IDFA (Identifier for Advertisers) is a UUID Apple assigns to each iOS device for ad-tracking purposes. Before iOS 14.5 (April 2021), it was universally available to any installed app — MMPs read it on click and on install, matched the two, and attributed installs deterministically. This single mechanism underpinned mobile-app attribution from IDFA's introduction in 2012 until ATT (App Tracking Transparency) rolled out.
What ATT changed: iOS 14.5+ requires apps to display a system prompt and obtain explicit user consent before accessing the IDFA or tracking the user across other apps and websites. The prompt is rendered by iOS — Apple controls the wording, no dark patterns. If the user denies, the IDFA is returned as all zeros (effectively unavailable) and the app cannot track the user across other contexts.
Opt-in rate variability by app category
- Consumer apps with clear value-exchange messaging (streaming, dating, finance with personalization promised): 40-50%.
- Productivity and utility apps: 25-40%.
- Casual games: 20-30%.
- Hyper-casual games: 15-25% — users have lowest investment, least patient with prompts.
- Heavily-branded consumer apps: 50%+ — users trust the brand enough to grant consent.
Apps that prep users for the prompt (a pre-screen explaining what tracking enables) usually lift opt-in 10-20 percentage points vs cold prompts.
Attribution stack post-ATT
- For the 20-40% who opt in: classic IDFA-based deterministic attribution still works.
- For the 60-80% who opt out: SKAdNetwork (SKAN) handles attribution at the aggregated, fuzzed, delayed level.
- Probabilistic / fingerprinting attribution: was widely used in 2021-2023 as a fallback; Apple's restrictions on fingerprinting tightened over time, making it less reliable now.
- First-party signal (CRM, web-to-app, email-to-install): grows in importance as third-party tracking fades.
Android: GAID (Google Advertising ID). The equivalent identifier on Android, still broadly available as of 2026. Users can reset it or opt out (Settings → Google → Ads), but the opt-out rate is much lower than iOS ATT — typically 10-20% on Android vs 60-80% on iOS. Google's Privacy Sandbox for Android (in phased rollout) will introduce SKAN-like aggregated attribution by ~2027, gradually restricting GAID. Until then, Android attribution remains primarily deterministic.