Multi-touch attribution: what it is and how to build it in 5 steps

Multi-touch attribution divides the revenue from one sale among every recorded touchpoint before it, where single-touch rules give the whole amount to the first or last click.

A SaaS buyer who clicks a podcast link on day 1, a LinkedIn post on day 9, a newsletter on day 16 and an affiliate's review link on day 24, then pays $1,200 for an annual plan on day 28, produces 4 credits that add back up to $1,200.

Setting it up takes 5 steps in a fixed order: capture each click on your own server, give the visitor an ID, link it to a person at signup, store every touch as its own row, and join the payment.

Pick the credit rule last, since any rule can be read from the same stored touches.

How multi-touch attribution works

Every rule takes 2 inputs: one buyer's touches in order, with timestamps, and a conversion with a dollar value. For a subscription, use the first paid charge as the conversion, since a free signup has no revenue to divide.

Google Analytics Help defines an attribution model as "a rule, a set of rules, or a data-driven algorithm" for assigning credit along the path. The shares sum to the charge, so the report ties back to what your processor collected.

One $1,200 sale under 4 rules

First touch and last touch put $1,200 on 1 row, so the podcast is the whole story under one rule and worthless under the other. Linear gives every row $300.

How credit thins from 3 to 10 touches

The same $1,200 sale spread over 3 to 10 touches. Linear slices shrink in proportion, and U-shaped middle slices shrink faster because the 2 ends keep $480 each.

Which multi-touch attribution model to use

Pick the rule by the decision it feeds. First touch shows where buyers first met you, last touch shows what closed, and linear gives every channel that appeared a share.

At 20 paid conversions a month, 1 customer is 5% of the month's revenue, so position weights are fitted to a handful of journeys.

I would read first touch and last touch side by side first, then add linear once most journeys have 3 or more touches. The attribution models comparison covers time decay and data-driven credit.

Benefits of multi-touch attribution

Journey openers become visible. In the $1,200 example the podcast earns $0 under last touch, so a team reading only last touch would cut it, while first touch gives it $1,200 and linear $300.

Two rules side by side sort channels: high under first touch and low under last touch marks an opener, and the reverse marks a closer.

The model also matches how long SaaS buyers take. In TrackRev's Q2 2026 attribution benchmarks, the median time from first tracked click to first paid charge is 6.3 days across 4,217 workspaces.

The 75th percentile is 21.0 days and the 90th is 48.2, so 1 buyer in 10 takes longer than about 7 weeks, with room for many touches a last-click report never sees.

Commission rules get an explicit basis. On the sale above, an affiliate program paying 20% of credited revenue owes these amounts, so the rule belongs in the partner terms:

What multi-touch attribution can't tell you

Credit follows a fixed rule, so it can't show whether a channel caused a sale.

Google Ads describes Conversion Lift as an incrementality experiment: 1 audience sees your ads, a control group does not, and the gap in conversions is the lift the ads caused.

A multi-touch report has no control group, so test large budget moves with a holdout.

It also sees only recorded touches. A private recommendation, a conference conversation or an unlinked podcast mention leaves nothing to credit and lands under Direct.

Asking buyers directly catches some, and the self-reported versus tracked attribution guide covers weighing the answers.

How to set up multi-touch attribution in 5 steps

1. Capture every click on your own server

Send every link you control through a 302 redirect on a domain you own: newsletters, ads, partner links, QR codes. The redirect writes the click before it forwards the visitor, so a blocked script can't lose it.

Store the visitor ID, link, channel, timestamp, user agent and a bot flag.

The first click mints the visitor ID, a random UUID set as a 365-day cookie in the redirect's response and appended to the destination URL as a parameter such as _vid.

A pixel on your site reads it, so the click and later page views share 1 identity. Accept only values shaped like your own IDs, or a crafted link can plant someone else's.

<script async src="https://app.trackrev.io/p.js" data-id="YOUR_WORKSPACE_ID"></script>

2. Link the visitor to a person at signup

Anonymous clicks become usable once the visitor ID sits beside something a payment carries, usually an email. With the TrackRev pixel that is 1 call on the signup success page, after the pixel's trk:ready event fires.

Every earlier click from that browser then belongs to a named account.

window.trk.identify("buyer@example.com");

3. Keep every touch as its own row

Store 1 row per click and never update one. A source field on the user, rewritten at each visit, is last-touch data under a multi-touch label.

Flag bot clicks when you write them and filter on the flag, or link-preview crawlers and email security scanners collect credit as if they were buyers.

4. Join the payment to the visitor

A log tied to signups ranks channels by signups, and joining the payment ranks them by revenue. Carry the visitor ID into checkout, and fall back to the customer's email. Each processor has its own field.

Decide here how renewals inherit credit and make refunds reverse their credit. The Stripe Payment Links attribution guide shows the wiring.

5. Choose the credit rule and the lookback window

The window decides which touches are eligible, because a click older than it earns nothing. Set it past the 90th percentile of your own days from first tracked click to first charge.

Google Analytics 4 attribution settings default to 90 days for most key events and offer 30, 60 or 90.

Multi-touch attribution without cookies

Safari's Intelligent Tracking Prevention is the best-documented source of cookie loss. WebKit's tracking prevention policy includes 3 caps that touch attribution.

The click log needs no cookie, because the redirect records the click on your server before the destination loads. A cookie only links that click to a later purchase, and 3 carriers outlast the caps:

• A cookie your own server sets in an HTTP response. The caps name script-written cookies and cloaked third-party requests, and a redirect on your domain is neither.
• The ID in the URL, appended by the redirect, read by the pixel and carried into the payment by the checkout field from step 4. Apple's Link Tracking Protection strips some known parameters, and the iOS 17 link tracking guide covers which.
• The buyer's email or login, which no browser setting clears.

Probabilistic matching on IP address and browser fingerprints breaks on shared office networks and mobile data, so I would not pay commissions on it.

A first-party ID is still a persistent identifier, so for EU or UK visitors ask a legal adviser whether it needs consent.

The TrackRev pixel waits for window.trk.grantConsent() when its script tag carries data-requires-consent="true", and the affiliate compliance guide covers the rest.

Buyers who switch devices

A cookie lives in 1 browser, so a phone click and a desktop payment look like 2 strangers. Only a shared identity joins them: the email from a signup form, or a login.

Store the visitor ID with the email at signup, and credit that ID's clicks when a charge arrives with the same email.

The join fails when the signup email and the card email differ. Key on your own user ID instead, passed as client_reference_id when you create the Stripe Checkout Session, or collect the work email before the upgrade.

TrackRev's email fallback reads only the most recently active visitor with that email, so 2 identified journeys, one on a phone and one on a laptop, are not merged.

Test the pipeline with a known journey

Click 2 tagged links in 1 browser 1 day apart, sign up, then pay a small charge and refund it, once in Safari and once in Chrome. Each symptom points at 1 step:

• Safari loses early clicks and Chrome keeps them: the ID is written only by JavaScript, so Safari's 7-day cap applies.
• No earlier clicks on the signup: identify ran before the pixel loaded, or never ran.
• Only the last click appears: a source field is overwritten at each visit.
• A charge with no credit: checkout carried no ID and the card email differs from the signup email.

Multi-touch attribution in TrackRev

TrackRev covers the 5 steps on 1 data model. Tracked links redirect on your domain and log each click server-side with a visitor ID, partner links included.

A one-line pixel hands the ID to your site, window.trk.identify(email) ties it to a person, and charges from Stripe, Paddle, Polar and Lemon Squeezy match by the checkout's ID or, failing that, by email.

The rules are last touch (the default), first touch and linear, with a lookback window of 1 to 365 days that defaults to 30. A rule applies as each charge arrives, so changing it affects later charges only.

Renewals reuse the first charge's split, and refunds drop out of channel revenue. A visit that skips your tracked links counts as a page view, not a touch.

The revenue attribution page shows the channel report. Pick another tool for position-based, time-decay or data-driven credit, or when the decisive touches happen in meetings and email threads.