Mobile Attribution Explained: How It Works Today

Most app teams know how many installs they got last month. Far fewer know which ads produced the users who paid. That gap is what mobile attribution closes, and since Apple's App Tracking Transparency (ATT) and the rise of privacy law, closing it works very differently from the way it did five years ago.

This guide covers what it is, how it works, what changed on iOS and Android, and how to check your setup.

What is mobile attribution?

Mobile attribution is the process of connecting an app install, or an action inside an app, to the ad, link or channel that caused it.

Mobile app attribution tells you which campaign, network and creative earned the credit for each install and in-app event. An SDK in the app records the first open, an MMP matches it to the earlier click, and spend follows results rather than guesses.

You will also see it called mobile ad attribution or mobile advertising attribution. They describe the same job. Mobile traffic attribution and mobile attribution analytics usually refer to the reporting layer built on top: installs, revenue and retention broken down by source.

Attribution answers three questions:

• Where did this user come from? Paid network, influencer link, QR code, referral or organic.
• What did it cost? Spend divided by installs or by valuable actions.
• What happened next? Sign-ups, purchases and retention by source, so you judge channels on revenue, not install volume.

Mobile Measurement Partner (MMP): an independent platform that collects clicks, installs and in-app events from every channel and applies one set of attribution rules across all of them.

How does mobile attribution work?

Mobile attribution works by recording an ad interaction, recording the first app open, and matching the two under a defined set of rules. A typical flow looks like this:

1. A user taps an ad or link. The click carries campaign parameters (network, campaign, ad set, creative) to the measurement platform.
2. The user installs from the store. The store redirect is where the trail normally breaks, which is why attribution needs a matching step at all.
3. The SDK fires on first open. The attribution SDK in your app, or a server-to-server call, reports the install along with whatever signals the platform allows.
4. The MMP matches install to click. It checks the install against clicks and impressions within the attribution window and credits the winning touchpoint.
5. In-app events complete the loop. Purchases, subscriptions and day-7 activity are tied back to the same source, and postbacks send those signals to Meta, Google or TikTok so their algorithms can optimise.

Postback: a server message that reports an install or event back to an ad network, either from your MMP or, on iOS, from Apple's own frameworks. For a free chapter by chapter primer, see the App Attribution Guide on how an install gets attributed.

What does an attribution SDK collect?

The attribution SDK is the sensor behind install attribution. It typically collects:

• Install and first-open timestamps, app version, OS and device model.
• The Play Install Referrer or click identifier on Android.
• The IDFA on iOS, only where the user has allowed tracking.
• The in-app events, revenue and deep link parameters you choose to send.

For setup, privacy and app-size checks, see our guide to how a mobile attribution SDK works.

Which matching methods do MMPs use?

The matching step (step 4 in the flow above) depends on what each platform allows. Most attribution today blends several methods:

Deterministic attribution: matching on an exact, shared identifier rather than an estimate.

On Android, Google's Play Install Referrer API returns the referrer URL plus click and install timestamps, which gives a deterministic match for Play Store installs without any device ID. Self-reported numbers from Meta and Google will rarely line up exactly with your MMP, and why self-attributing networks differ is worth understanding before you compare dashboards.

How does mobile attribution work after Apple's ATT and iOS 14 changes?

After ATT, iOS attribution runs on two tracks: user-level matching for people who allow tracking, and Apple's aggregated postbacks for everyone else. The device ID that once made iOS attribution simple is now opt-in.

What Apple's documentation states:

• ATT gates the IDFA. On iOS and iPadOS 14.5 and later, an app must request tracking authorisation before it can read the advertising identifier. Without it, the identifier returns all zeros. The prompt itself comes from the App Tracking Transparency framework.
• SKAdNetwork does not need consent. Apps can call SKAdNetwork regardless of tracking status. Since iOS 16.1, version 4 supports up to three postbacks per winning install.
• AdAttributionKit is the newer framework. AdAttributionKit, available from iOS 17.4, works with the App Store and alternative app marketplaces. It adds re-engagement attribution, and from iOS 18 publishers can pass a re-engagement URL that opens the installed app.
• The two interoperate. Apple says only one impression wins a conversion, whichever framework it came from, and SKAdNetwork conversion value updates are mirrored into AdAttributionKit.

Apple's user privacy guidance also states that apps may not derive data from a device to uniquely identify it, which rules out fingerprinting as a workaround. For a side-by-side view of the two frameworks, see AdAttributionKit vs SKAN.

Tech Explainer: what an Apple postback can tell you

• Fine conversion value: a 6-bit number from 0 to 63 that your team defines, for example "completed sign-up and first purchase". It only appears in the first postback.
• Coarse conversion value: low, medium or high, used in later postbacks or when privacy thresholds are not met.
• Three conversion windows: days 0 to 2, 3 to 7 and 8 to 35 after first launch, per Apple's AdAttributionKit documentation.
• Built-in delay: the first postback arrives 24 to 48 hours after its window closes; the second and third take 24 to 144 hours.
• Crowd anonymity: Apple assigns a postback data tier, so small campaigns may get fewer source-identifier digits and no fine value.

Plan your conversion value schema around the two or three signals that predict revenue.

What is changing on Android?

Android still allows more user-level attribution than iOS, but the advertising ID is no longer guaranteed.

• GAID can be deleted. Google's Play policy says users can delete their advertising ID in Settings, after which apps receive a string of zeros instead.
• Apps must declare it. Apps targeting Android 13 or above must declare the AD_ID permission in their manifest to read the ID.
• Privacy Sandbox is being retired. On 17 October 2025 Google announced it is retiring several Privacy Sandbox technologies, citing low adoption, including the Attribution Reporting API on Chrome and Android.

The planning assumption: lean on Install Referrer and click IDs, treat GAID as a bonus, and do not build on Android's Attribution Reporting API.

Where do GDPR and India's DPDP rules fit?

Platform rules decide which signals exist. Privacy law decides whether you may process them.

• GDPR: processing personal data of people in the EU needs a lawful basis under Article 6 of the GDPR, and consent is one of them. Attribution that touches device IDs or IP addresses must sit inside your consent flow.
• DPDP: India notified the Digital Personal Data Protection Rules on 14 November 2025, with an 18-month phased compliance timeline and a requirement for standalone, clear consent notices.

For your MMP, check where raw data is stored, whether PII is hashed, and whether identifiers can stay in your own cloud (product due diligence, not legal advice).

Which attribution model should you use?

An attribution model is the rule that decides which touchpoint gets credit. Most app teams should start with last-touch and add others for specific questions.

• Last-touch: the final click before install gets full credit, matching how ad networks report.
• Multi-touch: credit is shared across touchpoints. Useful for long journeys, but harder under privacy limits.
• Incrementality testing: holdout or geo tests measure what would have happened without the spend. It answers "did this channel cause growth?" rather than "who gets credit?".

For a deeper comparison by vertical, see mobile attribution models compared.

What does attribution analytics actually unlock?

Install counts hide channel quality. Attribution adds cost per install and per action, ROAS and LTV by source, retention at day 1, 7 and 30, and revenue postbacks to ad networks.

Published Linkrunner customer stories show what this enables: Playo cut Google Ads CPI by 34% in three months, and Matiks cut Meta CPI by 46% while scaling monthly installs from around 65k to just over 100k.

How to validate your attribution setup

Before trusting any dashboard, run these checks. A measurement plan written before paid spend makes most of them easier.

1. Test installs on both platforms. Click your own tracking links and confirm each install lands on the right campaign.
2. Check iOS postbacks are arriving. Confirm SKAN or AdAttributionKit data appears, and that your conversion values map to real events.
3. Compare to network dashboards. Expect small gaps; investigate large, sudden ones.
4. Reconcile revenue with finance. Attributed revenue should sit close to what your payment provider reports.
5. Review consent flows. Make sure ATT prompts and privacy notices fire before any identifier is read.

Platforms like Linkrunner make these checks routine: deterministic-first matching, with IP and user-agent matching only as a fallback, a SKAN setup wizard, and postbacks that send revenue signals to Meta, Google and TikTok. Pricing runs from $0.012 down to $0.008 per attributed install, with 25k free installs to start.

The takeaway

Mobile attribution still tells you which spend creates valuable users. What changed is the plumbing: iOS blends consented data with Apple's delayed postbacks, Android leans on referrer data, and consent law shapes collection.

If you want to see this running on your own campaigns, request a demo from Linkrunner. Or start with the five validation checks above and see where your current setup falls short.

FAQs about mobile attribution

What is mobile app attribution?

Mobile app attribution connects each app install and in-app action to the ad, link or channel that drove it. An SDK records the first open, an MMP matches it to the earlier click or impression, and reports show installs, revenue and retention by source.

How does mobile attribution work after Apple's ATT and iOS 14 changes?

Since iOS 14.5, apps must get ATT consent before reading the IDFA. For consenting users, MMPs can match installs at user level; for everyone else, attribution relies on SKAdNetwork and AdAttributionKit postbacks, which are aggregated and delayed by at least 24 hours.

What is the impact of privacy changes on mobile user acquisition?

UA teams get less user-level data on iOS, slower feedback and coarser conversion signals, so decisions lean on aggregated postbacks. On Android, deletable advertising IDs push measurement towards Install Referrer and click IDs.

How can an MMP handle iOS privacy changes such as ATT and SKAdNetwork?

A good MMP respects ATT status, decodes SKAdNetwork and AdAttributionKit postbacks, helps you design conversion values around revenue-predicting events, and shows consented and aggregated data side by side.

Is SKAdNetwork being replaced by AdAttributionKit?

AdAttributionKit is Apple's newer framework, adding support for alternative marketplaces and re-engagement. Apple documents the two as interoperable, with one winning impression per conversion across both, so most apps need to support both today.