Cross-device attribution for affiliate campaigns

Cross-device attribution connects eligible campaign events from two or more devices only when an authorized identity join supports the relationship. It is not the same as recognizing a returning browser, restoring a first-party visitor token, or grouping tabs on one device.

This guide explains the identity evidence, attribution rules, and consent controls to evaluate. Tracked's cross-device workflow is still in development.

Why the distinction matters

A buyer may see this journey:

1. an ad click opens on a phone;
2. the visitor reads the landing page;
3. the visitor later opens a laptop;
4. a lead or purchase occurs on the laptop.

Without an authorized bridge between those devices, the tracker has two journeys. Similar timing, location, or device characteristics do not prove that both journeys belong to one person.

Overconfident joining can be worse than leaving the conversion unattributed. It changes campaign reports using a relationship that may be false.

Same-device identity comes first

A sound identity system separates:

• a request;
• a tab session;
• an anonymous visitor on one device;
• a known account or customer;
• a cross-device identity relationship.

Tracked keeps anonymous visitor continuity separate from tab sessions. That supports same-device event journeys; it does not prove that two devices belong to the same person.

What can create a cross-device join?

The strongest joins use an explicit identifier supplied through an authorized workflow, such as:

• a user signing into the same account on both devices;
• a verified CRM or advertiser identity reference;
• a consented, consistently transformed customer identifier;
• a provider-supported identity or conversion interface.

The system still needs rules for scope, consent, retention, revocation, and access.

Probabilistic signals can contribute evidence, but they should not silently turn an anonymous browser into a known person. Confidence and ambiguity must remain visible.

Attribution needs more than identity

Even when two devices are correctly linked, the conversion still needs an attribution rule.

Questions remain:

• Which click receives credit?
• What lookback window applies?
• Does a later direct visit replace the earlier paid click?
• Are view-through and click-through events treated differently?
• Does the advertiser or traffic source use the same rule?
• How are refunds and repeated conversions handled?

Identity says which events may belong together. Attribution decides how credit is assigned within those events.

Confidence should be part of the report

A cross-device report should distinguish:

• deterministic join;
• authorized known-identity join;
• high-confidence inferred join;
• ambiguous or unmatched events.

Do not compress all four into one “unique user” count. Buyers need to know how much of the result is observed and how much is inferred.

The report should also support exclusion. A team may allow deterministic account joins while refusing probabilistic device links.

Consent and data minimization

Cross-device systems can combine more data than a same-device tracker. That makes policy part of the product design.

A defensible workflow should define:

• the permitted identity source;
• the measurement purpose;
• the fields stored or transformed;
• whether raw values ever persist;
• retention and deletion behavior;
• regional restrictions;
• who can view sensitive identity details;
• how consent withdrawal affects future joins.

“Server-side” does not remove these obligations.

Where Tracked is today

Tracked supports anonymous first-party visitor continuity for same-device journeys. A durable visitor ID or server-side matching signal does not establish that separate devices belong to one person. Tracked's authorized cross-device identity joins, attribution rules, and reporting are in development; no complete cross-device workflow is available today.

The practical rule

Do not call a browser match cross-device attribution. Require an authorized join, label its confidence, apply a documented attribution rule, and preserve unmatched events when the evidence is insufficient.

Tracked's available workflow keeps hosted pages, campaign routes, same-device journey evidence, reports, and page editing in one workspace. That gives a media buyer a path from an observed result back to the page that needs work, while cross-device identity remains in development.

Frequently asked questions

Is cross-device attribution available in Tracked?

Not yet. Cross-device attribution is in development. Tracked's first-party visitor identity and recovery article describes same-device continuity, which does not link separate devices to one person.

What is the difference between cross-device and same-device attribution?

Same-device attribution reconnects eligible events from one browser or device. Cross-device attribution needs an authorized identity signal that can justify joining events from separate devices, followed by an explicit attribution rule.

Can an IP address prove that two devices belong to one person?

No. Networks, households, workplaces, VPNs, and mobile carriers can make IP-based matches ambiguous. An IP address may contribute to a governed recovery method, but it should not be presented as deterministic personal identity.

Start free and inspect campaign journeys.