April 26, 2021 is when the world of digital advertising quietly snapped in two. That morning Apple shipped iOS 14.5 with App Tracking Transparency, and from that point forward every iPhone user got a system-level prompt the first time an app tried to track them across other companies’ apps and websites. Most people said no.
Five years later, “iOS broke our attribution” is no longer news, but the implications are still being absorbed. Reported ROAS on iOS-heavy channels looks suspicious. Mobile measurement playbooks have been rewritten. The share of conversions that arrive without any usable user identifier keeps creeping upward.
This is a working guide to what actually changed, what is still broken, and which measurement strategies are durable enough to build on in 2026.
What ATT Actually Changed
App Tracking Transparency is a permissions framework. Per Apple’s developer documentation, any iOS app that wants to track a user across other companies’ apps and websites, including reading the device’s Identifier for Advertisers (IDFA), must show a standardised system prompt asking permission. If the user declines, the app cannot access the IDFA, cannot link the user to data sets from other companies, and cannot pass a stable identifier to ad platforms for attribution.
The shift from “tracking on by default” to “tracking off unless explicitly accepted” looks like a small UI change. It is not. Before ATT, the IDFA was the connective tissue that let an ad click in TikTok be tied to a purchase in Shopify three days later. After ATT, that tissue dissolved for most users.
ATT applies to iOS, iPadOS, and tvOS apps. It does not directly govern websites. Safari uses different mechanisms, covered below. But because so much advertising lives inside apps (Meta, TikTok, Snapchat, Pinterest, Reddit, YouTube), the in-app loss cascades into the entire measurement stack.
The Real Numbers in North America
Two figures matter most for North American advertisers.
iOS device share. iOS holds roughly 60 percent of the smartphone market in the United States and roughly 54 percent in Canada, per Counterpoint Research’s most recent regional figures. iOS users also tend to spend more per session and per order than Android users in most retail categories, so the share of revenue exposed to ATT is even higher than the share of devices.
ATT opt-in. Public industry trackers including Business of Apps and Flurry have monitored opt-in monthly since 2021. Reported figures vary widely by app category and prompt design, but the consensus range for consumer apps has been a global opt-in rate in the low-to-mid double digits, with games skewing higher than social and shopping apps. The exact number matters less than the structural reality: a meaningful majority of iPhone users in your funnel did not consent to be tracked across apps.
Stack those two figures and the headline is uncomfortable. A large fraction of your highest-value device base is invisible to traditional cross-app attribution.
What Broke for Web Attribution
Web measurement on iOS was already under pressure before ATT, because Safari’s Intelligent Tracking Prevention had been chipping away at third-party cookies for years. Apple’s WebKit team then introduced Private Click Measurement (PCM) as a built-in, privacy-preserving alternative to cross-site cookie tracking.
PCM is a useful illustration of how Apple thinks about the trade-off. Per the WebKit blog post that introduced it, an ad click on a publisher’s site can store a small amount of data: 8 bits identifying the source campaign, plus 4 bits the destination site can include on a successful conversion. The combined report is sent to both the source and the destination after a randomised delay of 24 to 48 hours, with no cookies, no device identifiers, and no per-user logs. The intent is to give advertisers enough fidelity to measure aggregate campaign performance and nothing more.
For practitioners, the consequences are practical. Third-party pixels in Safari miss most cross-domain conversions. Click-level attribution from Meta or TikTok ads into a Safari-loaded Shopify store breaks unless the merchant is using a first-party tracking deployment. The traditional “drop a pixel and trust the dashboard” model is no longer reliable for any iOS-heavy funnel.
What Broke for App Attribution
For app installs and in-app conversions, Apple offers SKAdNetwork (SKAN) as the privacy-preserving replacement for IDFA-based attribution. The framework sends back delayed, aggregated postbacks instead of per-user logs.
The trade-offs are significant. Conversion data is delayed (postbacks arrive over hours or days, not seconds), coarse-grained (a limited set of conversion values per campaign, with extra noise added for privacy), and structurally incompatible with the user-level dashboards advertisers were used to. SKAdNetwork 4 added improvements like multiple postback windows and crowd-anonymity tiers. In 2024 Apple introduced a successor framework called AdAttributionKit, and at WWDC 2025 expanded it with configurable attribution windows, multiple overlapping re-engagement conversion windows, and a country code field in the postback to improve geo-level analysis.
The honest summary: app-install attribution on iOS is now a different category of measurement than it was in 2020. It is workable, but the granular, real-time numbers some teams remember are gone.
How Ad Platforms Adapted
Major ad platforms responded with three patterns.
Server-side conversion APIs. Meta’s Conversions API and Google Ads’ equivalent server-side endpoints let an advertiser send conversion events from their own backend instead of from a browser pixel. This recovers signal that ATT and Intelligent Tracking Prevention strip out of pixel-based tracking, because the event is sourced from the merchant’s own server rather than the user’s device. Meta updated Aggregated Event Measurement (AEM) in June 2025 to remove the previous 8-event limit and switched to automatic aggregation. In October 2025 Meta enabled view-through reporting for iOS app campaigns under AEM, restoring a measurement surface that had been dark since 2021.
Modelled and aggregated reporting. When user-level data is unavailable, platforms increasingly report modelled conversion counts: statistical estimates inferred from the consenting traffic and projected onto the non-consenting traffic. This is genuinely useful, but it is also opaque. Two campaigns that look identical in a dashboard can have very different modelled-versus-observed mixes underneath.
Lift studies and incrementality. Several platforms have leaned harder on lift studies and geo-experiments as the durable measurement layer, because incrementality testing does not depend on tracking individual users. It compares groups, not people.
What Actually Works Now
If we set aside hopes that ATT will be reversed (it will not), the resilient measurement strategy looks like this.
First-party tracking on your own domain. A tracking script deployed as a first-party asset on the merchant’s domain remains functional under ATT, Intelligent Tracking Prevention, and any current browser policy, because it is not cross-site. It captures sessions, touchpoints, and conversions in the merchant’s own data, independent of platform pixels.
Server-to-server conversion delivery. Where ad platforms support it, send conversions from your server rather than your browser. CAPI for Meta, Google Ads’ enhanced conversions and offline conversion imports, LinkedIn’s Conversions API, TikTok Events API. Match by hashed email, hashed phone, or a click ID where available.
Multi-touch attribution on your own data. Once conversions are captured first-party and stitched across sessions, you can run multi-touch attribution on the merchant’s own touchpoint data. The pipeline is independent of how much signal a given ad platform claims for itself, which removes a common reporting conflict.
Incrementality as the truth layer. Even with all of the above, reported ROAS on iOS-heavy channels overstates true contribution in ways that are difficult to correct in attribution alone. Periodic lift tests sit on top of attribution as the recalibration layer.
Aggregated reporting for the gaps. SKAdNetwork or AdAttributionKit for app installs, AEM for iOS web campaigns through Meta, Private Click Measurement where it is supported. These give you the aggregate-level signal Apple is willing to surface; they do not replace per-conversion attribution, but they keep dark areas visible.
A Practical Resilience Checklist
For an attribution stack that holds up on iOS in 2026:
- Deploy a first-party tracker on the merchant’s own domain. Stop relying on third-party pixels as your source of truth.
- Send conversions to Meta, Google Ads, LinkedIn, and TikTok via their server-side conversion endpoints. Deduplicate against any remaining browser pixels.
- Use email and phone hashing on every checkout and form, so server-side events have something to match against.
- Capture click IDs (gclid, fbclid, ttclid, li_fat_id) at landing and persist them through the funnel.
- Run a quarterly incrementality test on at least your two largest paid channels. Compare the lift to reported ROAS.
- Treat platform dashboards as input, not output. Reconcile them against the merchant’s own first-party data before reporting upward.
For a fuller picture of how this fits into modern attribution practice, the what is marketing attribution guide covers the full model and where each piece sits.
FAQ
Did ATT only affect Meta and Facebook ads?
No. ATT applies system-wide on iOS, so every advertising platform that previously relied on IDFA or on cross-app tracking through pixels is affected. Meta was the loudest because mobile app installs and in-feed conversions made up a large share of its measurement, but TikTok, Snapchat, Pinterest, and ad networks running inside other apps face the same constraints.
Is SKAdNetwork the same as AdAttributionKit?
No. SKAdNetwork is the original framework Apple introduced for privacy-preserving app attribution. AdAttributionKit, introduced in 2024 and expanded at WWDC 2025, is the successor framework that adds re-engagement attribution, configurable conversion windows, and a country code field in the postback. SKAdNetwork is still operational; AdAttributionKit is where the new feature work is happening.
Does Apple’s Private Click Measurement replace pixels in Safari?
It is the privacy-preserving alternative Apple supports natively in Safari. Per the WebKit documentation, PCM stores limited campaign data on click and delivers a delayed, aggregated attribution report without cookies or identifiers. For most advertisers it is a complement to first-party tracking and server-side conversion APIs, not a full replacement for traditional pixels.
Will iOS attribution get easier or harder from here?
Directionally harder, in the sense that Apple continues to push toward aggregated, on-device, identifier-free measurement, and other browsers and platforms are following the same path. The trade is durability for granularity: the techniques that survive are those that do not depend on a stable cross-app user identifier in the first place.
What is the single highest-impact change a brand can make today?
Move conversions to server-side delivery via the major ad platforms’ conversion APIs, and stop treating in-platform dashboards as the single source of truth. Pair that with a first-party tracker on the merchant’s domain, and most of the visible ATT damage is recoverable.
Where to Go From Here
ATT did not destroy digital attribution. It ended a measurement era that was unusually generous to advertisers and forced everyone else to build a more honest one. The brands that have adapted well treat platform numbers as inputs to a reconciled view, lean on first-party data they own, and use incrementality tests to keep ROAS claims grounded.
If you want a second opinion on how your current attribution stack holds up on iOS, we are happy to take a look. Get in touch via our contact page and we will walk through it.