One reference crosses the gap. Everything else is bookkeeping.
The click is recorded here. The sale happens on the merchant’s own domain. Nothing a browser stores survives that hop, so attribution rests on one reference they carry across it and hand back. This is that mechanism, and its failure mode.
What crosses, and what does not
Why we do not claim cookieless attribution, or ITP resilience
Every network in this category claims both. The cookie we set on redirect is scoped to this domain and marked SameSite=lax — a merchant cannot read it and it does not travel to their server, which is not a setting we could turn off but what the same-origin rules mean. What is actually true is narrower and more useful: they carry a reference across the boundary themselves and hand it back. A network that says otherwise is guessing.
What happens when the reference comes back
The attribution models
All of themWhat the IP fingerprint is not
It is recorded from the IP address, user agent and accept-language of the request, and on a postback or webhook that is the merchant’s own server or Stripe’s. So it groups a merchant’s clicks that plausibly belong to one visitor, and never decides on its own who earned a sale. A network that attributes on a fingerprint at conversion time is attributing to a data centre.