App Tracking Transparency: what the prompt controls

What does the ATT prompt actually decide?

It decides whether your app has the user's permission to track them. Apple requires that permission, through the App Tracking Transparency framework, in iOS 14.5, iPadOS 14.5 and tvOS 14.5 or later, before an app tracks a user or accesses the device's advertising identifier.^[1]

The answer has a concrete technical effect. Unless the user gives permission, the advertising identifier your app reads is all zeros, and you may not track them.^[1] That identifier is the IDFA, and it is what attribution tools used to match an ad click to an install on one specific device.

What counts as tracking?

Apple's definition is narrower than the everyday word. Tracking means linking user or device data collected from your app with user or device data collected from other companies' apps, websites or offline properties, for targeted advertising or advertising measurement.^[1] Sharing user or device data with data brokers also counts.^[1]

Two points follow from that wording.

• Ad measurement is in scope. The definition names advertising measurement, so matching a click in another company's app to an install in yours is tracking when it joins the two companies' data about one user or device.
• The definition is about other companies' data. It describes linking your data with someone else's. Read Apple's page for the cases it lists, and ask your own counsel if you are unsure where your app falls.

What still works when the user says no?

Apple says apps do not need to use App Tracking Transparency before calling SKAdNetwork APIs.^[2] It says the same about AdAttributionKit: you do not need the prompt to use it.^[3] That is why iOS reports from an MMP usually have two parts, a consented device-level part and a framework part.

Deferred deep links need care. Apple's FAQ asks whether you need permission to use third-party deep-linking or deferred deep-linking tools. Its answer is yes if the service passes unique identifiers or creates a shared identity of the user between apps from different companies for ad targeting, ad measurement or sharing with a data broker.^[1] If you rely on a deferred deep link on iOS, ask your provider how its matching works for users who have not given permission.

Should a small app show the prompt at all?

Show it if you gain something from the consented group. Work through these steps.

1. List every SDK in the app that shares user or device data with another company. If there is none, you may not need the prompt.
2. Decide what you would do with device-level data that you cannot do with campaign-level data. One example is longer event histories for those users.
3. If you show the prompt, choose the moment. Asking after the user has seen what the app does gives them a reason to answer.
4. Set up the framework path either way, because it covers the users who decline. Start with how SKAdNetwork postbacks work.

Next step

Once the prompt decision is made, read what you can still measure without the IDFA. It turns the table above into a reporting plan.