are sent. Sending the same orders from your store’s backend fills those gaps, which is why Meta recommends running its Conversions API alongside the Meta Pixel rather than instead of it^[7].

Sending each order twice only works if the platform can tell the two copies apart from two orders. Meta treats a browser event and a server event as one when they carry the same event name and the same event ID and arrive within 48 hours of each other, and it keeps whichever arrived first (Figure 4). Use the order number as the ID on both sides. Server events can be sent up to seven days after the order; a request containing an older event fails as a whole^[8].

Google Ads has its own route. Enhanced conversions sends the customer’s email address or phone number with the conversion, normalized and hashed with SHA-256, and Google matches it to signed-in Google accounts that engaged with your ads^[9].

Since iOS 14.5, an app needs the person’s permission through Apple’s App Tracking Transparency prompt before it can track them or read the device’s advertising identifier^[10]. Installs from people who decline carry no identifier an ad network can match. What remains is Apple’s own attribution: AdAttributionKit, available from iOS 17.4 for apps on the App Store and alternative app marketplaces, and the older SKAdNetwork, which works alongside it; Apple now points app campaigns to AdAttributionKit^[11],[12].

Both report an install to the ad network as signed postbacks that contain no user or device data, at least 24 to 48 hours after the event, and include detailed values only when Apple’s crowd-anonymity thresholds are met^[13]. An install can send up to three postbacks, one per conversion window. Only the first, which covers the first two days, can carry a fine value from 0 to 63; the later two carry low, medium or high^[14]. So the work is deciding what those values mean: which actions in the first two days predict a customer worth having, and what counts as low, medium and high after that (Figure 5).

Each month, set three counts side by side: orders in your store, purchases in GA4, and the purchases each ad platform claims (Figure 6). They will not match, and the gaps tell you something. GA4 counts fewer than the store, because some visitors decline consent and some browsers block tags. The platforms together claim more, because each credits the orders it touched under its own rules, so Meta and Google can both claim the same order. Watch the two ratios over time: a sudden move in either is a tracking fault until proven otherwise.

Choosing an attribution model will not settle which number is right. Since November 2023 GA4 has offered three: data-driven, paid and organic last click, and Google paid channels last click. First click, linear, time decay and position-based are no longer available, and all three exclude direct visits unless the path was direct only^[15]. Use each view for the decision it can support:

Only an experiment shows what a channel caused. In 15 large advertising experiments at Facebook, the observational methods advertisers commonly rely on generally overestimated what the ads achieved compared with randomized tests, and in some cases significantly underestimated it^[16]. The test that fits most consumer brands is a holdout: switch a channel off, or cut it, for a matched group of regions or customers for a few weeks, and compare orders there with orders elsewhere. A scale test does the reverse, raising spend in some regions to see whether orders follow.

Write the plan before you start: the channel, the regions, the length, the metric (store orders, not platform conversions) and the result that would change your budget, set against your break-even ROAS from Step 1. Divide the extra revenue the test shows by what the channel cost, and you have its incremental ROAS. The incrementality testing guide covers matching regions and reading the result.

Tests are slow: one or two channels a quarter. A marketing mix model fills the gaps between them. It is a regression of weekly orders on weekly spend by channel, and it estimates each channel’s contribution without tracking anyone. A light version is worth building once you have about a year of weekly data, spend that varied, and three or more channels; calibrate it with your test results. Google’s open-source Meridian, for example, supports calibration with experiments and runs at national or regional level^[17]. The MMM-Lite Starter Kit sets up a simpler version.

Put the numbers from Steps 1 to 7 on one screen with three tabs: a performance overview built on store data and contribution, a channel view that sets each platform’s claims beside its tested result, and an experiment log of what was tested, what it showed and what changed (Figure 8). Lead with marketing efficiency, store revenue divided by all ad spend, and with contribution after marketing: no single platform’s attribution can inflate either.

Then decide who may change the plumbing. Name one owner each for analytics events, pixel and server settings, consent configuration, dashboard logic and the attribution settings in each ad platform, and log every change, because an unlogged change in tracking looks exactly like a change in performance.

What changes by stage?

What mistakes should I avoid?

• Judging channels on revenue ROAS. Compare each with the break-even ROAS your contribution margin sets (Step 1).
• A purchase event without the order number. Reloads count as new orders (Step 2).
• A cookie banner that is not wired to the tags. Test it from an EU address (Step 3).
• Browser and server events with different IDs. Meta cannot match them, so orders count twice (Step 4).
• Adding up what the platforms claim. Count orders in the store (Step 6).
• Cutting or scaling a channel on attribution alone. Run a holdout first (Step 7).