100% Attribution Framework

1. Why attribution matters more for LWD than for a commercial business

A commercial business measures marketing attribution to grow. A charity like Life Without Debt Ltd measures marketing attribution to survive — and to earn the right to keep raising money. Three reasons:

2. The seven attribution principles

1. First-party first, always. Every conversion event is captured on our own servers before it is sent (server-side) to any ad platform. The source of truth lives in Cloudflare D1, not in Meta or Google.
2. Server-side over browser-side. Meta CAPI, Google Enhanced Conversions, and LinkedIn CAPI all receive server-fired events. Browser pixels are backup only. This survives iOS ATT, cookie deprecation, and ad blockers.
3. Deduplicated identity. Every event carries a hashed email + hashed phone + click ID (fbclid / gclid / li_fat_id). Ad platforms match on hashed PII, so 90%+ of conversions match back to the ad exposure, not just the last-click cookie.
4. Both last-touch and first-touch stored. Every gift record stores both the UTM of the session that converted and the UTM of the very first visit that started the donor's journey. Multi-touch attribution is derivable at query time; we don't lose data by picking a model too early.
5. Offline gifts count too. Cheques, bank transfers, foundation grants, corporate matched-giving cheques — all entered into the CRM with source metadata. Nothing is "unattributed".
6. Consent-first, cookieless-ready. We collect the minimum data required, we tell people we're collecting it, we honour Do-Not-Track, and the whole stack works even if a donor has all cookies disabled.
7. Attribution outlives the tool. If Meta CAPI shuts tomorrow, we still know which gift came from which campaign — because the data lives in our D1, not Meta's servers.

3. The four-layer attribution stack

Each layer feeds the next. Layer 1 is the source of truth. Layers 2–4 are where the data comes from. A donor gift is only "fully attributed" when it has data in all four layers where applicable.

4. UTM taxonomy — the naming convention

Every link we distribute — every ad, every email button, every social post, every QR code — carries the same five-parameter UTM string. Consistency is the whole point: sloppy UTMs make attribution unqueryable. This is the contract.

The five parameters

Full-URL examples

Meta ad, Christmas Appeal, Margaret hero creative, targeting Australian carers 45–70:

https://www.cosailifewithoutdebt.org/donate/monthly
  ?utm_source=meta
  &utm_medium=social-paid
  &utm_campaign=c-2026-11-christmas-appeal
  &utm_content=margaret-hero-image-01
  &utm_term=audience-carers-45-70

LinkedIn thought-leadership post by Laurence, Bank Paradox campaign:

https://www.cosailifewithoutdebt.org/bank-paradox
  ?utm_source=laurence-linkedin
  &utm_medium=social-organic
  &utm_campaign=b-2027-02-bank-paradox
  &utm_content=bank-paradox-open-letter-v1
  &utm_term=audience-csr-esg-leads

Foundation-outreach email, Paul Ramsay Foundation, September launch:

https://www.cosailifewithoutdebt.org/room-a
  ?utm_source=email
  &utm_medium=email-ask
  &utm_campaign=a-2026-09-launch-outreach
  &utm_content=paul-ramsay-discovery-invite
  &utm_term=foundation-paul-ramsay

5. The event dictionary — every action we track

Fifteen events. Every one has the same shape. Every one is fired both browser-side (GA4) and server-side (Cloudflare Worker → CAPI + Enhanced Conversions + D1). No custom off-schedule events.

6. Server-side conversions — Meta CAPI, Google EC, LinkedIn CAPI

The core mechanic. When a donor completes a gift on /donate, a Cloudflare Worker fires four parallel events. The browser pixel fires a fifth as backup.

The Cloudflare Worker payload (Meta CAPI example)

// POST https://graph.facebook.com/v18.0/{PIXEL_ID}/events
{
  "data": [{
    "event_name": "Donate",
    "event_time": 1735689600,
    "event_id": "gift-9f3a7b21-2027-06-15",   // dedup key
    "event_source_url": "https://www.cosailifewithoutdebt.org/donate/monthly",
    "action_source": "website",
    "user_data": {
      "em": ["e3b0c44...hashed_email_sha256..."],
      "ph": ["8d969ee...hashed_phone_sha256..."],
      "fbc": "fb.1.1735689500.IwAR2abc123...",   // fbclid captured on landing
      "fbp": "fb.1.1735689500.987654321",        // 1st-party fb browser cookie
      "client_ip_address": "203.0.113.42",
      "client_user_agent": "Mozilla/5.0..."
    },
    "custom_data": {
      "currency": "AUD",
      "value": 19.25,
      "content_name": "Regular Giving — $19.25 weekly",
      "content_category": "monthly-recurring",
      "predicted_ltv": 462.00,  // $19.25 × 24 months
      "campaign": "c-2026-11-christmas-appeal",
      "creative": "margaret-hero-image-01"
    }
  }],
  "test_event_code": null,
  "access_token": "{META_CAPI_TOKEN_SECRET}"
}

7. Offline & manual gift attribution

Not every gift comes through the donate flow. Foundation cheques arrive by post. Corporate matched-giving comes as a bank transfer with a reference. A donor calls Lisa and pledges. All of these still get attributed — the CRM operator enters the source at gift-entry time.

8. The four dashboards

Attribution is only useful if humans can read it. Four dashboards, four audiences, four cadences.

9. Privacy, consent, and the Australian Privacy Act

Because LWD's audience includes vulnerable people — families in medical and financial crisis — the privacy bar is higher than a commercial business's. Three specific commitments:

10. Implementation checklist & go-live gates

What must be true, in order, before the September launch. Each item has a named owner and a deadline.