ATT, SKAN and the Privacy Sandbox: Why Your Dashboards Changed and What Works Now
The 60-second version
Apple removed the identifier and Google is following. What ATT, SKAN and the Sandbox did to measurement, why dashboards look worse, and the stack that works on top.
- What happened, in one line
- What to do about it this week
- What you can safely ignore
In April 2021, Apple asked iPhone users a question almost everyone answered the same way: "Allow this app to track you?" The large majority said no. With that single prompt, the deterministic identity graph mobile advertising had relied on for a decade — click today, observe purchase tomorrow, report exactly — broke for most iOS traffic. Google's Privacy Sandbox then began the same transition for the web.
If your dashboards ever "got worse" around those years — delayed numbers, lumpier reporting, thresholds where small campaigns show nothing — nothing broke. The measurement substrate changed underneath you. This post explains what ATT, SKAN and the Sandbox actually did, what changed in your dashboards as a result, and the measurement stack that works on top of them.
The short version: from census to exit poll
What Changed in One Picture
Data JourneyBefore: census
Device ID (IDFA) linked ad view to install to purchase for nearly every iOS user. Platforms reported exact, row-level, next-day conversions.
ATT prompt
Users opt out of tracking en masse. The IDFA becomes zeros for non-consented users and deterministic matching collapses.
After: exit poll
Apple and Google return sparse, delayed, aggregated signals. Platforms fill the rest with statistical estimation.
The vocabulary you need: ATT (App Tracking Transparency) is the permission prompt. SKAN — SKAdNetwork, now evolving into Apple's AdAttributionKit — is the replacement signal Apple gives advertisers instead of identity: coarse, delayed, aggregated. The Privacy Sandbox (including the Attribution Reporting API) is Google's equivalent transition for Chrome and Android: no third-party cookies, event-level detail replaced with noisy aggregates. And modeled conversions are the platforms' statistical fill-in for everything these systems no longer show.
One sentence for leadership: we moved from counting every vote to running an exit poll. Exit polls predict elections well — but you would never recount a ballot box with one. Stop expecting row-level reconciliation from systems designed to prevent exactly that.
What each system actually does to your data
ATT: the prompt that removed the ID
ATT requires apps to ask before accessing the device advertising identifier. Opt-out users present an all-zeros IDFA, which means no cross-app identity, no deterministic install matching, no user-level retargeting pools. Note what ATT did not do: it did not stop measurement. It forced measurement through Apple's own privacy-preserving channel — SKAN — where Apple, not the advertiser, decides what is knowable.
SKAN / AdAttributionKit: sparse, delayed, aggregated truth
Instead of a stream of events, advertisers receive postbacks: one per install, delayed 24–72+ hours, carrying a coarse conversion value (a 6-bit bucket, not a revenue figure) and campaign ID — with Apple's privacy thresholds suppressing detail entirely for low-volume campaigns. Practical consequences:
- Revenue arrives late and lumpy. Same-day ROAS on iOS app campaigns is structurally incomplete; optimise on 72-hour+ windows.
- Small campaigns go dark. Below Apple's volume thresholds, postbacks carry no usable detail. Consolidate iOS campaigns rather than fragmenting them into dozens of micro-tests.
- Creative-level insight degrades. You learn which campaign drove value buckets, not which impression drove which rupee. Creative testing moves to geo or Android-first designs.
Privacy Sandbox: the web's version of the same deal
Third-party cookie deprecation plus the Attribution Reporting API gives Chrome-side advertisers event-level reports with injected noise and delayed, aggregated summary reports. The web analogue of every SKAN lesson applies: shorter effective lookbacks, no cross-site identity, thresholds that erase small slices. First-party data — your own domain, your own logged-in users, your own click IDs — appreciates in value exactly as third-party signal depreciates.
| Dimension | Pre-2021 norm | Post-ATT / Sandbox norm |
|---|---|---|
| Identity | IDFA / third-party cookie | Hashed first-party identity or nothing |
| Granularity | User × impression level | Campaign/coarse-bucket aggregates |
| Latency | Next-day final | 24–72h+ delays, restatements for days |
| Small slices | Fully visible | Thresholded to nothing |
| Cross-device | Graph-resolved | Modeled or absent |
| Source of truth | Platform dashboard | Your server + MER |
Why your dashboards look "worse" (and which of it is real)
The iOS campaign that 'stopped working' in May 2021
Three dashboard symptoms and their true causes:
- Numbers restate for days. Delayed postbacks and conversion lag stack. Treat any iOS or modeled-heavy number under 3 days old as provisional — report it with the date it will settle, not as final.
- Small geo/creative splits show zero. Privacy thresholds, not performance. Aggregate to the level the system can actually see before concluding anything failed.
- Android and iOS diverge. They are now measured by different instruments. Compare each OS against its own history, and compare the business on blended numbers — never iOS-dashboard vs Android-dashboard head to head.
The measurement stack that works now
Post-Privacy Measurement, In Priority Order
Process FlowFirst-party capture you control
Click IDs on orders, hashed emails at signup, server-side APIs. Signal you own survives every platform change by definition.
Consent Mode and proper consent signals
Correctly configured consent lets Google model with your consented data rather than guessing at its absence. Misconfiguration here is common and expensive.
SKAN / Sandbox signals, read on their own terms
Delayed, aggregated, thresholded — used for directional validation and campaign-level comparison, never row-level reconciliation.
Blended MER as the executive truth
Total revenue over total spend sidesteps every OS, window and threshold dispute. All platform numbers roll up to it, none override it.
Do not rebuild the old world with fingerprinting. Device fingerprinting to reconstruct opted-out identity violates Apple policy and increasingly regional law. The teams still standing in five years are the ones that invested in consented first-party data and aggregated literacy — not the ones that found a cleverer workaround.
Frequently Asked Questions
Should small advertisers just ignore SKAN complexity?
No — but you should interact with it at the right altitude. You do not need postback-decoding infrastructure; you need three habits: evaluate iOS on 7-day not same-day numbers, consolidate campaigns above threshold volumes, and judge the business on MER. That captures most of the value with none of the plumbing.
Does this affect web-only D2C brands or just app advertisers?
Both, on different timelines. ATT hit apps first and hardest; third-party cookie loss and link-decoration stripping degrade web measurement more gradually. If your traffic is overwhelmingly Android web + logged-in users, you felt a slope where app advertisers felt a cliff — but the direction is identical.
Are modeled conversions just made-up numbers?
No — they are estimates with known methodology and unknown error bars, like an exit poll. Treat them as directional signal for optimisation and exclude-or-separate them for financial reporting. The failure mode is not that modeling exists; it is presenting a part-measured, part-inferred number as though it were a bank balance.
Summary & Next Steps
ATT removed the identifier; SKAN and the Sandbox replaced the census with a privacy-preserving poll; dashboards got delayed, aggregated and thresholded as a direct consequence. The response is not a workaround — it is first-party capture, proper consent signals, SKAN-literate reading, and MER as the number the business runs on.
- Use modeled conversions for what they are: directional, never financial.
- Use view-through and window literacy to stop misreading restatements.
- Use MER as the truth that survives every platform's privacy redesign.
MER Calculator
Total revenue divided by total marketing spend — the attribution-agnostic efficiency number, plus its contribution-margin-adjusted variant.
Chinmay Raibagkar
About author →Founder of DataLens AI. He helps non-technical teams read their ad and database numbers with confidence — which number to trust, what to do next, and what to ignore.