ATT Opt-In Rates and What Tracking Changes Did to Marketing

App Tracking Transparency arrived with iOS 14.5 in April 2021 and turned the advertising identifier from a default into a permission. Five and a half years later the opt-in numbers have settled, the measurement stack has been rebuilt twice, and Google has quietly abandoned its own attempt at a replacement on Android.

What ATT actually requires

Apple's rule is simple to state: if your app collects data about people and shares it with other companies to track them across apps and websites, you must request permission through the ATT framework ¹. "Tracking" is defined in the App Privacy documentation as linking your app's user or device data with third-party data for targeted advertising or ad measurement, or sharing it with a data broker ². Implementation is a single call, ATTrackingManager.requestTrackingAuthorization, plus an NSUserTrackingUsageDescription string in Info.plist that explains the request ¹. Users who decline get a zeroed-out IDFA, and any domain your privacy manifest lists as a tracking domain stops resolving for that user.

One recent change worth noting: starting with iOS 27.2, Apple is offering an alternative ATT prompt design in the EU, initially limited to Germany, France, Italy, Poland and Romania. The rules on when permission must be requested have not changed, only the prompt itself (announced September 16, 2026) ¹¹.

Opt-in benchmarks, with their dates

The most important thing to understand about ATT benchmarks is that they measure different denominators. "Opt-in rate" usually means the share of users who tapped Allow among those who actually saw the prompt. It excludes users on "restricted" devices (minors, managed devices), users who had Limit Ad Tracking on before 2021, and the large group of apps that never show the prompt at all.

The gap between the 40 to 50 percent headline and the 26 percent authorized share is the "dual opt-in" problem: for an IDFA match to work, the same user has to allow tracking in both the publisher app where the ad ran and the advertiser app they installed. AppsFlyer cites this as one of the largest reasons attribution rates stay low even where consent rates look healthy ⁵. Roughly 30 percent of global iOS devices were already in a denied state when ATT launched because of Limit Ad Tracking, and around 14 percent are restricted and never see the prompt at all ^4,5.

Regional and vertical cuts move around a lot. Gaming apps consistently prompt more often than non-gaming apps and historically converted lower on a per-prompt basis ³; industry dashboards from attribution vendors have reported somewhat higher consent in parts of Asia-Pacific and lower consent in Western Europe (unverified: the regional dashboards could not be retrieved for this article, so treat that pattern as directional only). If you need a number for planning, use your own prompt's rate from a pre-prompt test rather than a global average.

SKAdNetwork and AdAttributionKit

Without an IDFA, iOS install attribution runs through Apple's own postback systems. SKAdNetwork, available since iOS 11.3, has the device rather than the advertiser decide which ad network won an install and sends a signed postback with no user or device identifiers ⁶. Since iOS 16.1 and SKAdNetwork 4, there are three conversion windows, days 0 to 2, 3 to 7 and 8 to 35 after first launch, each able to produce a postback ^6,7. The first postback is delayed 24 to 48 hours; the second and third, 24 to 144 hours ⁷.

How much a postback carries depends on crowd anonymity. Apple assigns each campaign a tier from 0 to 3 based on install volume; only tiers 2 and 3 receive the fine-grained conversion value, and tier 0 receives a two-digit source identifier and nothing else ⁷. That is the structural reason small campaigns see so little signal, and why UA teams consolidate spend into fewer, larger campaigns on iOS.

AdAttributionKit, available from iOS 17.4, is the successor framework. It keeps the same privacy model, with signed ads, postback tiers and three conversion windows, and adds re-engagement attribution and support for alternative app marketplaces in regions where they exist ⁸. Apple's SKAdNetwork documentation now carries a notice directing developers to AdAttributionKit for app ad campaigns, and two older SKAdNetwork methods are marked deprecated, though SKAdNetwork itself has not been retired ⁶. Neither framework requires ATT permission; both work regardless of the user's tracking choice ^6,8.

Privacy Sandbox on Android: wound down

For three years Google positioned Privacy Sandbox on Android as the eventual replacement for the advertising ID. That plan is over. On October 17, 2025 Google announced it was retiring the Attribution Reporting API, Topics and Protected Audience on both Chrome and Android, along with Protected App Signals and the SDK Runtime ⁹. Its feature status page, last updated August 14, 2026, lists every one of the Android APIs as "scheduled for phaseout" with a "do not launch" recommendation ¹⁰. The only attribution work Google says it is continuing is an interoperable web standard through the W3C ⁹.

The practical consequence for app marketers is that Android in October 2026 still runs on the Google advertising ID, with Play's user data policy as the main constraint, and there is no announced date for that to change. Any SDK roadmap that assumed Android would converge on an Apple-style postback model should be revisited.

What changed in user acquisition

The measurable effects of ATT fall into four buckets. First, iOS campaigns became harder to optimise because conversion signals arrive late, coarse and only for large crowds, which pushed budgets toward networks with the most first-party data and toward Android in the years immediately after 2021. Second, the "dual opt-in" requirement made deterministic retargeting on iOS a minority channel. Third, SKAdNetwork and AdAttributionKit rewarded concentration, so mid-sized advertisers lost relative efficiency to the largest spenders. Fourth, spend eventually came back: AppsFlyer's 2025 Performance Index, covering 16.2 billion installs across 39,000 apps, attributes overall ad spend growth to significant iOS gains ¹².

How this shows up in the charts

Top-free and top-grossing lists are, in part, a readout of paid acquisition, and ATT changed the cost of buying a position. Because iOS postbacks are delayed and tiered, a campaign that pushes an app into a category top 10 cannot be read day by day the way it could with IDFA attribution, so the burst-and-hold tactic became more expensive and less precise. Larger publishers with bigger crowds and better first-party models kept their places, which is one reason the upper ranks on iOS have turned over more slowly than on Android since 2021. On Android, with the advertising ID intact, deterministic UA still works, so mid-tier apps can still rank quickly with a short, targeted campaign. When you see an app jump on Google Play but not on the App Store in the same week, the two measurement regimes are often the explanation.