Every attribution problem in paid social starts with the same failure: the identifier does not survive the trip from the ad click to the form submission.
What actually breaks
Three mechanisms, in order of how much damage they do:
Third-party cookies are gone. Safari and Firefox block them outright. Chrome does not support them for this purpose either. Any tracking that depends on a cookie set from a different domain than the page is measuring an increasingly small and biased sample.
JavaScript-written cookies get capped. Safari’s Intelligent Tracking Prevention limits cookies written from JavaScript to 7 days, and to 24 hours in some conditions. If your click identifier lives in a document.cookie write, your attribution window is a week long at best, and a day in the worst case.
Redirects lose the click. The classic pattern is: the ad points to a tracking URL, the tracking service records the click and redirects to the landing page. Every hop is a chance to drop the parameters, break the referrer, or hit a browser that blocks the chain.
How DropCPL avoids all three
The design decision is simple to state and non-trivial to implement: the tracking domain and the landing page are the same domain.
- The ad URL points to the tracking domain and carries the
ad_id. - The request hits dropcpl. In that one request, DropCPL logs the click, sets the
click_idcookie server-side via aSet-Cookieheader, and renders the landing page in the same response. - The cookie is
HttpOnlyand first-party. JavaScript cannot read it or write it, and it is not a third-party cookie. - When the form is submitted, the
click_idcomes back with it, and the lead is attributed.
No redirect between tracking and page. No pixel deciding whether to fire. No cross-domain hop.
| Approach | Cookie set by | Lifetime under ITP | Survives cross-site blocking |
|---|---|---|---|
| Third-party pixel | third-party JS | blocked | no |
| First-party JS pixel | document.cookie | ~7 days (24h worst case) | partially |
| DropCPL | server Set-Cookie | not JS-capped | yes |
What is stored, and for how long
DropCPL logs what the attribution needs: ad_id, campaign, fbclid, click ID, timestamp, user agent and IP. The click_id cookie lives 7 days. Lead and click data is retained for 24 months, as stated in the privacy policy.
The _fbp cookie, when the Meta Pixel is present, is read for matching with the Conversions API — it is not created or owned by DropCPL for its own advertising.
Privacy, briefly
First-party tracking is not a loophole. It is the same data, collected by the party the user is actually visiting, under a contract with them — instead of by a third party the user never chose. DropCPL does not sell data and does not run its own ad network.
Related
- Creative attribution — what the click is used for
- Meta Ads integration — sending events back to Meta properly
- Tracking after iOS — the guide version, with the numbers