Fingerprinting (also called probabilistic attribution or statistical attribution) is the practice of identifying devices probabilistically based on combined signals — IP address, device model, OS version, screen size, language settings, time zone, sometimes installed-app list — rather than via deterministic identifiers like IDFA or GAID. The technique was widely used as an iOS attribution workaround in 2021-2023, after ATT made the IDFA opt-in.
How fingerprinting worked
- Ad network captures device signals at ad click (IP, device model, OS, screen, etc.).
- MMP captures the same signals when a new install happens.
- A probabilistic matching algorithm scores: "is this install likely the same device that clicked the ad earlier?"
- High-probability matches get attributed; low-probability matches don't.
Effectiveness depended on signal richness — more device signals → more accurate matching. Pre-ATT, fingerprinting was a useful fallback when IDFA was unavailable; post-ATT, it briefly became the primary iOS attribution alternative for 60-80% of users who opted out.
Why Apple restricted fingerprinting
- ATT's goal was to make users opt in to tracking. Fingerprinting circumvented that goal — tracking continued without user consent.
- Apple's App Store Review Guideline 5.1.2 explicitly prohibits using device signals to track users for advertising purposes when the user has opted out of ATT.
- Apple progressively enforced this between 2021-2024 — first warning developers, then rejecting app updates that included fingerprinting SDKs.
- Major MMPs (AppsFlyer, Adjust, Singular, Branch) all rolled back fingerprinting-based attribution features.
- By 2024, fingerprinting was effectively non-viable for any app distributed through the App Store. Apps that continued faced removal.
What replaced fingerprinting
- SKAN (SKAdNetwork) — Apple's privacy-preserving attribution. Aggregated, delayed, conversion-value-encoded. The legitimate iOS attribution path.
- First-party signal — CRM, email, login-based identifiers that carry across web → app or paid-channel → install with user consent.
- Apple Search Ads Attribution API — first-party attribution for ASA campaigns.
- Probabilistic modeling at the aggregate level — for measurement (not attribution), modeling channel-level contribution from aggregated data (MMM-style) is allowed.
The Android picture — fingerprinting is less restricted on Android, but Privacy Sandbox for Android (full rollout ~2027) will introduce similar restrictions. Most reputable MMPs are de-emphasizing fingerprinting on Android too in anticipation. Apps that build their attribution stack around fingerprinting are building on sand.