iOS attribution after App Tracking Transparency

Since iOS 14.5, an app must ask before it can link a user’s activity with data from other companies. Most people say no. A lot of marketing writing treats that as the end of iPhone measurement. It is not — but what survives is worth being precise about, because the difference decides how you read your numbers.

The prompt is narrower than people think

Apple’s definition of tracking is specific: linking data collected in your app with data collected in other companies’ apps or websites, for advertising or advertising measurement.

Counting what happens inside your own app is not tracking. Installs, sessions, retention, purchases and your own events need no prompt at all. Neither does Apple’s own attribution for Search Ads, nor Apple’s SKAdNetwork reports.

What needs the prompt is the per-person link between an ad someone saw in, say, Instagram, and the install in your app — because that requires the advertising ID on both sides.

What still works without permission

Apple Search Ads, exactly. The AdServices framework hands the app a token at first launch; exchanged with Apple, it returns the campaign, ad group and keyword that drove the install. No prompt involved. The token lasts 24 hours, so an SDK that sits on it — for instance because the phone was offline — can lose the attribution. Ours hands anything unsent to iOS as a background upload so it goes as soon as the network returns.

SKAdNetwork and AdAttributionKit, per campaign. Apple tells the ad network, and you, that a campaign produced N installs, plus a coarse conversion value you define — typically revenue bands in the first days. No names, delayed, and small campaigns are withheld entirely to protect anonymity. It is enough to compare campaigns and compute cost per install.

Your own links, with a code. A creator shares a code, the user types it into your app, and the install belongs to that creator. Exact, on both platforms, and no prompt — because the user handed you the information.

Clipboard matching, with the user’s tap. A web page can copy a token that the app reads at first launch. iOS shows an “Allow Paste” prompt; those who accept are matched exactly.

What is genuinely lost

For a user who declines, you cannot know that this person came from that Instagram ad. No tool can, unless it guesses from the IP address and device — which Apple forbids, and which is unreliable anyway once carrier networks and Private Relay are in play.

The practical consequence: iPhone reporting has two layers. Exact rows for the installs you can name, and per-campaign totals from Apple for the rest. Mixing them into one number produces a figure that looks precise and is not.

Reading the numbers honestly

Three habits keep iPhone reporting truthful:

1. Keep unattributed installs in their own bucket, rather than calling them organic. Some of them came from ads you simply cannot see.
2. Show Apple’s campaign totals beside your exact rows, labelled, never summed into per-user cohorts.
3. Expect late data. SKAdNetwork arrives days after the install, so recent days are always incomplete.

Raising the share you can measure

You cannot make people accept the prompt, and Apple forbids gating features or offering rewards for it. What does work is asking well: explain in your own screen, in your own words, what the user gets, and ask after they have seen value in the app rather than on first launch. Apps that do this see far higher acceptance than apps that show the system prompt cold.

Everything else is a matter of using the channels that need no permission: Apple Search Ads, creator codes, your own links, and Apple’s own reports.

Related: what mobile attribution is and how the Android install referrer works.