Apple's App Tracking Transparency framework, in production since 2021, fundamentally changed how mobile ad attribution works. Five years in, most ecommerce brands still treat it as either a complete disaster (overstated) or a non-event (understated). The reality sits in the middle: ATT meaningfully degraded paid-channel attribution, the workarounds have matured, and the brands that adapted are running profitable mobile acquisition with different measurement, not no measurement.
What ATT actually does
ATT requires apps to ask the user, via a system prompt, before tracking them across other apps and websites. If the user denies, the app cannot access the IDFA (the iOS device advertising identifier) and cannot share user-level data with attribution tools that depend on it. Push notifications, analytics within your own app, and Shopify-side data are unaffected. What is affected is the chain that links a paid ad impression on Meta or TikTok to an install or purchase in your app.
For brands that depended on deterministic attribution — every install neatly traced back to an ad — this changes the picture. Without IDFA, attribution moves to probabilistic methods (Apple's SKAdNetwork, third-party MMP fingerprinting) which provide aggregate signal but not user-level certainty.
Opt-in rates and what to expect
Opt-in rates depend on how and when you ask. The blunt iOS default prompt yields 20–30% opt-in for most ecommerce apps. A well-designed pre-prompt — a screen that explains the value of opting in, before the system prompt fires — lifts opt-in to 35–55%. The pre-prompt is a one-time engineering investment that pays back for the life of the install.
Keep in mind: a user who denies ATT is not lost to you. They can still buy, still install, still convert. You just cannot attribute their journey back to a specific paid ad with user-level precision.
How attribution measurement shifts
The post-ATT measurement stack relies on three layers. Layer 1 is Apple's SKAdNetwork (SKAN), the privacy-preserving attribution protocol Apple provides. SKAN data is delayed, aggregated, and limited but real. Every major MMP integrates with it.
Layer 2 is post-IDFA modeling. Channels like Meta and Google use their own first-party data plus aggregate SKAN signals to estimate conversions probabilistically. The estimates are less precise than deterministic attribution but generally directionally accurate for budget allocation.
Layer 3 is incrementality testing. The most robust answer to "is this channel working" in a post-IDFA world is to actually test it with holdouts. Spend $X on Channel A for two weeks, hold $X aside for a control region, measure the difference. Slow but truthful.
Which channels are most affected
Meta Ads took the biggest measured hit. CPIs reported in Meta's own dashboard are now systematically under-counted because users who opt out of ATT do not get tracked back. Real CPIs are usually 15–35% higher than Meta reports. Adjust your CAC ceilings accordingly.
TikTok and Snap are in similar shape; they invest heavily in their own modeling to compensate but the precision is below pre-ATT. Apple Search Ads, ironically, is unaffected — it runs inside Apple's ecosystem and uses different identifiers. ASA reporting remains clean.
Owned channels — email, push, packaging, organic social — are unaffected by ATT entirely. The attribution there is unambiguous because the user is already known. This is one of the reasons owned channels matter more in 2026 than they did five years ago.
Practical adaptations
For your acquisition program: assume reported paid CPIs are 15–30% low, set CAC ceilings accordingly, and weight owned channels more heavily in the mix. Lean on SKAN for relative channel comparisons but do not treat the absolute numbers as ground truth.
For incrementality: run a holdout once a quarter on your largest paid channel. The result tells you what fraction of conversions attributed to that channel were truly incremental. Most paid social channels show 50–70% incrementality; the rest would have converted via owned channels regardless.
For your in-app pre-prompt: invest in it. A pre-prompt that converts opt-in from 30% to 50% across your install base produces meaningful measurement uplift over the year. The engineering cost is small; the long-term measurement clarity is large.
“Post-ATT, the brands that win are the ones who stopped treating attribution as a precise number and started treating it as a directional signal. The dashboards changed; the work did not.”— Performance lead we trust
The Android equivalent: Privacy Sandbox
Google's Privacy Sandbox on Android is the equivalent privacy framework. It is being phased in gradually, replacing the Google Advertising ID with aggregate measurement APIs. The end state will look similar to ATT: aggregate attribution, no user-level cross-app tracking.
For ecommerce brands, the right preparation is the same: build owned channel depth, invest in first-party data, treat probabilistic attribution as the future state on both platforms. The brands that already adapted to ATT will adapt to Privacy Sandbox without much drama.
What not to do
Do not try to circumvent ATT. Fingerprinting techniques that work around the framework are explicitly against Apple's guidelines and trigger app removal when detected. Apple's detection has improved every year; the workaround vendors who promised "ATT-proof attribution" in 2021 have mostly disappeared.
Do not abandon mobile acquisition because attribution got murky. The channel still works. The buyers are still there. The math is harder to read but the underlying economics did not change. Brands that pulled out of mobile acquisition during the ATT confusion have spent the years since trying to rebuild ground that competitors never gave up.
Do not over-invest in MMP precision. Spending heavily on a measurement tool that reports cleaner numbers in your dashboard is not the same as actually having cleaner attribution. The dashboard cleanliness is an illusion; the underlying constraints are platform-imposed and apply to every MMP equally. Spend the budget on owned channel depth instead.
