Conversion events are linked back to the originating email send
Why it matters
Without a foreign key or UTM-derived reference linking conversion records to the originating email send, you cannot compute campaign ROI, per-campaign conversion rates, or the revenue contribution of any individual sequence or A/B test. You can observe that a purchase happened, but you cannot answer which campaign drove it. GDPR Art. 5(1)(a) (lawfulness, purpose limitation) and CCPA §1798.120 (right to opt out of sale tied to identifiable data processing) both implicitly require that you understand why you hold each piece of customer data — including behavioral data collected via ePD Art. 5(3) tracking pixels. Blind conversion logs satisfy none of these requirements and make all email program measurement impossible.
Severity rationale
Critical because unlinked conversion data makes it impossible to compute campaign ROI, evaluate A/B test outcomes on revenue metrics, or attribute any business result to an email program — the entire analytics layer loses its core function.
Remediation
Parse UTM parameters from the conversion request and persist them as explicit columns alongside the conversion record. Do this server-side — client-side analytics tools lose the data on ad blockers and private browsers:
async function recordConversion(
contactId: string,
type: string,
value: number,
req: Request
) {
const url = new URL(req.url)
await db.conversions.create({
data: {
id: crypto.randomUUID(),
contact_id: contactId,
type,
value,
utm_source: url.searchParams.get('utm_source') ?? null,
utm_medium: url.searchParams.get('utm_medium') ?? null,
utm_campaign: url.searchParams.get('utm_campaign') ?? null,
utm_content: url.searchParams.get('utm_content') ?? null,
converted_at: new Date()
}
})
}
Add a campaign_id column to your conversions table and populate it by joining utm_campaign against your campaigns table at write time so queries don't require a join on every read.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Campaign Analytics & Attribution Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 5(1)(a) — Lawfulness, fairness and transparency — data processed lawfully
- ccpa · §1798.120 — Right to opt-out of sale of personal information
- eprivacy · Art. 5(3) — Confidentiality of communications — consent before tracking
Taxons
History
- 2026-04-18·v1.0.0·Initial import from campaign-analytics-attribution·automated