App Tracking Transparency
About 4 min read
Last updated: 2026-09-02
What Is App Tracking Transparency (ATT)
App Tracking Transparency (ATT) is a privacy protection framework introduced by Apple in iOS 14.5 (April 2021). It requires apps to obtain explicit user permission before tracking user behavior across other companies' apps and websites.
Before ATT, iOS apps could freely obtain the IDFA (Identifier for Advertisers), a device-specific advertising identifier, and link user behavior across apps. After ATT, before an app can access the IDFA, a dialog is displayed asking "Allow [app name] to track your activity across other companies' apps and websites?"
Because the decision rests with the user, apps have to be designed on the assumption that the request will be refused. Once the premise of linking the same person across apps no longer held, the measurement techniques that leaned on cookies and tracking pixels had to be rebuilt from the ground up.
Technical Mechanisms of ATT
ATT operates through the following technical mechanisms.
- IDFA access control: When an app attempts to obtain the IDFA from
ASIdentifierManager, the ATT framework checks the user's permission status. If authorization has not been granted - because the user declined, or because tracking is restricted on the device - the IDFA comes back as a zero-filled value (00000000-0000-0000-0000-000000000000). - Permission state management: Each app's permission state has four levels: "Not Determined," "Restricted," "Denied," and "Authorized." Users can change this at any time from "Settings → Privacy & Security → Tracking."
- SKAdNetwork: As an alternative to tracking restricted by ATT, Apple provides SKAdNetwork. It measures advertising conversions (installs and purchases) at an aggregate level without identifying individuals. While accuracy decreases for advertisers, user privacy is protected.
ATT is confined to Apple's platforms (iOS and iPadOS), yet its impact reached the whole industry. Google also pursued "Privacy Sandbox" on Android, an advertising technology that does not depend on the advertising ID, but in October 2025 it announced that main APIs such as Topics and Protected Audience would be retired on both Chrome and Android; as of August 2026, measurement on Android still assumes the advertising ID (GAID). While Do Not Track is a preference signal at the web browser level, ATT differs significantly in having enforcement power at the OS level.
ATT's Impact on Advertising and Business
ATT's introduction has brought structural changes to the digital advertising ecosystem.
- Decreased retargeting accuracy: "Retargeting" - showing ads for products a user viewed on an e-commerce site in another app - relied on cross-app tracking via IDFA. ATT has significantly reduced the accuracy of this technique.
- Impact on ad revenue: On its October-December 2021 earnings call (February 2022), Meta (formerly Facebook) said it expected the iOS privacy changes to be a headwind on the order of $10 billion for its business in 2022 - a figure given as the company's own outlook, not as a booked loss. Smaller app developers that had relied on precise measurement saw ad rates fall as well.
- Importance of first-party data: Unable to rely on third-party data, companies have taken a fresh look at the value of first-party data they collect directly (membership information, purchase history, in-app behavior) and shifted weight toward building their own member bases and email touchpoints.
- Revival of contextual advertising: "Contextual advertising" - delivering ads based on the context of displayed content rather than user behavior history - has taken on more weight as an option.
While GDPR requires consent for tracking as a European regulation, ATT is more directly effective as it is technically enforced by Apple as a platform provider.
Recommended User Settings and Actions
Settings to maximize ATT for privacy protection.
- Bulk deny tracking requests: Turn off "Allow Apps to Request to Track" in "Settings → Privacy & Security → Tracking" and no further dialogs appear, with every new request denied. If you chose to keep existing permissions when turning it off, however, apps you have already authorized can still obtain the IDFA (Apple's developer documentation states that a normal identifier is still returned in that state). Do not treat the single switch as the end of it - review your existing permissions as described in the next item.
- Review existing permissions: On the same settings screen, review the list of apps you have previously allowed to track and revoke unnecessary permissions.
- Don't rely on ATT alone: ATT controls tracking via IDFA but does not restrict data collection within apps. It is important to combine it with mobile app permission management to also minimize permissions for location, contacts, and other data.
On Android, you can reset or delete the advertising ID from the advertising (ad ID) entry in Settings; the wording and where it sits differ by device and Android version. There is no mechanism that obliges apps to ask for permission the way iOS ATT does, but a setting for declining personalized ads is provided.
To learn more about this topic, see Smartphone Privacy Settings: 8 Often-Overlooked Items.
Common Misconceptions
- Denying tracking with ATT stops all ads from appearing
- ATT only restricts tracking for personalized advertising; it does not stop ads from being displayed. When tracking is denied, generic ads (contextual ads) not based on behavior history are shown instead.
- Apps won't work properly without ATT permission
- ATT tracking permission is unrelated to app functionality. Apple's App Store Review Guidelines state that an app may not require users to enable system functionalities such as tracking in order to access its features or content, or in exchange for compensation. All features remain available even after denial.
ATT vs. Do Not Track Comparison
ATT (App Tracking Transparency)
A framework enforced by Apple at the iOS level. User permission is required before an app can access the IDFA. When permission is denied the app cannot obtain the IDFA, which makes it difficult to identify the same person across apps. It covers Apple's platforms (iOS and iPadOS).
Do Not Track (DNT)
A tracking refusal preference sent by web browsers via HTTP headers. Has no legal binding force, and there are no penalties for websites that ignore it. Because the receiving side is under no obligation to act on it, its practical effect is limited.