Setting up privacy-compliant app tracking after ATT and SKAdNetwork 4 means combining a consent management platform (CMP) for ATT prompts, a correctly configured SKAN 4 conversion value schema, and a mobile measurement partner (MMP) that supports privacy-preserving attribution. Apple’s App Tracking Transparency framework requires explicit user consent before any cross-app tracking occurs, while SKAN 4 provides aggregated, anonymised attribution data for installs that happen without consent. The sections below walk through each component of a compliant and functional tracking setup.
What changed about app tracking after ATT and SKAN 4?
ATT and SKAdNetwork 4 together shifted mobile attribution away from deterministic, user-level tracking toward probabilistic and aggregated models. ATT, introduced in iOS 14.5, requires users to opt in before their IDFA can be used. SKAN 4, released with iOS 16.1, extended Apple’s privacy-preserving attribution framework with new capabilities including hierarchical source identifiers, multiple conversion windows, and web-to-app attribution support.
Before these changes, mobile measurement partners could match installs to ad clicks using the IDFA with high accuracy. After ATT, opt-in rates in many markets settled well below 50%, meaning a large share of installs now fall outside deterministic attribution. SKAN 4 fills part of that gap by sending postbacks directly from Apple to ad networks, but the data arrives with delays, noise, and without user-level detail. The practical result is that attribution data mismatch between your MMP dashboard and ad platform reporting has become the norm, not an exception. Understanding this gap is the starting point for any accurate measurement strategy in 2026.
What is a privacy manifest and do all apps need one?
A privacy manifest is a structured file (PrivacyInfo.xcprivacy) that declares the data types your app and its third-party SDKs collect, the reasons APIs are accessed, and which tracking domains are used. Apple requires privacy manifests for all apps submitted to the App Store, and since May 2024, apps using certain high-impact third-party SDKs must include those SDKs’ own manifests as well.
In practical terms, yes, virtually all apps with any form of analytics, attribution, or advertising SDK need a privacy manifest. If your app uses any of Apple’s required reason APIs, such as those for file timestamps, system boot time, or disk space, you must declare a valid reason for that access. Failure to include an accurate manifest can result in App Store rejection. The manifest does not replace ATT consent; it sits alongside it as a transparency layer that Apple uses to enforce its privacy policies at the platform level.
How does SKAdNetwork 4 attribution actually work?
SKAdNetwork 4 attribution works by having the ad network sign an ad impression with a campaign identifier, then having the device send a postback to the ad network and optionally to a developer-specified endpoint after a conversion window closes. The postback contains a source identifier, a conversion value, and a coarse value, but no user-level data. Apple adds crowd anonymity thresholds before releasing fine-grained values.
SKAN 4 introduced three conversion windows (0 to 2 days, 3 to 7 days, and 8 to 35 days), each generating its own postback. This allows you to measure not just installs but also post-install activity across a longer period. The source identifier now supports up to four digits, giving ad networks more campaign granularity than earlier versions allowed. However, the crowd anonymity requirement means that low-volume campaigns may only receive coarse conversion values (low, medium, or high) rather than the fine-grained values you configure. This is a common reason why app install numbers look wrong or incomplete when comparing SKAN data to your MMP dashboard.
Which mobile measurement partner (MMP) should you use with SKAN 4?
The right MMP for SKAN 4 is one that supports full SKAN 4 postback ingestion, conversion value schema management, and probabilistic modelling to fill the attribution gaps that SKAN’s crowd anonymity creates. The leading options in 2026 are Adjust, AppsFlyer, and Branch, all of which have built dedicated SKAN 4 infrastructure.
When evaluating MMPs for iOS install tracking, look for these capabilities:
- SKAN 4 postback parsing across all three conversion windows
- Conversion value schema configuration that maps your key in-app events to fine-grained and coarse values
- Probabilistic attribution for opted-out users, using signals like IP address and device type
- Data-driven attribution modelling to reconcile unattributed installs and surface ROAS estimates closer to reality
- Real-time dashboard parity checks to flag attribution data mismatch between the MMP and ad platform
Adjust and AppsFlyer both offer dedicated SKAN 4 dashboards with modelled conversion reporting. Branch is particularly strong for teams running web-to-app campaigns that need to bridge attribution across both environments. The choice often comes down to your existing tech stack, the ad networks you run, and how much custom event mapping you need.
How do you set up a consent management platform for ATT compliance?
Setting up a consent management platform (CMP) for ATT compliance involves integrating a CMP SDK that triggers Apple’s ATT permission dialogue at the right moment in the user journey, stores the consent outcome, and passes it to your analytics and attribution SDKs so they behave accordingly. Popular CMP options include Usercentrics, OneTrust, and Didomi, all of which have iOS-specific ATT modules.
The timing of the ATT prompt matters significantly. Showing it immediately on first launch produces lower opt-in rates. A more effective approach is to present a pre-permission screen first, explaining in plain language why tracking benefits the user, then triggering the native ATT dialogue. This is sometimes called a “soft ask” or pre-prompt screen. Once the user responds, your CMP should pass the consent status to your MMP, ad SDKs, and analytics tools so that each one activates or limits data collection in line with the user’s choice. Keeping consent records is also important for audit purposes under GDPR and Apple’s own review process.
What in-app events should you still track under privacy constraints?
Under privacy constraints, you should prioritise tracking the in-app events that directly map to your conversion value schema and business goals: registration, first purchase, subscription start, and any event that signals high-intent user behaviour within the SKAN conversion windows. These events feed your SKAN postbacks and inform your MMP’s modelled attribution.
For opted-in users (those who granted ATT permission), you can still collect full user-level event data via your MMP, so track a broader set of events including tutorial completion, feature adoption, and retention milestones. For opted-out users, focus your event schema on the events that fit within SKAN’s fine-grained conversion value range (0 to 63) across the three windows. Prioritise events by revenue impact and funnel position. Tracking too many low-signal events wastes conversion value “slots” that could be assigned to higher-value actions. A clean, intentional event taxonomy is more useful than a comprehensive one that dilutes your SKAN signal.
How do you validate that your privacy-compliant tracking setup is working?
You validate your privacy-compliant tracking setup by running end-to-end install tests, checking postback delivery from SKAN, comparing attributed versus unattributed install volumes in your MMP, and confirming that your conversion value schema is firing correctly for test users. A working setup shows postbacks arriving within expected windows and conversion values matching the events you configured.
Here is a practical validation checklist:
- Test install flow: Use a test device with ATT enabled and one without, then confirm your MMP records both correctly (deterministic for opted-in, probabilistic for opted-out).
- SKAN postback verification: Use your MMP’s SKAN testing tools or Apple’s StoreKit testing environment to confirm postbacks are being received and decoded.
- Conversion value audit: Check that your defined in-app events are updating the conversion value within the first 24 hours of install, as this determines which fine-grained value Apple sends.
- Dashboard reconciliation: Compare install counts across your MMP, ad platform, and App Store Connect. Persistent large discrepancies often indicate misconfigured postback URLs or a missing privacy manifest entry.
- ATT consent rate monitoring: Track your opt-in rate over time. A sudden drop can indicate a broken pre-permission screen or an ATT prompt appearing too early in the onboarding flow.
If your iOS install tracking still looks inaccurate after these checks, the most common causes are an outdated SKAN version declared in your Info.plist, a conversion value schema that never updates because key events fall outside the first conversion window, or ad networks that have not yet migrated to SKAN 4 postback endpoints. Addressing these systematically closes most of the gap between reported and actual install numbers.
If you want expert support building and validating this setup, our app growth stack services cover the full attribution infrastructure, from MMP configuration to conversion value schema design. You can also book a free consultation with our team to review your current tracking setup and identify where your attribution data may be falling short. At Wuzzon, we have worked with Adjust, AppsFlyer, and Branch across dozens of iOS and Android apps, and we know exactly where these setups tend to break down.
Frequently Asked Questions
What ATT opt-in rate should I realistically expect, and does it affect whether SKAN 4 is worth setting up?
Opt-in rates vary significantly by app category, region, and how well you implement a pre-permission screen, but industry averages in most markets sit between 25% and 45%. Even at the higher end of that range, the majority of your installs will fall outside deterministic attribution — which is exactly why SKAN 4 is worth setting up regardless of your opt-in rate. SKAN 4 postbacks cover opted-out installs that would otherwise be completely dark, and when combined with probabilistic modelling from your MMP, you recover a meaningful portion of attribution signal that would otherwise be lost entirely.
Can I use SKAN 4 attribution on Android, or is it iOS-only?
SKAdNetwork is an Apple framework and applies exclusively to iOS apps distributed through the App Store. Android has its own privacy-preserving attribution solution called the Privacy Sandbox for Android, which includes the Attribution Reporting API, but it operates differently from SKAN and is still maturing in terms of ad network and MMP adoption. If you run campaigns across both platforms, you will need separate measurement strategies: SKAN 4 plus ATT consent management for iOS, and a combination of Privacy Sandbox APIs and consented measurement for Android.
What is the most common mistake teams make when configuring their SKAN 4 conversion value schema?
The most common mistake is mapping too many events across the full 0–63 fine-grained conversion value range without accounting for the crowd anonymity threshold. If individual conversion values don’t accumulate enough installs to meet Apple’s anonymity minimum, you receive only coarse values (low, medium, or high) instead of the fine-grained values you carefully configured — making your schema effectively useless for optimisation. A better approach is to anchor your schema around a small number of high-volume, high-intent events that are likely to fire within the first conversion window (0–2 days), ensuring you consistently hit the threshold needed for fine-grained postbacks.
Do I need to update my privacy manifest every time I add a new third-party SDK?
Yes — every time you integrate a new third-party SDK that accesses Apple’s required reason APIs or collects data types not already declared, you must update your PrivacyInfo.xcprivacy file accordingly. Many of the major analytics, attribution, and advertising SDKs now ship with their own privacy manifest files that get merged into your app’s manifest at build time, but you should always verify this is happening correctly as part of your release checklist. Failing to keep the manifest current is one of the more frequent causes of App Store review rejections for apps that were previously compliant.
How long does it take to receive SKAN 4 postbacks, and how should I plan reporting around the delay?
SKAN 4 postbacks are not delivered in real time — Apple introduces a randomised delay on top of each conversion window’s closing time to further protect user privacy. For the first window (0–2 days), postbacks typically arrive within 24–48 hours after the window closes, but delays of several days are not uncommon. For the second and third windows (up to 35 days post-install), the total wait before data is available can extend to 5–6 weeks. The practical implication is that SKAN data should never be used for same-day campaign decisions; build your reporting cadence around weekly reviews and rely on your MMP’s modelled attribution for faster directional signals.
If my app is already live and has never had a privacy manifest or CMP, where should I start?
Start with the privacy manifest, as it is the harder App Store requirement to overlook — an app submission without one can be rejected outright. Audit every SDK in your app, check whether each one ships its own PrivacyInfo.xcprivacy, and build your app-level manifest to cover any gaps. Once the manifest is in place, integrate a CMP with a pre-permission ATT screen before your next major release, and configure your MMP to respect the consent outcome. Running a phased approach — manifest first, then CMP, then SKAN schema refinement — is more manageable than attempting a full overhaul in a single release cycle.
Will probabilistic attribution from my MMP ever be as accurate as IDFA-based tracking was before ATT?
No — and it is important to set that expectation clearly within your team and with stakeholders. Probabilistic attribution uses device signals like IP address, device model, and OS version to make statistically informed guesses about install sources, but it is inherently less precise than a direct IDFA match. That said, leading MMPs have significantly improved their probabilistic models, and when combined with SKAN postbacks and data-driven attribution modelling, you can reconstruct a reasonably accurate picture of campaign performance at the channel and campaign level. The shift to accept is from user-level certainty to campaign-level confidence intervals — which, for most optimisation decisions, is sufficient.
Related Articles
- Best mobile marketing agencies to help you choose between Adjust, AppsFlyer, and Kochava
- 6 questions to ask before renewing your app tracking contract
- Why don't users open my app a second time?
- How do I know which ad channel is actually driving app installs?
- 5 common causes of broken app deep links
- Why do users lose their cart after reopening my app?
- 9 creative ad formats to advertise your app and stand out
- Why is it important to advertise your app consistently?
- What metrics matter for app store optimization?
- 5 app store description templates for brand apps
EN 
NL 