Five years on, ATT is still the most-cited attribution event in advertising.
Apple shipped App Tracking Transparency in April 2021. The opt-in rate stabilized around 25-30% globally and has not moved meaningfully since 1. Meta’s CFO told analysts in early 2022 that the iOS changes cost Meta something on the order of $10 billion that year. The IDFA, the unique device identifier that powered mobile attribution for a decade, became roughly 75% useless overnight 2.
The five-year retrospective is mostly retold as a privacy story. The more useful framing is operational. ATT taught a generation of media buyers what happens when a platform takes attribution away, and the lessons keep applying every time a new privacy event lands.
What ATT changed
Three operational shifts that came out of the April 2021 launch and have held since.
The first shift is the deprecation of device-level user tracking on iOS. The IDFA, available to advertisers before opt-in, is now available only on the 25-30% of users who actively granted permission 3. The other 70-75% are functionally invisible at the individual level for cross-app attribution.
The second shift is the rise of probabilistic attribution and SKAdNetwork. The platforms had to invent statistical models to fill the visibility gap. Those models are useful but lossy: they produce directional answers, not the precise user-level attribution the old IDFA permitted.
The third shift is the migration of measurement responsibility from the platform to the advertiser. Before ATT, Meta could promise an advertiser specific attributed conversions. After ATT, Meta could only report what it could see, which was substantially less. The advertiser had to fill the gap with first-party data infrastructure, server-side tracking, and downstream measurement against revenue.
The lessons that held
Three lessons from the ATT era that apply to every subsequent privacy event.
The reported numbers will lie before the policy lies. Meta’s pre-ATT attribution was always optimistic. ATT did not make it more optimistic; it reduced what Meta could see, which meant the dashboard finally caught up with what the bank account had been showing. Operators who had been treating Meta’s reports as gospel had a painful adjustment. Operators who had been running incrementality tests already knew the platform had been overstating. The pattern repeats every time a platform changes its attribution model.
Server-side tracking is the floor, not an enhancement. ATT made it clear that browser-side and device-side tracking would continue to erode. The advertisers who invested in Meta CAPI, Google Enhanced Conversions, and equivalent server-side flows in 2021-2022 entered 2026 with measurement infrastructure that handled the next two waves of changes without major rework. The advertisers who treated server-side as a future-roadmap item are still catching up 2.
First-party data is the durable asset. ATT, third-party cookie deprecation, state privacy laws, GDPR enforcement, and the iOS 26 fingerprinting protections all share one underlying direction: less platform-side visibility into individual users, more responsibility on the advertiser to know its own customers. The brands that built email lists, post-purchase survey programs, and CRM-integrated measurement spent five years compounding an asset that the policy environment kept making more valuable.
What ATT did not change
Two things the ATT panic suggested would happen that did not.
Mobile advertising did not collapse. Meta’s ad revenue continued growing after 2022; the company adapted, the measurement got messier, the campaigns kept producing returns for advertisers who learned to read the new signals. The headline-driven prediction that ATT would end mobile advertising was wrong.
Privacy did not improve in the way most users expected. ATT cut cross-app tracking for users who opted out, but the broader data economy adapted around the constraint. Probabilistic methods, fingerprinting, and platform-side aggregation kept the same advertising functions running with less individual-level visibility. The user-facing privacy improvement was real but smaller than the rhetoric implied.
What the five-year frame predicts for the next privacy event
Three durable predictions:
Whichever platform’s attribution gets curtailed next, the reported numbers will drop. The drop is not a real performance loss; it is reporting accuracy catching up with reality. Operators who already measured downstream revenue independently will see no change in what they were tracking. Operators who relied on platform reports will need 60 to 90 days to recalibrate.
The advertisers who already invested in server-side infrastructure will absorb the change without operational pain. The advertisers who did not will hire consultants in panic. The price of catching up after a policy event is roughly 3x the price of being ready before one.
The brands with first-party data programs will outperform brands without them by an increasing margin. The compounding gap that started widening in 2021 will keep widening through 2030.
The reflection that holds
ATT was framed as a privacy event. It was also, and more substantively, a measurement event. The brands that read it correctly built infrastructure that paid back across the five years that followed. The brands that read it as a one-time event to be weathered are still catching up.
The next attribution event is somewhere in the next 24 months. Possibly iOS 27. Possibly an FTC or EU enforcement action. Possibly a platform’s response to AI-driven shopping changing what attribution even means. The specific event is not yet predictable. The lesson from ATT is: be the operator who already has the infrastructure when it lands.
That work, like most paid media work in 2026, is unglamorous and pays in compounding returns. The brands doing it now will not see the result this quarter. They will see it five years from now, when the next ATT happens and they barely notice.