App Tracking Transparency (ATT)

App Tracking Transparency (ATT) is Apple’s framework that requires apps on iPhone and iPad to ask for, and get, the user’s permission before tracking them across other companies’ apps and websites or reading the IDFA advertising identifier. ATT took effect with iOS 14.5, released on April 26, 2021.

What is ATT?

Everything hinges on how Apple defines “tracking”: linking user or device data collected in your app with data from other companies’ apps, websites or offline sources, for targeted advertising or ad measurement. Sharing data with data brokers also counts as tracking (Apple Developer, User Privacy and Data Use, accessed October 2026).

Apple gives two examples:

• Sending email addresses or advertising IDs to an ad network so it can retarget ads or find people who look like your customers.
• Including a third-party SDK that combines your app’s data with data from other apps to target or measure ads, even if you never use that feature.

Data that is linked only on the device and never sent off it in an identifiable form, or data shared purely for fraud prevention, does not need ATT.

How does the ATT prompt work?

The app declares its explanation text in the NSUserTrackingUsageDescription key (without this key, the app crashes) and then calls the API to show the prompt. The system will not show the prompt at all if the user has switched off Allow Apps to Request to Track in Settings (Apple Developer, requestTrackingAuthorization, accessed October 2026).

Starting with iOS 27.2 and iPadOS 27.2 (announced by Apple in September 2026 and still at the release candidate stage as of October 20, 2026), the EU gets its own rules. Apps may ask users again one year after their last answer, even if they said no. In France, Germany, Italy, Poland and Romania, the prompt appears as a full page (Apple Developer, User Privacy and Data Use, October 2026).

Three rules are worth remembering. You may explain before you ask, but the explanation has to be honest. You may not offer rewards or lock features in exchange for a yes (guideline 5.1.2(i)). And you may not use device fingerprinting as a substitute for the IDFA.

How has ATT changed ad campaigns?

If a user declines, the IDFA comes back as all zeros, and the MMP (mobile measurement partner) can no longer match clicks to installs at the individual level. Advertisers moved to SKAdNetwork and AdAttributionKit, two Apple APIs that return aggregated results and do not require ATT. Meta labels iOS app install campaign results measured through SKAdNetwork separately, as “From Apple’s SKAdNetwork” (Meta Business Help Center, About attribution models and attribution settings, accessed October 2026).

On March 31, 2025, France’s competition authority fined Apple 150 million euros over how it ran ATT between April 2021 and July 2023. The authority had no objection to the principle behind ATT. Its problem was that users had to consent twice (once for ATT and once for the app’s own consent prompt) while a single refusal was enough, and that Apple’s own apps did not have to ask until iOS 15 (Autorité de la concurrence, March 2025).

Example

Hypothetical: an English-learning app shows the ATT prompt the moment it is first opened, before the user knows what the app does. The product team tests moving the prompt to after the first lesson, adding a screen that explains the data is used to measure which ads brought users in. They then compare opt-in rates for the two versions in their MMP. Handing out free lesson coins in exchange for a yes is not allowed.

How does ATT compare with privacy on Android?

Frequently asked questions

Does ATT apply in Vietnam?

Yes. The permission requirement covers every device running iOS, iPadOS or tvOS 14.5 or later, in any country.

Does an app that does not run ads need to show the ATT prompt?

Only if it tracks users under the definition above or reads the IDFA.

See how Adtek sets up measurement for iOS app install campaigns on our App User Acquisition page.