Mobile Attribution SDKs: How They Work

Short answer: a mobile attribution SDK is a small library inside your app that records the first open, reads the platform's install signals (the Play Install Referrer on Android, SKAN and AdAttributionKit on iOS), resolves deep links, and sends in-app events and revenue to your MMP so installs can be credited to the campaign that drove them. Linkrunner has SDKs for React Native, Expo, Flutter, native iOS, native Android, Web, Capacitor and Cordova, plus a native bridge guide for Unity.

Most teams pick an MMP on price, then meet the SDK when an engineer asks what it collects, how heavy it is and whether legal has signed off. This post explains how attribution SDKs work and what to check before you ship one. For step-by-step setup, see our Android SDK setup guide; for hours and owners, see the SDK integration project plan.

What Is a Mobile Attribution SDK?

A mobile attribution SDK is a library you add to your app that captures install, open and in-app event data on the device and sends it to a mobile measurement partner (MMP), which matches that data to ad clicks and impressions to decide which campaign gets credit.

SDK: a packaged set of code you add to your app to use a third-party service, here your MMP.

Install attribution: crediting an install to the ad, link or channel that drove it.

The SDK is the sensor; the MMP's servers do the matching, apply your attribution windows and send postbacks.

How Does an Attribution SDK Work?

An attribution SDK works in five jobs: it detects the first open, reads the platform's install signals, records events and revenue, resolves deep links, and on iOS registers for Apple's privacy-preserving attribution.

1. First open. Initialised at app start, the SDK recognises a new install and sends an install event. If init runs late, a paid install can land as organic.
2. Install signals. On Android it reads the Play Install Referrer, the referrer string Google Play attaches to the install, which carries the click identifier and UTM parameters. On iOS it relies on the IDFA where the user has allowed tracking, and on SKAN or AdAttributionKit where they have not.
3. Events and revenue. Calls such as trackEvent() send sign-ups, purchases and revenue. The MMP forwards selected events to Meta, Google and TikTok as postbacks so the networks optimise towards paying users.
4. Deep links. The SDK opens the right screen from a link, including deferred deep links, where a new user installs from the store and still lands on the intended screen on first open.
5. User identity. A call such as setCustomerUserId() attaches your own user ID so events join cleanly to your backend and CRM.

iOS vs Android: What Changes

Android attribution is mostly deterministic through the Play Install Referrer; iOS attribution depends on whether the user grants App Tracking Transparency (ATT) permission, and falls back to Apple's aggregated SKAN and AdAttributionKit postbacks when they do not.

Android

• Play Install Referrer: the strongest Android signal. Read it on first open and do not strip query parameters in your link handling.
• GAID: the resettable Google Advertising ID, used for matching and reinstall detection where consent allows.
• Meta install referrer: Meta passes its own referrer for app ads; Linkrunner documents how to read it in the Meta Install Referrer guide.

iOS

• IDFA: available only after the user accepts the ATT prompt. Your app shows the prompt; the SDK reads the result.
• SKAN and AdAttributionKit: Apple's privacy-preserving frameworks send aggregated, delayed postbacks for users who decline tracking. Linkrunner's iOS SDK and plugins set the SKAN postback endpoints in Info.plist for you. For the difference between the two frameworks, see What Is AdAttributionKit?.
• Timing: in Linkrunner's 2026 benchmark, the median click-to-install time was about 2 minutes on Android and around 40 minutes on iOS, which is why iOS needs longer windows and more patience in testing (full benchmark).

What an SDK Should Collect, and What It Should Not

A reasonable attribution SDK collects what matching and reporting need, and nothing more:

• Should collect: install and open timestamps, app version, OS and device model, the install referrer or click identifier, the advertising ID where consent allows, the events and revenue you choose to send, and deep link parameters.
• Should not collect by default: raw email addresses or phone numbers, contacts, precise location, or anything you have not explicitly passed to it.
• Should respect consent: the SDK should accept the user's consent state before it sends data and update when that choice changes.

Ask each vendor for the field list in writing and check it against your privacy policy and store data safety forms.

Privacy Controls in the Linkrunner SDK

Linkrunner's privacy controls map to the checklist above:

• Opt-in PII hashing: off by default. Enable it with enablePIIHashing(true) and the SDK hashes PII with SHA-256 before it is sent.
• Consent signals: pass the user's choice with setConsent() before init and update it whenever it changes. The Send Consent docs cover the details.
• Deterministic-first matching: IP and user-agent matching is used only as a fallback when no deterministic signal exists.

For teams that cannot let raw events leave their own cloud, Linkrunner also offers Bring Your Own Cloud, which keeps raw events, identifiers and PII inside your boundary. Certifications and policies are on the Trust Center.

App Size and Performance: What to Check

Check these on any MMP SDK:

• Size delta: build the app with and without the SDK and compare, using the app size reports in Google Play Console and App Store Connect. Measure your own build rather than trusting a vendor headline.
• Transitive dependencies: see what the SDK pulls in. Duplicate networking or JSON libraries add weight.
• Main-thread work: init should not block launch. Linkrunner's Android sample initialises inside a background coroutine, and the iOS SDK initialises asynchronously with try await.
• Network behaviour: check events are batched and retried offline, so a poor connection does not drop revenue.

SDK-less and Server-to-Server Options

An SDK-less integration sends installs and events to the MMP from your own servers over a REST API instead of from a library inside the app. It suits teams that cannot ship an app update quickly, or that already record every event on the backend.

The trade-off is ownership: your team must send the signals the SDK would otherwise collect, such as the install referrer, device identifiers and consent state.

Linkrunner documents this in its SDK-less (REST) integration guide. A common hybrid is to keep the SDK for installs and deep links, and send backend events such as subscription renewals through the Events Capture API.

How to Test an Attribution SDK Integration

Test an attribution SDK by running a real install from a tracked link on each platform, then confirming the install, the attributed campaign, each core event with revenue, and a deferred deep link all appear correctly in the MMP before any spend goes live.

A minimal test pass:

• Install: click a test campaign link, install and open the app, and confirm the install shows against that campaign, not organic.
• Events and revenue: fire each core event once and check names, parameters, revenue values and currency.
• Deep links: with the app uninstalled, click a deep link, install and confirm the first open lands on the right screen.
• Consent: decline tracking on iOS and refuse consent on Android, then confirm the SDK behaves as your policy says it should.
• Postbacks: check the events reach Meta and Google with the mapping you expect.

Linkrunner's integration testing guide and event and revenue testing guide walk through each check, and the dashboard includes an SDK Console for developers. For a full sign-off log, see Mobile Attribution QA.

Which Frameworks Does Linkrunner Support?

Linkrunner has an SDK for every common app stack, and each one handles install attribution, deferred deep links, in-app events and revenue, and SKAN on iOS. There are no paid add-ons per SDK.

Install commands and init code for each are on the Linkrunner SDKs page. Most teams integrate the SDK and go live on the same day, and most customers are fully live within a week. You can also run npx @linkrunner/skills add with your platform name and ask Claude Code, Cursor, GitHub Copilot or Windsurf to do the integration; the AI Agent Skills docs explain how.

Comparing SDKs across MMPs

If you are shortlisting MMPs for a cross-platform app, check four things in each vendor's own developer docs:

• A maintained package for your framework, with a recent release, not a community wrapper.
• Expo support: whether a config plugin exists, or whether you must eject.
• Unity: a dedicated package or a bridge to the native SDKs.
• Feature parity: whether deferred deep links, SKAN and consent work the same in the cross-platform SDK as in native.

Frequently asked questions

What does a mobile attribution SDK do?

It records the first open of your app, reads install signals such as the Play Install Referrer or the IDFA, and sends installs, events and revenue to your MMP. The MMP matches them to ad clicks to credit the right campaign and sends postbacks to ad networks.

Which mobile measurement partners have an SDK for React Native apps?

Linkrunner has a React Native SDK, rn-linkrunner on npm, which supports React Native 0.70 and later, and an Expo config plugin, expo-linkrunner. Other MMPs publish their own React Native packages; check each vendor's developer docs for version support and Expo compatibility.

Do I need an SDK for mobile attribution?

Not always. An SDK-less integration sends installs and events from your servers over a REST API, but your team then owns collecting the device signals and consent state an SDK would gather. Most apps use the SDK for installs and deep links and add server-side events where needed.

Does an attribution SDK collect personal data?

It collects device and event data needed for matching, and the advertising ID where the user allows it. With Linkrunner, PII hashing is opt-in: enable enablePIIHashing(true) and the SDK hashes PII with SHA-256, and setConsent() passes the user's consent choice.

Getting the SDK Right

An attribution SDK decides whether your paid installs are counted, and it handles user data on the way. Check what it collects, how it treats consent and what it costs in size, then test it end to end before spend. If you are on React Native, Flutter, Expo or native, Linkrunner's SDK docs have a quickstart, and the first 25k attributed installs are free.