Mobile Attribution Explained: How It Works Today

Most app teams can tell you how many installs they got last month. Far fewer can tell you which ads produced the users who paid. That gap is what mobile attribution closes, and since Apple's App Tracking Transparency (ATT) and the rise of privacy law, closing it works very differently from the way it did five years ago.

This guide covers what mobile attribution is, how it works, what changed on iOS and Android, and how to check your own setup.

What is mobile attribution?

Mobile attribution is the process of connecting an app install, or an action inside an app, to the ad, link or channel that caused it. It tells you which campaign, network and creative earned the credit, so spend can follow results rather than guesses.

You will also see it called mobile app attribution, mobile ad attribution or mobile advertising attribution. They describe the same job. Mobile traffic attribution and mobile attribution analytics usually refer to the reporting layer built on top: installs, revenue and retention broken down by source.

Attribution answers three questions:

• Where did this user come from? Paid network, influencer link, QR code, referral or organic.
• What did it cost? Spend divided by installs or by valuable actions.
• What happened next? Sign-ups, purchases and retention by source, so you judge channels on revenue, not install volume.

Mobile Measurement Partner (MMP): an independent platform that collects clicks, installs and in-app events from every channel and applies one set of attribution rules across all of them.

How does mobile attribution work?

Mobile attribution works by recording an ad interaction, recording the first app open, and matching the two under a defined set of rules. A typical flow looks like this:

1. A user taps an ad or link. The click carries campaign parameters (network, campaign, ad set, creative) to the measurement platform.
2. The user installs from the store. The store redirect is where the trail normally breaks, which is why attribution needs a matching step at all.
3. The SDK fires on first open. The attribution SDK in your app, or a server-to-server call, reports the install along with whatever signals the platform allows.
4. The MMP matches install to click. It checks the install against clicks and impressions within the attribution window and credits the winning touchpoint.
5. In-app events complete the loop. Purchases, subscriptions and day-7 activity are tied back to the same source, and postbacks send those signals to Meta, Google or TikTok so their algorithms can optimise.

Postback: a server message that reports an install or event back to an ad network, either from your MMP or, on iOS, from Apple's own frameworks.

Which matching methods do MMPs use?

The matching step in step 4 depends on what each platform allows. Most attribution today blends several methods:

Deterministic attribution: matching on an exact, shared identifier rather than an estimate.

On Android, Google's Play Install Referrer API returns the referrer URL plus click and install timestamps, which gives a deterministic match for Play Store installs without any device ID. Self-reported numbers from Meta and Google will rarely line up exactly with your MMP, and why self-attributing networks differ is worth understanding before you compare dashboards.

How does mobile attribution work after Apple's ATT and iOS 14 changes?

After ATT, iOS attribution runs on two tracks: user-level matching for people who allow tracking, and Apple's aggregated postbacks for everyone else. The device ID that once made iOS attribution simple is now opt-in.

What Apple's documentation states:

• ATT gates the IDFA. On iOS and iPadOS 14.5 and later, an app must request tracking authorisation before it can read the advertising identifier. Without it, the identifier returns all zeros. The prompt itself comes from the App Tracking Transparency framework.
• SKAdNetwork does not need consent. Apps can call SKAdNetwork regardless of tracking status. Since iOS 16.1, version 4 supports up to three postbacks per winning install.
• AdAttributionKit is the newer framework. AdAttributionKit, available from iOS 17.4, works with the App Store and alternative app marketplaces. It adds re-engagement attribution, and from iOS 18 publishers can pass a re-engagement URL that opens the installed app.
• The two interoperate. Apple says only one impression wins a conversion, whichever framework it came from, and SKAdNetwork conversion value updates are mirrored into AdAttributionKit.

Apple's user privacy guidance also states that apps may not derive data from a device to uniquely identify it, which rules out fingerprinting as a workaround. For a side-by-side view of the two frameworks, see AdAttributionKit vs SKAN.

Tech Explainer: what an Apple postback can tell you

• Fine conversion value: a 6-bit number from 0 to 63 that your team defines, for example "completed sign-up and first purchase". It only appears in the first postback.
• Coarse conversion value: low, medium or high, used in later postbacks or when privacy thresholds are not met.
• Three conversion windows: days 0 to 2, 3 to 7 and 8 to 35 after first launch, per Apple's AdAttributionKit documentation.
• Built-in delay: the first postback arrives 24 to 48 hours after its window closes; the second and third take 24 to 144 hours.
• Crowd anonymity: Apple assigns a postback data tier, so small campaigns may get fewer source-identifier digits and no fine value.

So plan your conversion value schema around the two or three signals that predict revenue.

What is changing on Android?

Android still allows more user-level attribution than iOS, but the advertising ID is no longer guaranteed.

• GAID can be deleted. Google's Play policy says users can delete their advertising ID in Settings, after which apps receive a string of zeros instead.
• Apps must declare it. Apps targeting Android 13 or above must declare the AD_ID permission in their manifest to read the ID.
• Privacy Sandbox is being retired. On 17 October 2025 Google announced it is retiring several Privacy Sandbox technologies, citing low adoption, including the Attribution Reporting API on Chrome and Android and the SDK Runtime. Google says feedback will inform an interoperable Attribution standard at the W3C.

The planning assumption: lean on Install Referrer and click IDs, treat GAID as a bonus, and do not build on Android's Attribution Reporting API.

Where do GDPR and India's DPDP rules fit?

Platform rules decide which signals exist. Privacy law decides whether you may process them.

• GDPR: processing personal data of people in the EU needs a lawful basis under Article 6 of the GDPR, and consent is one of them. Attribution that touches device IDs or IP addresses must sit inside your consent flow.
• DPDP: India notified the Digital Personal Data Protection Rules on 14 November 2025, with an 18-month phased compliance timeline and a requirement for standalone, clear consent notices.

For your MMP, check where raw data is stored, whether PII is hashed, and whether identifiers can stay in your own cloud. This is product due diligence, not legal advice.

Which attribution model should you use?

An attribution model is the rule that decides which touchpoint gets credit. Most app teams should start with last-touch and add others for specific questions.

• Last-touch: the final click before install gets full credit. It matches how ad networks report and suits performance budgets.
• Multi-touch: credit is shared across several touchpoints. Useful for long journeys, harder under privacy limits because individual paths are often invisible.
• Incrementality testing: holdout or geo tests measure what would have happened without the spend. It answers "did this channel cause growth?" rather than "who gets credit?".

For a deeper comparison by vertical, see mobile attribution models compared.

What does attribution analytics actually unlock?

Install counts hide channel quality. Attribution makes these cuts possible:

• Cost per install and per action, by network, campaign and creative.
• ROAS and LTV by source, so a higher-CPI channel that brings paying users wins over a cheap one that churns.
• Retention by source at day 1, day 7 and day 30.
• Quality-user postbacks, sending revenue events rather than raw installs back to ad networks.

Published Linkrunner customer stories show what source-level visibility enables: Playo cut Google Ads CPI by 34% in three months, and Matiks cut Meta CPI by 46% over three months while scaling monthly installs from around 65k to just over 100k.

How to validate your attribution setup

Before you trust any dashboard, run these checks. A measurement plan written before paid spend makes most of them easier.

1. Test installs on both platforms. Click your own tracking links on iOS and Android and confirm each install lands on the right campaign.
2. Check iOS postbacks are arriving. Confirm SKAN or AdAttributionKit data appears, and that your conversion values map to real events.
3. Compare to network dashboards. Expect gaps from differing windows and time zones; investigate large, sudden ones.
4. Reconcile revenue with finance. Attributed revenue should sit close to what your payment provider reports.
5. Review consent flows. Make sure ATT prompts and privacy notices fire before any identifier is read.

Platforms like Linkrunner make these checks routine: deterministic-first matching with no fingerprinting, a SKAN setup wizard, and postbacks that send revenue signals to Meta, Google and TikTok. Pricing runs from $0.010 down to $0.007 per attributed install, with 25k free installs to start.

The takeaway

Mobile attribution still tells you which spend creates valuable users. What changed is the plumbing: iOS blends consented user-level data with Apple's delayed postbacks, Android leans on referrer data, and consent law shapes what you may collect.

If you want to see this running on your own campaigns, request a demo from Linkrunner. Or start with the five validation checks above and see where your current setup falls short.

FAQs about mobile attribution

How does mobile attribution work after Apple's ATT and iOS 14 changes?

Since iOS 14.5, apps must get ATT consent before reading the IDFA. For consenting users, MMPs can match installs at user level; for everyone else, attribution relies on SKAdNetwork and AdAttributionKit postbacks, which are aggregated and delayed by at least 24 hours.

What is the impact of privacy changes on mobile user acquisition?

UA teams get less user-level data on iOS, slower feedback loops and coarser conversion signals, so campaign decisions lean on aggregated postbacks and modelled performance. On Android, deletable advertising IDs push measurement towards Install Referrer and click-based matching.

How can an MMP handle iOS privacy changes such as ATT and SKAdNetwork?

A good MMP respects the ATT status, receives and decodes SKAdNetwork and AdAttributionKit postbacks, and helps you design conversion values around revenue-predicting events. It then shows consented, deterministic and aggregated data side by side, so you can still compare channels.

Is SKAdNetwork being replaced by AdAttributionKit?

AdAttributionKit is Apple's newer framework, adding support for alternative marketplaces and re-engagement. Apple documents the two as interoperable, with one winning impression per conversion across both, so most apps need to support both today.