What is IDFA and How to Handle the IDFA Changes
Originally published on 09.07.20 and updated on 23.06.21.
At long last, iOS 14.5 arrived recently, and with it came the major shakeup for app developers and advertisers that’s been the talk of the town over the last year. In case you’ve been off the mobile marketing grid for a while, the de facto elimination of the Identifier for Advertisers (IDFA) and introduction of Apple’s ATT Framework is what we’re talking about.
While iOS 14 is loaded with lots of great new features for users and interesting ASO opportunities for analysts, for those looking to advertise their app the IDFA “phase-out” has been a major source of uncertainty and concern. Even before the changes to the IDFA were announced, the release of iOS 14 was already a big deal. However, with more strict privacy rules and regulations as part of the package, the new operating system has sent shockwaves throughout the industry regarding changes in the way app marketers choose to spend their ad budgets.
In what felt like a much welcome stroke of good luck at the time, Apple decided to delay the changes to the IDFA until recently. While this was great news for app marketers who were scrambling to figure out what to do in the absence of the highly popular unique identifier, the change is now here and there’s no way around it. So, in the interest of setting yourself up for the best chance of success, we’ve put together some suggestions to help you respond in the best way possible.
What is IDFA?
First things first, before we delve into the ins and outs of the Apple IDFA changes, let’s define exactly what the IDFA is and why its numbered days garnered so much attention. FYI, it stands for Identifier for Advertisers.
In short, the IDFA tracks user data across apps and websites (and not just ones owned by the company doing the tracking) in order to provide targeted advertising. Its technology is similar to a cookie, but even more powerful because it allows for full mobile attribution tracking of individual users from install to usage.
What is SKAdNetwork?
SKAdNetwork is Apple’s attribution framework that helps advertisers measure the success of their campaigns while protecting user privacy and preventing access to user-level data. It doesn’t rely on IDFA or other advertisers like other attribution methods, which means it doesn’t require ATT user consent.
Apple performs the attribution itself, and then notifies the relevant network. The network can then send the data to an MMP. MMPs can produce reports from all of the data from each network.
The Self Attributing Networks (Google, Facebook, TikTok, Twitter, Snap) have all implemented SKAdNetwork.
What is the ATT Framework?
ATT Framework stands for App Tracking Transparency Framework. It’s a privacy regulation introduced by Apple to help consumers safeguard their personal data on Apple devices. It involves app developers requesting permission to track users and access identifiers via an in-app pop-up prompt. Without a user’s permission, apps will not be able to track them or their device’s identifiers.
The ATT Framework also adds app privacy labels in the App Store so users can see how their data is used.
As far as stats go, the ATT opt-in rate thus far is around 40% on average according to AppsFlyer. However, that can be broken down into different verticals, with mobile gaming dominating with a 52% opt-in rate. So far, only one out of three apps has implemented the ATT Framework, and only just under 50% of iOS users have adopted iOS 14.5+.
It’s become clear that companies that don’t implement the ATT prompt will not have access to user-level data at all. Without ATT opt-in, IDFAs will be gated and probabilistic techniques for ad measurement will be banned.
However, for companies that do implement the prompt and receive a full opt-in from users, it’s great news. If a user sees an ad on Facebook and clicks on it, then moves to the app and clicks to allow tracking, then you will see the data on the regular UI on the raw data level and access IDFA. For any users that opt out, the data will only be visible on the SKAdNetwork.
Why Might Companies Avoid the ATT Prompt?
There are certain businesses that might benefit more from not including the ATT prompt than doing so. There are a number of reasons this could be the case, but more often than not it will relate to the category they exist within. Certain apps, particularly those in the Health and Wellbeing category, could risk scaring their users that are sensitive to what happens with their data. In this vertical, many companies are afraid of implementing the prompt because of the nature of their apps. Their target users are not always open to the idea of tracking. Even if these companies were to do an initial prompt providing context and explaining why they need access to the data, the users could be so intimidated that the drop-out rate could reach levels of 70-80%. In this case, the companies would only acquire around 20% of user level data. Firstly, this won’t be enough, and secondly, it will potentially lose the company lots of users.
Other reasons for avoiding the ATT prompt could be to save on the development work that it requires, which can be both time consuming and costly. In this case, you can invest the time and money into bettering your SKAdNetwork and decide to rely solely on that. You will not have the user level data, but you might already know that the percentage of users who opt-in within your industry is so low that there’s not enough data to be relevant to you anyway.
Companies that don’t want to implement the prompt at all are willing to give up on the user level data for iOS 14.5 and above. They will then only have the data through the SKAdNetwork because they’re not giving users the option to be tracked. On the back end, those apps will need to avoid requesting identifiers within the app. If they do so, Apple can ban them from the App Store.
Although it’s a particular strategy to avoid scaring away users with the prompt, most companies want a chunk of user level data if they can get it. For big companies, such as those spending millions of dollars a month, it matters significantly. Even an opt-in rate as low as 40% can give these big apps a good amount of user level data to track.
IDFA Privacy Enhancements
Previously an active IDFA on an app installed by an iOS user was the default, buried deep away in the app’s settings and hard to find (provided you even knew about it to look for in the first place). However, as part of the iOS 14 shakeup, the new policy will require users to give consent to be tracked.
The New Order of Business: The Prompts and Where to Place Them
The way in which this process now plays out is as an opt-in delivered in the form of a pop-up notification with messaging that says “[App Name] would like permission to track you across apps and websites owned by other companies.” or ”Allow [App Name] to track your activity across other companies’ apps and websites?”
Not surprisingly, expectations of receiving a high user opt-in rate were low at best. In fact, the general sentiment within the industry was that expectations of even just a 10% opt-in rate would be borderline wildly optimistic. This development quickly had a huge impact on the entire $80 billion industry, where experts feared even the most cleverly worded opt-in message wouldn’t be able to miraculously solve the problem.
Beyond Apple’s own mandatory prompt, which can often scare users, there is an additional optional prompt where some of the words are editable. You can change a few of the words, but not the messaging (or the other 90% of text within the prompt).
The additional prompt can be implemented for the ATT Framework on Adjust and AppsFlyer and can be tested in different places within the app. For example, if you place the prompt at the beginning of the user journey and the user clicks no, then you’re risking losing them at an early stage. If you put the prompt very close to the purchase event, then you’ll get the information you need from this stage and above only. So where should you put the prompt?
Adding the extra prompt also means you’re making users click through two prompts instead of just one. This can be a positive for giving context and making the mandatory prompt seem less scary on the one hand, but on the other hand it can throw users off course and make them question why they’re being asked the same question twice. The only way to know what will be most successful for your app is to test, test and test some more.
Do you put the personalized prompt at the beginning so that you can track the whole flow? Companies are doing a lot of testing before launching the additional prompt.
There’s also a lot of testing surrounding the wording used in the prompt as well as the placement. The research suggests that the fewer words used, the better. There’s also suspicion regarding use of words such as “track” and “collect”, which both have the propensity to instil fear or a negative reaction.
Facebook’s Response to Apple
Facebook’s stance has taken a full 360 degree turn lately. Initially, it’s safe to say that Facebook wasn’t best pleased with Apple regarding its IDFA changes. In a newsletter on the subject, Facebook outright disagreed with Apple. What’s more, in what felt like a battle between two global mobile leaders, Facebook accused Apple of only benefiting itself while damaging the rest of the industry.
Despite this, Facebook’s position was one of practicality. While Facebook publicized its disapproval of the iOS 14 privacy changes, it also recognized that it had no choice but to accept them to avoid the risk of its apps being blocked from the App Store. Which is precisely why Facebook committed itself to offering a solution, and encouraged everyone to implement its new SDK for iOS 14.
Now, Facebook’s stance has landed in a more supportive arena. Perhaps because it doesn’t have a choice – you need to configure your app events for Apple’s SKAdNetwork to track and measure conversions of iOS 14 users in order to create iOS 14 ad campaigns. There are three ways to configure SKAdNetwork events that Facebook recommends:
- Use recommendations: confirm recommended events based on available data (use for Facebook SDK).
- Import from partner app: Use an event configuration schema to configure your events on your MMP’s platform (if you use one). Your event configuration schema can be imported to Facebook, but edits must be made on the MMP platform.
- Customise: each event and value set can be chosen and configured individually (this option is for if you use App Events API, Facebook SDK or an MMP and want your events configuration to be consistent across platforms).
Facebook’s SKAdNetwork configuration in its Facebook Events manager allows you to choose up to 63 individual or bundled app events and establish a priority for each based on its importance for your business. The event priority works as follows: only the highest priority event will be sent when there are multiple customer actions during a conversion window.
Facebook has been providing resources to act as a guide through the changes in IDFA 2021. Our advice is: use them. We’re in a time that’s a learning curve for everybody, so utilizing every tool at your disposal will no doubt minimize the impact.
How We Have Responded To The New IDFA Rules And How Your Business Should Act
Now, with automatic access to the IDFA a thing of the past, the good news is that it doesn’t have to be the end of the world for the industry. Yes the IDFA gets the lion share of the attention, but it’s important to keep in mind that it isn’t the only game in town. Apple own attribution framework SKAdNetwork provides an, albeit limited, alternative:
If we could have a conversation with Apple we reckon it would go something like this.
Moburst: “How are we supposed to track iOS users now?”
Apple: “Don’t panic. We’re going to leave you with a few crumbs to track some users along the way, so we’ve built our own iOS tracking network.”
Apple’s SKAdNetwork means iOS 14.5+ data will come only from this network. It doesn’t reveal everything that the IDFA does, but some of the same things will remain. There is one big issue, however, surrounding the delay it poses. With the SKAdNetwork, every event has a three day window delay. Once upon a time you were able to see real time data that allowed publishers to track someone doing an activity within an app, including real-time purchases. Now there will be a three day delay to begin tracking, and for each event you want to track there’ll be another 24 hour delay. This will lead to a loss of information and the inability to respond in real time through optimized tracking.
Each MMP has already bundled the SKAdNetwork into the SDK that enables advertisers to control the data flow from the MMP’s UI without needing to implement another SDK. Essentially, they’ve built new UIs specifically to target attribution in a post-IDFA world.
We’re suggesting to everyone who wants to better understand those UIs to take the guides offered, connect your CSN and really learn how to best utilize them. Learning and knowing your way through these UIs is the best preparation you can do because, trust us, there’s a lot to learn. The key to best tracking your data and knowing what you’re seeing is really understanding these SKN UIs.
Moreover, the MMPs are also offering data enrichment that should provide some level of attribution. To what extent is still unclear. Besides that, publishers with many apps could leverage IDFV and there are already talks in the industry regarding the next big identifier (email and credit cards are two big ones which Apple is already adopting with its sign-in with Apple/ Apple Pay products).
Deep linking is made possible through MMPs, and this will still remain possible in the new post-IDFA era. However, it may be the case that you won’t get everything that you want from deep links.
Beyond these efforts you can also prepare on your own end if you’re willing to put in the work and get creative. The following are a few different solutions and workarounds you may want to consider depending on your team size, budget, and more.
How to Choose the Events for the SKAdNetwork?
Truthfully, this is a major decision for most companies. On most of the platforms, especially Facebook, when you want to run on SKAd you can see the SKAd for Apple’s SKAdNetwork or through an MMP SKAd dashboard only. In both cases, you need to rank the events from one to six. There’s usually six events that have to happen within a seven day attribution window. If there’s an event that occurs in day fifteen, you won’t see the data here anyway.
If you have five or six events, the structure often goes as follows. This example is in regards to an e-commerce app.
- Registration
- Registration complete
- Add item to cart
- Add credit card details
- Complete purchase
If a user adds an item to their cart and the app is saving the data of this card for ten days, and after ten days they complete the purchase, the app won’t see the purchase because it needs to happen within the seven day attribution window.
If you know from an analysis in your internal BI system before iOS 14.5 was launched that most of your users are converting after seven days, then it’s not relevant to put that particular event on the SKAdNetwork mapping. It would be useless because you won’t get this data anyway. It’s important to know this and think very carefully about which events to track.
Be wise about what you decide to track because each event after the install comes with a twenty four hour delay. If you add registration, then you’ll start to see the event from forty eight hours. And so on. If you’re tracking six events, but know the additional two events are not so important, then it’s better not to track them at all through the SKAdNetwork. They can be tracked if the user opts in twice on the regular UI and dashboard through the raw data and user level data, but not through SKAd because of the delay – the data will come a month too late. For example, for an e-commerce client of ours, we have events that we track just to see all of the data, but we only put two main events on the SKAd because we know we want them to get the data for these two as quickly as possible. The other “nice to have” events delaye the data from coming in and make the analysis for the UA campaign a lot harder.
If a company has fifteen events on the SDK, it’s not a good strategy because firstly, you can only track six, and secondly you need to do the analysis on the attribution window and if it’s occurring twenty days later it’s no longer relevant. You need to focus on the main KPIs and really know what to put on the SKAdNetwork mapping. If you track six events, you will get the data much later and make your life harder. In the back end, they combine the events into all possible combinations within the in-app events, so there’s a number from 0-64. This is the result of combining all of the relevant possibilities from all six events listed. Only after that do they return the data. The less events you put there, the earlier your results will be ready.
What Is Your Data Modeling Structure?
In the past few years, whether big company, agency or small start-up, almost every publisher with an internal Business Intelligence system that tracks in-app events used identifiers like IDFA. Unfortunately, we’ve now known for quite a while that automatic IDFA won’t be available anymore. So, at Moburst we’ve made big changes to our internal Business Intelligence system Datarama. What exactly have we done? Well, we’ve changed the structure and implementation of the dashboard and reports that were built on the IDFA unique identifiers.
You may be wondering how exactly we’ve done this. Essentially, in every case we can (it isn’t possible for every client) we take unique identifiers from other places and avoid using IDFA. These aforementioned ‘other places’ come, for example, from each MMPs own unique identifiers – of which there are many. MMPs combine a lot of identifiers together, not just IDFA. Wherever we can we’ve switched to the MMP IDs to ensure our processes make sense moving forward, and to avoid continued reliance on the IDFA while access to it is limited.
If you have a Business Intelligence team and the resources to support it, this could be the option for you. The first step is to assess how you are currently measuring user data. Say goodbye to the days of relying solely on IDFA data. Are your data gatherers working off of raw data or aggregated reports? If the answer is raw data then switching to aggregated reports that rely on multiple identifiers could provide a good hedge.
AppsFlyer’s Aggregated Attribution Solution
Be aware that while this may sound simple, changing the way you model your data is quite an involved process, even for the most experienced of PPC Managers. Yes it can definitely be effective, but we’re talking about a pretty big fundamental shift in your BI’s modus operandi, and the time, manpower, and financial costs to implement such a change can add up in a hurry.
How Are You Pulling Your Data?
If you don’t have the resources to change your BI operations (or don’t have a dedicated BI team at all) then looking into your MMP and its capabilities must be high on your priority list. It’s important to remember that not all MMPs are created equal. Some were devised mobile-first while others trace their origins back to web attribution. Do you know the backstory behind the one you’re using?
If your MMP is on top of its game then it’s probably been hard at work over the last year working on its solution. Nearly all MMPs now offer a new UI specifically catered to the SKNs to help with this new privacy shift. Without naming names there are definitely two MMPs we know of, albeit in the more expensive price tier, that have already made great strides in this area since the IDFA news broke back in June. Unfortunately, others of the slightly less expensive variety (who typically don’t trace their roots back to mobile attribution) are somewhat behind the curve with getting their solutions to a top standard.
While they may be excellent products in their own rights, you truly do “get what you pay for”, and with a development as disruptive as the required IDFA opt-in, the end may justify the means when it comes to spending a little bit more. However, and this is important, don’t jump without looking first – as we mentioned above every MMP is its own creature, so don’t assume you can or can’t get what you need from yours based solely on its size or price tag.
Rethinking User Acquisition
If you’re a small agency or publisher without a high level of technical experience, the first two suggestions probably aren’t the right fit for you. However, even if you don’t have a BI team or aren’t using an MMP, there are still some tactics available to you if you’re willing to put in the work.
Think Outside the Box
Firstly, getting users to opt-in to allow you access to their IDFA is one way to go. While that intrusive consent pop-up that users are presented with is the same for everyone in the mandatory prompt, the messaging inside the optional prompt is customizable.
With marketers free to get creative with words, you’ve still got one last shot (albeit a long one) to stand out, show a little brand personality, and entice users to opt-in. You can give them some context to the mandatory prompt to make it seem less scary.
Even if you successfully convert just a small percentage of users into IDFA consenters, you’re still ahead of the game and will set yourself up to target them with their own unique campaigns featuring different messaging. It isn’t exactly a retargeting campaign, but rather a separate step in your user acquisition. Obviously you’ll be targeting a far smaller audience, but it will be one that’s composed of quality over quantity. And, more importantly, it will be an audience that’s trackable and attributable.
Higher Learning
In addition to giving your Creative team a new assignment with your opt-in messaging, you’re also going to need to put your UA manager to work on getting more statistically oriented when it comes to upper-funnel analysis. Up until now for performance marketers, the focus has been all about down funnel and mapping in-app events. However, with the IDFA no longer a given, conducting deeper analysis on metrics like impressions, CTR, CVR, and clicks are more important than ever before.
Should You Accept the ATT Prompt?
Nobody can tell you what you should and shouldn’t do when it comes to your own data. However, we can shed some light on why somebody might choose to accept the ATT prompt. It’s not really as scary as you may believe.
If you’re downloading an app anywhere, you’re accepting the terms and conditions that come with it. These usually pertain to location and recording, even though the device and app are not activated. Most people accept these terms and conditions which means the apps can record certain things, or send you push notifications when the app is not activated, and various other actions. This is the standard in the industry for around 90% of apps. The new prompt is only asking permission to track your movement across other apps, which is just one identifier. If accepted, this allows the app to adjust the data you’re seeing and avoid showing you spam commercials. It will start showing you ads based on things you’ve previously interacted with or displayed interest in so that everything you’re displayed with is relevant to you. Nobody wants to see random ads for a toilet for example, right? The whole process is technical.
All of the content we consume everywhere, whether that’s a TV commercial or on a social media Explore page, is adjusted and targeted to the individual. If you’d rather keep it this way and ensure that all ads are customized to you rather than random, then accepting the IDFA prompt could be for you.
Has the Impact Been as Drastic as the Industry Expected?
The simple answer is no. Although the industry was sent into a bit of a frenzy and it felt like certain elements were in jeopardy, the actual numbers of people opting out from IDFA have been a lot less drastic than expected. The initial predictions forecast a 10-15% opt-in rate, when in reality the figures are far closer to a 40-50% average opt-in rate in most verticals.
A good way of thinking about it is by relating it to cookies. Everyone accepts cookies these days automatically. Most people don’t even think about it. This could end up going down the same route. Because we’re already seeing a much higher opt-in rate than anticipated, the experts are predicting that in around a year’s time most users will opt in.
Another reason why the numbers are likely to continue increasing is because of the options developers have to encourage users to opt in. Most apps with bad opt-in rates currently will possibly end up limiting the features of the app until users accept the prompt to encourage them. The user will likely want to opt in that way. If it’s a matter of just a question, they’ll say no. However, if it’s a matter of being able to use certain app features, then they’ll say yes. Assuming things will head in that direction, the experts are predicting that’s another reason why the stats will get even better like it did with cookies.
MMPs like AppsFlyer have already made a special place on their UI to show you the industry standard for your app’s vertical. They’re not showing you your competitors’ apps, but they are showing you the statistics in your vertical, whether that’s gaming or fitness or online dating. You can then see the average percentage of users who opt in and opt out from your particular industry. This is a great feature.
What Now?
Advertising Solutions
Currently, Google is still working on a solution, as is TikTok. Facebook is the only advertiser that has prepared a standalone solution, it exists within the Facebook Ads platform. Even Facebook’s solution shows that the data is not something that can be fully relied on yet. Every mobile advertising network, e.g. Twitter Ads, has detailed information online regarding how they’ve dealt with the situation.
Future Campaign Budget Allocations
The ATT prompt, user level data issues and the SKAdNetwork are not applied to Apple Search Ads. Combined with the less than reliable data mentioned above, companies will eventually be less inclined to run iOS 14 and above campaigns on those networks, and shift the budget to ASA’s new network. They’ll also likely allocate bigger budgets to different types of influencers and similar activities, and launch new features.
In not applying the same rules to Apple Search Ads, it’s made abundantly clear that Apple’s main motivation is not to protect users like it claims. If that was truly the case, the same rules would apply to ASA as they do to everything else. It’s as though Apple is shouting “we own you iOS users”. If you want to do campaigns for iOS 14.5 and above, you have to do as Apple asks or only track a significantly smaller percentage of your users with a delay of around three days.
Public Responses
Google and Facebook, though initially publicly displeased, are now trying not to fight back. They’ve realised it’s futile because otherwise they would be rendered useless. Facebook has done a full 360 and is now saying the changes are positive and trying to collaborate with Apple. It’s an interesting trend to observe.
Performance Orientation
Although a lot more budget will be targeted towards ASA, the industry will not collapse and a lot of publishers will still publish for iOS. They’ll simply adjust their approach to make it much more performance and user acquisition oriented and less technical for analysis. Essentially, iOS campaigns will start to look more like Google UAC campaigns as we currently know them. Most companies are already spending a lot on Google UAC campaigns despite the fact there is barely a fraction of the data that Facebook offers. It still generates significant revenue for businesses. Why would iOS be any different?
Why Did Companies Not See the Chaos Coming?
Most companies, even some of the largest corporations out there, didn’t expect the change or see it as big a deal as it is. There seems to be a logical explanation for this surrounding the internal infrastructure of many companies. Generally, the Marketing and Development departments are separate. This is a problem here because the API changes on iOS 14.5, including the ATT Framework and the prompt, are a combination of both marketing and development work. You need to understand marketing in a very smart way, technically and related to code, to appreciate the true significance of such a drastic change.
Luckily, at Moburst we have experts who understand both, with roles designed to oversee both. A number of our data analysts have a history in marketing, which helps with their roles as a data analyst within a marketing agency.
A very talented iOS Developer could read about the change and think they’ve created apps that require far more complicated dev work than this change, so it’s not such a big deal and the required code can be created in a couple of weeks maximum. They might not have the insight to know that all of the campaigns need to be adjusted and that certain identifiers rely on this analysis since the developer is not doing the actual analysis.
Key Takeaways
Automatic access to the IDFA may be gone, but not all is lost. It certainly won’t be an easy change, but with the right planning and utilizing the best solutions MMPs have to offer, it doesn’t have to be a catastrophe.
- If you have a data team and the resources to go with it, a restructuring of how you model your data, including switching to aggregated reporting rather than raw data, could reap the dividends that justify the costs of doing it. This is something we prioritized for ourselves, and it’s stood us in good stead to head into the future with the most success for our clients.
- Take a good hard look into everything your MMP has to offer. They all have solutions by now, but not all are created equal, and it’s wise to think about where your MMP began – web or mobile?
- Treat your opt-in messages like ads. Make them as enticing as possible. It would be naive to expect them to move the needle a tremendous amount, but why leave any chips on the table?
- Change up your focus from down funnel to upper-funnel analysis to help identify trends more quickly.
Stay alert. Yes, the changing trends in privacy present a huge challenge for everyone, and it’s not just iOS. Even Google is eventually expected to make its GAID an opt-in identifier as well. That said, keep in mind that Facebook has always relied on the IDFA for a significant percentage of its advertising technologies so it’s offering a solution as well as many of the major MMPs. Implement the Facebook SDK.
It’s a fluid situation that is pretty much guaranteed to change so in addition to doing your legwork make sure to check back with us. We’ll no doubt be keeping our eyes on the situation and sharing updates and insights when we have them.
Related Articles
App Store Optimization (ASO) – The Complete Guide for 2025
9 Best Mobile Marketing Agencies for 2025 & Beyond
