Marketing Analytics After Third-Party Cookies

The tidy last-click report that told you exactly which ad produced which sale is gone, and the replacements are estimates. Browser tracking prevention, mobile app privacy prompts, consent banners and shortened cookie lifetimes each remove a slice of the signal. Pretending the remaining dashboard is complete is the expensive mistake here. Building a measurement setup that is honest about its gaps is the useful response.

What actually broke, mechanically

It is worth knowing which failure you are looking at, because the fixes are different. Cross-site identifiers stopped working, so a platform can no longer recognise the same person on a publisher site and on yours. Some browsers cap the lifetime of cookies set by script, so a visitor who returns three weeks later looks new even on your own domain. App tracking prompts removed a large share of mobile identifiers. And consent banners mean a portion of your visitors are never measured at all, by design.

• Cross-site identity: gone, and not coming back in the same form.
• Long attribution windows: unreliable, because the identifier expires before the window does.
• Mobile app to web journeys: heavily degraded.
• Consented sample: a fraction of the total, varying by region and by how your banner is written.
• Redirects through third parties: the referrer is often lost, so the visit lands in "direct".

Own the first-party layer

Everything durable in modern measurement is first-party. That means events recorded on your own domain, tied to your own identifiers, stored where you control retention. Server-side tagging helps, but the deeper win is simply logging the events that matter to your business in your own database alongside the order or the lead, rather than only inside an analytics vendor whose sampling and retention rules you do not control.

• Record a stable internal event for every meaningful action: signup, qualified lead, purchase, renewal.
• Capture landing page and campaign parameters on first touch and store them on the account or lead record, not only in a session.
• Keep the raw event log, not only the aggregated report, so you can answer a question you have not thought of yet.
• Respect consent at collection time, so the data you keep is data you may actually use.
• Set a retention period on purpose. Keeping everything forever is a liability, not an asset.

Fix the UTM hygiene before anything clever

Most attribution problems in small businesses are not privacy problems, they are naming problems. Half the traffic lands in direct because links were shared without parameters, and the paid report double counts because one campaign is tagged three ways. Agree a convention, write it in a shared document, use lower case everywhere, and audit it monthly. This is unglamorous and it recovers more clarity than any modelling technique.

In Nepal there is one more gap worth closing deliberately. A large share of traffic arrives through Viber, WhatsApp and Facebook Messenger, and those visits usually appear as direct because the referrer is stripped. Tag the links you send in those channels yourself. The same applies to payment redirects: when a customer returns from eSewa or Khalti, the original source can be lost unless you carry it through, which is one of the practical details in what to integrate for digital payments in Nepal.

Ask people, because it works

A single optional field on your signup or checkout form asking how the customer heard about you outperforms most attribution modelling at small budgets. It captures the podcast mention, the friend's recommendation and the search that happened on a phone before the purchase on a laptop, none of which any tracking setup will see. Keep it optional, keep it free text or a short list, and read it monthly rather than building a chart from it.

Self-reported attribution is imprecise. Precise-looking attribution that misses half the journey is worse.

Send conversions back to the platforms deliberately

The advertising platforms now rely on you telling them what happened, through server-side conversion APIs, because the browser no longer tells them. This is worth doing, since the optimisation algorithms genuinely work better with clean conversion data, but be clear about what you are agreeing to: you are sending your customer event data to an advertising company. Send the minimum required, honour consent, deduplicate against the browser event so one sale is not counted twice, and tell your client plainly that this is happening, because it is a question their own privacy policy has to answer.

Measure at the level where the decision is made

You rarely need to know which of two ads produced a specific sale. You need to know whether the channel deserves next month's budget. That question is answerable with aggregate methods that survive the loss of individual tracking: compare periods when spend changed, run geographic holdouts, and watch blended cost per acquisition across everything you spend rather than per-platform figures that each claim the same conversion.

• Blended CAC: total spend divided by total new customers. The number no platform can inflate.
• Holdout tests: pause a channel in one region for a defined window and watch the aggregate.
• Period comparison: change one thing at a time and give it long enough to read.
• Platform-reported conversions: a directional signal, never a total.

One warning on holdouts. If your monthly numbers are small, the test needs to run long enough that the difference is bigger than the ordinary week-to-week noise, and for many Nepali businesses that means a month rather than a week. Run it across a stable period, never across Dashain, and write down what you expect to see before you start so you are not reading the result backwards.

What to stop doing

Stop reconciling platform numbers against each other; they use different windows and different claims of credit, and the sum will always exceed reality. Stop reporting a channel-level return on ad spend to three decimal places. Stop buying a tool that promises to restore deterministic cross-device tracking, because the constraint is browser and platform policy, not your vendor's cleverness.

A setup that fits a small team

First-party event logging in your own database, one analytics tool configured with consent handling, campaign parameters stored on the account record, a how-did-you-hear-about-us field, and a monthly blended CAC number the whole team looks at. That is a few days of work, it degrades gracefully as more tracking disappears, and it answers the questions a budget meeting actually asks. It is also the setup we put behind our digital marketing work, and where the reporting needs to go further than a dashboard, our data work picks it up. If you are starting from nothing, the channel-level basics in digital marketing for Nepali businesses come before any of this.