App Tracking Transparency (ATT)

Definition

App Tracking Transparency is the iOS framework that requires an app to obtain explicit user permission before accessing the device's advertising identifier or otherwise tracking that user across apps and websites owned by other companies.

Introduced with iOS 14.5, ATT is the change that broke identifier-based mobile attribution and created everything that replaced it. The framework itself is small — one Info.plist key, one request call, four possible statuses — but the rules around when the prompt may be shown, what counts as tracking, and what happens on reinstall are where implementations go wrong.

The implementation, in full

Without the Info.plist key the prompt never appears and the request returns denied, which is the most common cause of an ATT implementation that appears to work in code review and yields zero authorisations in production.

<key>NSUserTrackingUsageDescription</key>
<string>Your data is used to measure which ads brought you here,
so we can show you fewer irrelevant ones.</string>

import AppTrackingTransparency
import AdSupport

// Must be called while the app is active. Calling it from
// didFinishLaunching, or behind a launch screen, silently fails:
// the system declines to present and you get .denied.
func requestTracking() async -> Bool {
    let status = await ATTrackingManager.requestTrackingAuthorization()
    return status == .authorized
}

// The current status, without prompting.
switch ATTrackingManager.trackingAuthorizationStatus {
case .notDetermined: break   // prompt has not been answered
case .restricted:    break   // blocked by policy; do not prompt
case .denied:        break   // user said no; you cannot re-prompt
case .authorized:
    let idfa = ASIdentifierManager.shared().advertisingIdentifier
    // ...
@unknown default: break
}

Timing the prompt

Because you get one attempt, when you ask matters more than how you ask. Apple's rules constrain the options: you may show your own explanatory screen first, but it must not resemble the system prompt, must not offer an incentive, and must not present a choice that pre-empts the system dialog.

Reported industry opt-in rates have varied widely and have generally risen since 2021, with commonly cited figures clustering somewhere between a quarter and a half of prompted users depending on category, geography and framing. Treat any single published number with suspicion, measure your own rate by prompt placement, and note that even a good rate leaves the majority of your install base unmeasurable at device level.

What ATT does and does not cover

Tracking, in Apple's definition, means linking your app's data with data collected by other companies for advertising or measurement, or sharing it with a data broker. That definition is narrower than "analytics" and wider than "the IDFA".

The last two rows are where ATT connects to the privacy manifest: domains you declare as tracking domains are blocked by the OS without ATT permission, so an over-broad declaration turns a consent decision into an outage. And fingerprinting is not a consent question at all — Apple's rules disallow it whether or not the user opted in.