Attribution that survives iOS and the end of cookies

Open your CRM and filter last quarter's closed-won deals by original source. If more than half say "Direct" or "Unknown," you don't have an attribution problem. You have an attribution absence. The measurement stack most B2B teams assembled between 2015 and 2021 assumed two things: cookies persist and scripts run. Neither is true anymore, and the fix isn't another tool. It's owning the data yourself.

Why your attribution broke

Safari's Intelligent Tracking Prevention caps JavaScript-set cookies at 7 days. Arrive through a link decorated with a click ID like gclid or fbclid and the cap drops to 24 hours. Firefox blocks third-party cookies by default. Chrome walked back its plan to remove them entirely, and it barely matters for B2B measurement: your buyers were already invisible in Safari and Firefox, behind corporate ad blockers, and behind consent banners that start in denied under consent mode v2.

Now add the part that's specific to B2B. A typical mid-market deal runs 90 to 270 days from first touch to signature. Gartner puts the buying committee at 6 to 10 people. A 7-day cookie can't connect a podcast mention in March to a contract in October, and no cookie anywhere can connect the VP who clicked your LinkedIn ad to the analyst who filled out the demo form three weeks later on a different laptop.

The result is familiar. Your analytics tool reports "Direct: 58%." Every ad platform claims the same handful of conversions as its own. The board asks which channels deserve budget next year, and the honest answer is a shrug.

Own first touch and last touch at your front door

The durable fix is unglamorous: capture attribution yourself, on your own domain, and move it into your CRM as fast as possible. Here's the pattern we run on our own site.

On every landing, a small script reads the URL and referrer and builds an attribution record: utm_source, utm_medium, utm_campaign, utm_term, utm_content, plus the click IDs (gclid, fbclid, li_fat_id), the landing path, the referring domain, and a timestamp.

That record gets written twice. Once as first-touch, stored under its own key and never overwritten. Once as last-touch, replaced whenever a new session arrives with fresh campaign parameters. Both copies live in localStorage and in a first-party cookie with a 90-day window, because Safari degrades those two storage types on different schedules and you want whichever one survives.

Browser storage is only a relay. The moment any form gets submitted (contact, newsletter, careers, all of them), two hidden fields post the first-touch and last-touch records along with the submission, and they land in the CRM as custom properties on the contact. From that point on, no browser policy can touch the data. The CRM is the system of record. The browser was just the courier.

Total cost: about 80 lines of TypeScript and an afternoon of QA. No vendor, no subscription, no new data processing addendum for legal to review.

UTM discipline is a governance problem, not a tooling problem

The capture layer records garbage with perfect fidelity if the links are garbage. To every analytics tool on earth, utm_source=LinkedIn, linkedin, and Linkedin are three different channels.

The rules that keep the data clean are boring on purpose. Lowercase everything. Source is the platform: google, linkedin, the name of the newsletter you sponsored. Medium comes from a fixed vocabulary: paid-social, organic-social, email, referral, podcast. Campaign names follow one convention, something like 2026-q3-latam-soc2-sprint. And every tracked link gets built in a single place, a shared sheet or a tiny internal tool, not from memory in eight different browser tabs.

One more rule, the one that gets violated most: never put UTMs on internal links. They start a fake new session and overwrite real last-touch data with noise.

Here's a 30-minute audit. Export sessions by source and medium for the last 90 days and count the spelling variants of your top five channels. Anything above zero is a governance problem wearing a data costume.

Modeled conversions are a patch, not a source of truth

With consent mode v2 defaulting to denied, Google's tags degrade to cookieless pings when a visitor declines, and Google fills the gap with modeled conversions. For paid channels, that's directionally useful. But the models need volume: GA4's behavioral modeling wants on the order of a thousand consented events per day before it switches on. A B2B site doing 8,000 sessions a month doesn't clear that bar, and below it the modeled numbers are extrapolation presented with a very confident font.

Keep consent mode on anyway. Bidding algorithms need the signal and your ads perform better with it. Add enhanced conversions, hashed emails posted at the moment of conversion, so the platforms can match what they're able to match. Then treat all of it as ad-platform bookkeeping. Board reporting comes out of your CRM, built from the first-party records you captured at the front door.

Multi-touch vendors overpromise. Measure this instead.

The multi-touch attribution pitch is seductive: fractional credit across every touchpoint, W-shaped models, dashboards that drill down to the keyword. For long-cycle B2B, our position is blunt: it's fiction with decimals. Three reasons.

First, the model only sees touches a pixel can reach, and B2B journeys run through Slack communities, WhatsApp threads, podcasts, conference hallways, and a former colleague saying "just call these people." Second, resolving identity across a 6-to-10-person committee using three devices each is guesswork presented as math. Third, at 15 to 40 closed-won deals a quarter, the sample can't support fractional weights. The subscription, typically $20,000 to $60,000 a year, buys you a more confident version of wrong. Multi-touch earns its keep in high-volume e-commerce with thousands of daily conversions and same-week cycles. That's not your motion.

What we measure instead, for ourselves and for clients:

• First-touch and last-touch by channel, straight from the CRM. Two honest bookends beat eight modeled midpoints.
• Self-reported attribution. A required free-text field, "How did you hear about us?", on the contact and demo forms. It catches the dark social nothing else sees.
• Pipeline created and closed-won by channel, quarterly, cohorted by created date.
• Blended efficiency. Pipeline per dollar of program spend and CAC payback, per quarter.

Four numbers, zero vendors, defensible in front of any board.

Attribution in the privacy era isn't a tooling race. It's plumbing plus discipline: capture at the edge, store in the CRM, keep the naming clean, and stop paying for precision your sample size can't support. This is the kind of thing our Data practice untangles in the first weeks of an engagement, usually alongside Marketing because capture and spend live in the same funnel. And if you want to know where your data operation stands next to the other seven dimensions, that's what the DGTL Readiness Index maps.

Related: Revenue Operations for B2B → · Data infrastructure for B2B → · The B2B growth engine →