Cookies and attribution
Which cookies the tag writes, for how long, and how the click survives until the conversion.
Attribution model#
Attribution is last tracked click, within a window set on the campaign. The identifier is written to a first-party cookie on arrival and read at conversion time. A new click overwrites the previous one.
These are first-party cookies, written on the advertiser’s domain. We do not use third-party cookies, so third-party blocking in browsers does not affect attribution. The limits that do apply are the browser’s own rules for script-written first-party cookies.
Cookies written#
All prefixed with moclick_. Which ones appear depends on the campaign and
on the parameters present in the entry URL — no cookie is written without its
corresponding parameter.
| Cookie | Purpose | Lifetime |
|---|---|---|
moclick_click_id |
Click identifier, used to attribute the conversion to its source. | Campaign window |
moclick_native_cid |
Click identifier for Moclick’s own measurement. | Campaign window |
moclick_traffic_source |
Traffic source, for per-publisher attribution. The name suffix follows the parameter configured on the campaign. | Campaign window |
moclick_msxt, moclick_eventid, moclick_udid |
Session, event and device identifiers required by the media platforms contracted for the campaign. Written only when the campaign uses them. | Campaign window |
__mclk_dprobe |
Technical probe used to find out which domain the browser will accept the cookie on. Contains no visitor data. | 10 seconds |
Attributes#
| Attribute | Value |
|---|---|
Path | / |
Max-Age | Campaign window. Default 30 days, maximum 365 |
SameSite | Lax |
Secure | Present over HTTPS |
Domain | Inferred, or the value of cookie_domain |
HttpOnly | Absent — the tag has to read them in the browser |
Domain inference#
So the cookie is valid across every subdomain, the tag tests candidate domains by walking up the hostname hierarchy, writing and removing the technical probe on each attempt. The first domain the browser accepts is the one it uses.
If none is accepted — which happens on domains in the Public Suffix List and in some
platform setups — the cookie is written on the current host only.
Attribution keeps working on that host, but does not cross subdomains. In that case set
cookie_domain explicitly, as described in
subdomain and cross-domain.
Local storage#
Besides the cookies, the tag uses browser storage for two technical markers: one recording that the conversion has already been sent, which prevents a resend on reload, and another that blocks a duplicate record of the same visit. Neither contains visitor data.
Both degrade without breaking: with storage blocked, server-side deduplication takes over and the integration keeps working.
Attribution window#
Configured per campaign, from 1 to 365 days, default 30. The right choice depends on the product’s decision cycle:
| Window | Suitable for |
|---|---|
| 1 to 7 days | Impulse purchases, time-limited offers, urgency campaigns |
| 30 days (default) | General e-commerce, lead generation |
| 60 to 90 days | High ticket, long consideration cycle, B2B |
| Over 90 days | Specific cases. Weigh it carefully: a long window inflates attribution and weakens the legal basis for the cookie |
Changing the window affects only cookies written from that point on. Existing ones keep their original lifetime until they expire.
When attribution does not happen#
| Situation | Effect | Mitigation |
|---|---|---|
| Cookie expired | Conversion with no source | Widen the window to match the real cycle |
| User cleared cookies | Conversion with no source | None on the client side |
| Conversion on another device | Not attributed | Postback S2S with your own identifier |
| Conversion on another domain | Not attributed | Propagate in the URL or use Postback S2S |
| Private browsing | Same session only | None |
| Script blocker | Nothing is written | Postback S2S |
| Tag missing on the landing page | Nothing is written | Install it on every page |
Attribution loss is inherent to browser-side tracking. When the measured volume diverges from what you are billed, Postback S2S is the way to close the gap — it depends on neither cookies nor JavaScript.