iOS ATT and cookie deprecation: what broke in 2021 and how the industry rebuilt measurement.

What actually happened in 2021

Apple shipped App Tracking Transparency in iOS 14.5 on April 26, 2021. The framework requires apps to ask user consent before tracking across other apps and websites. Around 75 percent of iOS users opt out. The change broke mobile-app attribution for every ad platform overnight. Combined with browser-level tracking restrictions in Safari and Firefox, attribution accuracy has degraded materially for every advertiser since 2021.

The mechanism is simple. Before iOS 14.5, an app could read a persistent device identifier called IDFA (Identifier for Advertisers) without user consent. Ad platforms used IDFA to match a user across apps and websites. After iOS 14.5, the app must show a system dialog asking the user to allow tracking. Most users say no. Without IDFA, ad platforms cannot deterministically match users, and attribution falls back on probabilistic methods.

The ripple effects went beyond mobile apps. Meta's stock dropped roughly 25 percent in early 2022 after the company disclosed iOS ATT was costing it roughly $10 billion in 2022 revenue. The whole performance-marketing industry pivoted toward first-party data, server-side tagging, and conversion APIs to rebuild measurement.

Claim: Meta disclosed in February 2022 that iOS ATT would cost the company approximately $10 billion in 2022 revenue. The stock dropped roughly 25 percent on the day of the disclosure, the largest single-day market-cap loss in stock-market history at the time. Source: Bloomberg, Reuters, and Meta Q4 2021 earnings call (February 2022). Context: The number is the clearest evidence of how much measurement value the IDFA was carrying. Other large platforms (Snap, Twitter, TikTok, YouTube) reported similar but smaller impacts. The performance-marketing industry's pivot to first-party measurement is partly because of this disclosure.

The browser-level cookie story

Browser tracking has been degrading since 2017. Apple's Intelligent Tracking Prevention (ITP) launched that year and has tightened with every Safari release. Firefox's Enhanced Tracking Protection became default-on in 2019. Chrome's Privacy Sandbox is phasing out third-party cookies through 2024-2026. Each browser independently restricts cross-site tracking, and the combined effect is the same as iOS ATT: persistent identifiers no longer work reliably.

The history runs back to 2017 with Safari's ITP 1.0. That release purged cross-site tracking cookies after 24 hours of inactivity. ITP 2.0 in 2018 restricted document.referrer leakage. ITP 2.3 in 2020 downgraded referrers and capped JavaScript-set first-party cookies at 7 days. Each update made browser-based attribution harder.

Firefox followed Safari's lead in 2019 with Enhanced Tracking Protection by default. Chrome was the holdout until Google announced the Privacy Sandbox initiative in 2020. The Privacy Sandbox includes Topics API (replacing third-party cookies for interest targeting), Attribution Reporting API (replacing pixel-based attribution), and FLEDGE / Protected Audiences (replacing audience retargeting). Rollout has been slow and contested. The third-party cookie deprecation in Chrome was repeatedly delayed and is still incomplete in 2026.

What the impact has been

Mobile-app attribution dropped roughly 30-50 percent in accuracy after iOS ATT. Browser-based attribution has degraded gradually since 2017 and continues. Multi-touch attribution paths are shorter and less complete than they were in 2020. Lookalike audience modeling is less precise. Conversion-lift studies on iOS have become statistically noisier. The cumulative effect is that ad-platform algorithms train on less signal and bidding optimization is less efficient.

How privacy changes since 2017 have hit specific marketing capabilities

Capability	Pre-2021 state	2026 state
Cross-app tracking on iOS	IDFA-based, near-universal	Opt-in only, ~25% of iOS users
Cross-site cookies in Safari	Working with some ITP restrictions	Effectively blocked since ITP 2.0
Cross-site cookies in Firefox	Working	Blocked by default since 2019
Cross-site cookies in Chrome	Working	Phasing out via Privacy Sandbox 2024-2026
First-party cookies (JavaScript-set)	Long-lived	Capped at 7 days in Safari ITP 2.3
Last-click attribution on web	Reliable	Undercount by 20-40% typical
Mobile-app attribution accuracy	~95% match rates	~50-70% match rates with SKAN
Lookalike audience precision	Strong	Materially weaker, recovering via first-party data

What the industry built in response

The post-2021 measurement stack relies on first-party data instead of browser cookies and device identifiers. Three building blocks: server-side tagging (sGTM), conversion APIs from every platform (Meta CAPI, Google Enhanced Conversions, TikTok Events API, LinkedIn CAPI), and customer data platforms (Segment, mParticle, Hightouch) that maintain a first-party identity graph. Together they recover most of what was lost — though not all.

Server-side tagging routes measurement events through a server you control before the browser can block them. Conversion APIs send those events to ad platforms via server-to-server connections that survive iOS ATT and cookie restrictions. Customer data platforms hold the first-party identity layer (hashed email, hashed phone, customer ID) that platforms now require for matching.

Apple's SKAdNetwork is the iOS-specific alternative. SKAN is a deterministic attribution framework where Apple aggregates conversion data and reports it back to ad networks in privacy-preserving form. SKAN 4 (launched 2023) added multiple conversion windows and richer postback data. It is the standard for iOS app-install attribution in 2026, even though it is materially less precise than the pre-2021 IDFA-based model.

How to rebuild measurement (5 steps)

Five steps that work for almost every mid-market and enterprise advertiser. The work takes 8 to 16 weeks. The most common skipped step is step 4 — incrementality testing — because it requires running controlled experiments instead of just trusting the platform-reported numbers.

1. Implement server-side tagging.Stand up sGTM on a first-party subdomain. Wire your web GTM container to send events through it. This is the foundation for everything else.
2. Connect conversion APIs for every paid channel.Meta CAPI, Google Enhanced Conversions, TikTok Events API, LinkedIn Conversions API, Snap CAPI. Each platform needs its own configuration. Pass hashed email and phone for matching.
3. Build a first-party identity graph.A customer data platform (Segment, mParticle, Hightouch) or a warehouse-based identity resolution layer. The graph holds hashed PII and customer IDs that platforms now require for matching.
4. Run quarterly incrementality tests.Geo holdouts on the largest channels. The tests validate whether attribution-model credit reflects real causal contribution. Run quarterly on the biggest two or three channels.
5. Implement SKAN 4 for mobile apps.If you run iOS app-install campaigns, SKAdNetwork is required. SKAN 4 supports multiple conversion windows and is the industry standard. Pair with Adjust, AppsFlyer, or Branch for SKAN data orchestration.

Quick answers

What is iOS ATT in plain English?

A privacy framework Apple shipped in iOS 14.5 (April 2021) that requires apps to ask user consent before tracking across other apps. About 75 percent of users say no. The change broke cross-app attribution overnight.

What is IDFA?

Identifier for Advertisers. A persistent device identifier on iOS that ad platforms used for cross-app tracking before iOS 14.5. After ATT, IDFA is only available with explicit user consent.

How much did iOS ATT cost Meta?

Meta disclosed approximately $10 billion in 2022 revenue. The stock dropped 25 percent on the day of disclosure. Other platforms reported smaller but still material impacts.

What is SKAdNetwork?

Apple's privacy-preserving attribution framework for iOS app installs. SKAN aggregates conversion data and reports it back to ad networks without identifying individual users. SKAN 4 (2023) is the current version.

What is the Privacy Sandbox?

Google's initiative to replace third-party cookies in Chrome with privacy-preserving alternatives. Includes Topics API (interest targeting), Attribution Reporting API (attribution), and FLEDGE / Protected Audiences (audience retargeting).

What replaced lost measurement?

Server-side tagging (sGTM), conversion APIs from every platform (Meta CAPI, Google Enhanced Conversions, TikTok Events API, LinkedIn CAPI), customer data platforms for first-party identity, and SKAdNetwork for iOS apps.

Frequently asked

What is App Tracking Transparency (ATT)?

Apple's privacy framework launched in iOS 14.5 on April 26, 2021. Apps must show a system dialog asking the user's consent before tracking across other apps and websites. About 75 percent of users opt out.

What did iOS ATT break?

Mobile-app attribution overnight. Without IDFA, ad platforms cannot deterministically match users across apps. Match rates dropped from ~95 percent to ~50-70 percent. Multi-touch attribution paths became shorter and less complete.

How much did iOS ATT cost the ad industry?

Meta alone disclosed approximately $10 billion in 2022 revenue impact. Snap, Twitter, TikTok, and YouTube reported smaller but still material impacts. The cumulative cost across the industry is well into the tens of billions of dollars.

What is cookie deprecation?

Browser vendors restricting or removing third-party cookies. Safari (ITP) and Firefox (ETP) have effectively blocked third-party cookies since 2017-2019. Chrome is phasing them out through 2024-2026 via the Privacy Sandbox.

Are third-party cookies fully gone in 2026?

Not yet in Chrome. Google has repeatedly delayed full third-party cookie deprecation in Chrome. As of 2026, Chrome still allows third-party cookies for most users, but a growing share of Chrome traffic has them restricted via Privacy Sandbox testing.

How do I rebuild attribution after iOS ATT?

Five steps. Implement server-side tagging (sGTM). Connect conversion APIs for every paid channel. Build a first-party identity graph (CDP or warehouse-based). Run quarterly incrementality tests. Implement SKAN 4 for iOS app installs.

What is server-side tagging?

Routing analytics events through a server you control instead of firing them directly from the browser. The pattern survives ad blockers, ITP, and cookie restrictions. Google's sGTM is the most-deployed implementation.

Will measurement keep getting worse?

Probably yes, though slowly. Each browser update tightens tracking restrictions. Each iOS update adds privacy controls. Each EU regulation (GDPR, ePrivacy, DMA) adds compliance overhead. The recovery direction is clear: first-party data, server-side measurement, and incrementality testing as the truth layer.