Measuring Mobile After ATT: Attribution When the User Said No to Tracking

Mobile attribution after App Tracking Transparency is no longer a single deterministic number from your MMP — it's a blend of aggregated postbacks, modeled conversions, and probabilistic inference that you size to the precision each decision actually needs. IDFA is gone by default, SKAdNetwork and AdAttributionKit fill part of the gap, and the rest comes from statistical modeling you have to interrogate, not trust blindly.

Quick Answer: Post-ATT mobile measurement combines SKAdNetwork/AdAttributionKit postbacks (privacy-safe, delayed, low-cardinality), modeled conversions (probabilistic, inferred from consented data), and Privacy Sandbox attribution reports (Android's equivalent). No single source is ground truth — match confidence level to decision size.

What Changed When Apple Shipped ATT

App Tracking Transparency requires an explicit opt-in prompt before any app can access the IDFA or share data across apps for advertising. Apple shipped it in iOS 14.5 in April 2021, and opt-in rates settled far below what deterministic attribution needs to function the old way. Flurry Analytics, an Apple subsidiary that tracks opt-in rates across its SDK panel, has reported worldwide opt-in rates hovering in the 20-30% range for most of the post-ATT period, with wide variance by app category and region.

That number matters because deterministic, user-level attribution — "this exact install came from this exact click on this exact ad" — depends on a persistent identifier tying an ad impression to an app install. Without IDFA on the 70-80% of users who decline tracking, that chain breaks. You're no longer measuring most of your users directly; you're measuring a minority and inferring the rest.

This is the mental shift growth PMs have to make first, before any tooling discussion:

• Old world: every install had a deterministic source, campaign, and creative attached.
• New world: a minority of installs are deterministically attributed; the majority are estimated from aggregated signals, modeling, or both.
• Consequence: attribution is now a statistical claim with a confidence interval, not a database join.

Treating a modeled number as if it carried the same certainty as a deterministic one is the single most common measurement mistake growth teams make right now — and it's an easy one to make, because the dashboard doesn't visually distinguish the two.

How SKAdNetwork and AdAttributionKit Actually Work

SKAdNetwork (and its 2024 successor, AdAttributionKit) attribute installs without exposing individual users, by having Apple's OS itself hold the linkage between click and install and only release an aggregated, delayed postback to the ad network. The app developer never sees which user converted — only that some install happened, within a coarse time window, with a conversion value attached.

The mechanics matter for how you interpret the data:

1. Privacy thresholds suppress small campaigns. If a campaign-creative-country combination doesn't clear Apple's minimum install threshold, the postback either doesn't fire or gets stripped of granularity. Long-tail campaigns and niche geos are systematically undercounted in reporting, not because they underperformed.
2. Conversion value is a single 6-bit number (0-63), or richer under AdAttributionKit's newer coarse/fine value model. You have to design a value schema in advance — decide which post-install events (trial start, first purchase, day-3 return) map to which numeric value — and you can't retroactively see the exact event, only the code you assigned.
3. Postbacks arrive on a randomized delay (a 24-48 hour timer window, extended further for the second and third postback conversions AdAttributionKit added), specifically to prevent the timing itself from being used to re-identify a user.
4. Attribution is a "last click wins" locked hierarchy Apple runs itself, favoring Apple Search Ads and Apple's own priority ordering over network claims — so cross-network comparisons of "share of installs" through SKAdNetwork alone can misstate real contribution.

The practical result: SKAdNetwork tells you that a cohort converted and roughly how well, on a delay, at a coarsened resolution. It does not tell you which individual user, and for lower-volume campaigns it may not tell you much at all.

Where This Breaks Down for Growth Teams

Campaign-level ROAS optimization that used to run daily now has to run on 2-4 day lag, at higher spend thresholds, with wider error bars on anything below your privacy-threshold volume. Budget reallocation decisions built for daily deterministic feedback loops need to be redesigned around weekly aggregates, or you're optimizing noise.

Modeled Conversions and Google's Privacy Sandbox

Modeled conversions estimate attribution for the users you can't directly observe by learning patterns from the smaller, consented, observable population and projecting them onto the rest — a statistical technique, not a measurement. Meta, Google, and most MMPs (AppsFlyer, Adjust, Singular) now blend some ratio of deterministic-plus-probabilistic and modeled data into a single reported number.

Google's answer on Android — Privacy Sandbox, including the Attribution Reporting API and Protected Audience API — mirrors Apple's aggregation approach but with its own mechanics: event-level reports with limited data (similar coarse conversion values) and separate aggregatable reports processed through a noise-adding aggregation service, rather than raw cross-app IDs. Google has repeatedly delayed the timeline for deprecating third-party cookies and the Android advertising ID equivalent, but the direction — aggregation plus differential-privacy-style noise, not raw identifiers — is now the industry's dominant design pattern on both platforms.

Read this table as a hierarchy of trust, not a menu of interchangeable options. The further right and further down you go, the more the number is a statistical estimate rather than an observation — and the more it deserves a confidence interval attached, out loud, in the dashboard.

Modeling Is Not Fabrication, But It Is Assumption-Dependent

A well-built model, trained on a large enough consented panel with a stable underlying user population, can track directional truth closely. Meta's own documentation on Aggregated Event Measurement and modeled conversions describes this as extrapolation from observed to unobserved, which is defensible math — but every model carries assumptions about panel representativeness that can silently break when your user mix shifts (a new country launch, a new acquisition channel, a seasonal spike). Model drift is invisible until you specifically check for it, because the model keeps producing a confident-looking number regardless of whether its training assumptions still hold.

A Framework for Matching Precision to Decision Size

Not every decision needs the same measurement rigor — the right question isn't "how accurate is this number" in the abstract, but "how wrong can this number be before it changes what I'd do." Building that threshold explicitly, per decision type, is the single highest-leverage habit a growth PM can adopt post-ATT.

Use this rough decision-precision map as a starting point:

1. Kill/scale a channel entirely (large, rare, reversible-but-costly): demand the widest evidence base — deterministic data where available, SKAdNetwork trend over multiple weeks, and modeled conversion corroboration. Don't act on one week of noisy postback data.
2. Shift 10-20% of budget between existing campaigns (frequent, small, easily reversible): directional SKAdNetwork or modeled trend data is usually sufficient — the cost of being wrong for a week is low, and waiting for perfect data means never optimizing.
3. Creative-level iteration and A/B testing: this is where deterministic, opted-in data is genuinely valuable and where you should weight your consented sample more heavily, understanding it may not represent your full non-opted-in population.
4. Long-term LTV and payback-period modeling: treat SKAdNetwork-era cohorts as directionally informative but widen your confidence bands considerably versus pre-ATT baselines — and say so explicitly to finance and leadership rather than presenting a single point estimate.

The failure mode this framework prevents: teams that apply "kill/scale" rigor everywhere become too slow to act on daily budget shifts, while teams that apply "shift budget" looseness to the kill/scale decision end up cutting or scaling channels off statistical noise.

Building the Habit of an Honest Confidence Interval

Reporting a single attributed-install number without a stated confidence range trains stakeholders to treat modeled data as fact. A simple discipline fixes most of this: report a range, state the source mix, and flag when the underlying assumption (opt-in rate, panel size, threshold suppression) has shifted since last quarter. This is unglamorous but it's the actual work of post-ATT measurement leadership — closer to the jobs to be done discipline of understanding what a stakeholder is actually trying to decide than to a dashboarding exercise.

Common Mistakes Growth PMs Make Post-ATT

The most damaging pattern is treating your MMP's dashboard number as ground truth simply because it's the number everyone already looks at — the dashboard doesn't visually flag which rows are deterministic versus modeled. Four related mistakes compound this:

• Comparing pre- and post-ATT cohorts on the same axis without adjusting for the structural break in measurement methodology — a "CAC doubled" conclusion is often partly a measurement-method artifact, not a real cost change.
• Under-designing the SKAdNetwork conversion value schema, wasting the scarce 6-bit (or coarse/fine AdAttributionKit) budget on low-value events instead of the 2-3 signals that actually predict LTV.
• Ignoring privacy-threshold suppression and reading a missing postback as "zero installs from this campaign" rather than "below reporting threshold."
• Skipping a re-check cadence — attribution windows, threshold values, and API behavior have changed multiple times since 2021 (AdAttributionKit's introduction alone changed postback timing and value granularity), and a measurement stack tuned for 2022 rules can quietly misreport under 2025 rules.

This overlaps with a broader mobile-PM discipline: measurement decisions, like app store review timing in a release plan or push notification permission design, are all instances of building product decisions around platform rules you don't control and that change without much notice. The complete guide to the mobile PM role covers this platform-dependency pattern more broadly.

Logging Measurement Assumptions So They Don't Silently Expire

Every modeled attribution number rests on assumptions — panel opt-in rate, threshold values, conversion-value mapping — that are true today and may not be true after the next platform update, so the assumption needs to be written down somewhere it will actually resurface. Most teams keep this knowledge in one analyst's head or a stale wiki page nobody revisits until a number looks wrong.

Prodinja's Journals let you log a measurement assumption as an explicit Assumption entry — for example, "modeled conversions assume a stable 25% opt-in rate across markets" — tied to the relevant project or decision, so it surfaces again when attribution windows, SKAdNetwork thresholds, or Privacy Sandbox rules shift and you need to know what you were relying on when you set the current budget splits. It's a lightweight habit, not a dashboard replacing your MMP — the discipline of writing the assumption down is what matters, and having it linked to context is what makes it findable months later.

This connects to how attribution assumptions interact with the rest of product measurement — for instance, understanding where in the customer journey a modeled conversion actually sits helps you judge whether a coarse SKAdNetwork signal is measuring acquisition or something further downstream, and whether platform conventions like iOS Human Interface Guidelines versus Material Design differences are quietly affecting your opt-in rate through prompt framing and timing.

Key Takeaways

• IDFA is gone for most users by default — Flurry's tracked opt-in rates have generally sat in the 20-30% range since ATT shipped, meaning most installs are no longer deterministically attributable.
• SKAdNetwork and AdAttributionKit trade individual visibility for aggregated, delayed, privacy-safe postbacks — design your conversion value schema deliberately, since the encoding space is scarce.
• Privacy Sandbox is Android's structurally similar answer — aggregated, noised reporting rather than raw cross-app identifiers, following the same overall direction as Apple.
• Modeled conversions are statistically defensible but assumption-dependent — they can drift silently when your user mix or opt-in rate shifts without anyone noticing.
• Match measurement precision to decision size — a channel kill decision deserves multi-week corroborated evidence; a 10% budget shift between live campaigns doesn't need to wait for it.
• Report attribution as a range with a stated source mix, not a single point number, so stakeholders stop treating modeled data as fact.
• Log measurement assumptions explicitly so they resurface when platform rules change again — because they will.