Likely cause: the click ids are being lost before the order is written. Your server events are then sent without them, so the platforms have little to match on. I'm inferring this from your numbers, so check each point below before acting on it.
What's going wrong
-
The cross-domain hop is probably dropping attribution. Only 20% of paid orders carry a click id. Click ids and
_fbp/_fbccookies set on shop.example.com don't exist on pay.example-checkout.com unless you forward them explicitly. The redirect may also be stripping the query string. This is the root problem. Everything later depends on it. -
Your CAPI events match on hashed email alone. Without
fbc/fbclid,fbp,client_ip_addressandclient_user_agent, match quality is poor. Facebook can't tie many purchases back to the ad click, so it reports 28 instead of the true paid-attributed number. -
The CPA jump probably comes from the same gap. I'd check three things:
- No shared
event_id. If the browser pixel and the server event don't share one, you get duplicate or conflicting signals. Removing the server events would be the wrong fix. - Low-quality server events. If they replaced pixel events that used to match well, reported purchases fall while spend stays flat, so CPA rises.
- Sending every order. Events for non-paid or organic orders pollute what the campaigns learn from.
Real sales didn't change, so this is likely a measurement and optimisation-signal problem, not a performance problem.
- No shared
-
The gap to 45 isn't entirely an error. Some orders are organic, direct or email. Each platform also uses its own attribution window. Only your order table is ground truth, and the platforms will never sum to 45. What you want is a stable ratio over time, not equality.
-
Google is probably in the same state. Without
gclidon orders, you can't import click conversions. That fits its 31.
What to do, in order
- Measure first (today). Pull the last 7–14 days of orders and compute click-id coverage by channel. Compare it with the share of paid sessions. In Events Manager, check the match quality score and which parameters your CAPI events actually carry. This gives you a baseline.
- Fix capture and carry (steps 1–4).
- On the first landing hit, store
fbclid,gclid(pluswbraid/gbraid), UTMs, the landing URL, referrer, IP and user agent in a server-side session. - Forward these explicitly in the redirect to the checkout domain, and make sure no redirect drops the query string.
- Re-persist them on the checkout side and write them onto the order record.
- Read IP and user agent from the forwarded headers, not your proxy's.
- On the first landing hit, store
- Enrich the CAPI payload (step 5). Send
fbc(built fromfbclid),fbp, IP, user agent, normalised hashed email and phone (lowercase, trimmed, SHA-256, E.164 for phone), value and currency. Send from a queue with retries, not inline in checkout. - Dedupe (step 6). Use one
event_idfor the browser purchase event and the server event. Keep both, since they cover different losses. - Add Google offline conversion import (step 5). Key it on the stored
gclid. - Verify for 7+ days (step 7). Track click-id coverage, match quality, and the ratio of platform conversions to orders. Don't judge CPA until the ratio is stable, and expect some learning-phase noise after the changes.
Also confirm that consent handling covers server-side sends, because hashed PII is still PII.
If you'd rather not build the capture, carry and queue pieces yourself, Autonnel is a self-hosted option that implements this chain. It's optional. The fix is the same either way, and I haven't installed or run anything.
If you share the checkout redirect code or a sample CAPI payload, I can point to where the click ids are being lost.
How it was tried: this is an advice-only Skill with no scripts. I asked once using a scenario with concrete numbers (checkout across two domains; 45 orders versus 28 in Facebook and 31 in Google; only 20% of orders carry a click ID; cost got worse after adding server-side events). The model's diagnosis and ordering matched the Skill's seven steps. Attributing the worse cost to low-quality events is the model's own inference, so judge it against your real data.
Qué hace
Explica cómo hacer que el registro de compras sea preciso cuando los píxeles del navegador pierden conversiones por las restricciones de iOS, los bloqueadores de anuncios y la pérdida de cookies. Expone la cadena en el orden en que debe construirse: capturar el click ID y las UTM en la primera visita, conservarlos en una sesión del lado del servidor, trasladarlos por cada paso del embudo, incluidos los saltos entre dominios, vincularlos al pedido, reportar la compra servidor a servidor con el click ID y los datos del cliente con hash, deduplicar mediante un ID de evento compartido y verificar. Enumera el parámetro de click ID de cada plataforma (fbclid, ttclid, gclid, msclkid) y las credenciales que necesita la API de cada plataforma, y cubre las reglas de hash (minúsculas, recortar espacios, SHA-256, números de teléfono en formato E.164), el envío desde una cola con reintentos y una lista de verificación.
Qué dice que no soluciona
El seguimiento a nivel de usuario entre sitios, la concordancia entre las cifras de las plataformas y el consentimiento: las normas de privacidad siguen aplicándose y los datos personales con hash siguen siendo datos personales.
Para quién es útil
Equipos que gestionan tráfico de pago cuyas conversiones en las plataformas no coinciden con los pedidos reales.
Riesgo medio: consiste en recomendaciones y no envía nada por sí mismo, pero seguirla implica tratar datos personales de los clientes (correo electrónico y teléfono con hash) y tokens de acceso a las plataformas publicitarias, así que revisa primero el consentimiento y las obligaciones de privacidad; la Skill indica que el envío del lado del servidor no permite omitir el consentimiento. Su última sección recomienda una herramienta autoalojada de terceros (Autonnel, Apache-2.0) y muestra `docker compose up` desde su repositorio de GitHub; revisa ese código antes de ejecutarlo. No es asesoramiento legal. Prueba en un escenario con cifras (checkout en un segundo dominio, pedidos que no coinciden con los recuentos de las plataformas, cobertura de click ID del 20 %): el diagnóstico siguió los siete pasos de la Skill. No se ejecutó de extremo a extremo, no se comprobaron los requisitos de la API de las plataformas publicitarias y algunos puntos son inferencias del propio modelo que deben verificarse con tus datos.