App Tracking Permission: What Developers Must Know

Yes, developers now need your permission to track you across apps and websites owned by other companies. This requirement comes primarily from Apple’s App Tracking Transparency (ATT) framework, which has been enforced since iOS 14.5 (April 2021), and from Google’s similar policy for Android apps, which began rolling out in 2021 and became stricter in 2022. When an app wants to access the Identifier for Advertisers (IDFA) or collect data that links you to third-party tracking, it must show a system prompt asking for your explicit consent.

Why This Matters for Developers

Before ATT, apps could read the IDFA (a device identifier) and use it to track your activity across other apps and websites, building a profile for ad targeting. Now, if an app wants to do that, it must first show a system-generated prompt: “Allow [App] to track your activity across other companies’ apps and websites?” The user taps “Ask App Not to Track” or “Allow.” If the user says no, the app cannot access the IDFA, and it must not use other methods to track you (like fingerprinting).

Google’s Android equivalent is less strict but similar in spirit. Android apps that target Android 13+ (API 33) must declare the AD_ID permission in their manifest. If an app targets older Android versions, it can still access the advertising ID, but Google Play requires apps that collect the advertising ID to have a privacy policy and to handle user opt-out. In practice, most major ad SDKs (like Google Mobile Ads) now respect the user’s “opt out of personalization” setting on Android.

How the Permission Prompt Works

On iOS, the prompt is generated by the operating system, not the app. The developer must include a usage description string (NSUserTrackingUsageDescription) in the app’s Info.plist. When the app calls ATTrackingManager.requestTrackingAuthorization(), iOS displays the alert. The developer can customize the message text but cannot change the buttons or the overall layout. If the user selects “Ask App Not to Track,” the app receives a status of .denied and must not attempt to track. If the user has disabled “Allow Apps to Request to Track” in Settings, the status is .restricted and the prompt never appears.

On Android, there is no universal system prompt. Instead, the developer must check the user’s “Opt out of Ads Personalization” setting. If the user has enabled that option, the advertising ID is a string of zeros, and the app must not use it for tracking. The developer can still use the ID for frequency capping, attribution, and security, but not for cross-app profiling.

What Counts as Tracking

Tracking is defined as linking user or device data collected from your app with data collected from other apps, websites, or offline properties for targeted advertising or advertising measurement. Examples that require permission:

• Sending the IDFA to a third-party ad network that uses it to serve targeted ads across apps.
• Sharing a user’s email address with a data broker who combines it with other sources.
• Using a third-party SDK that collects the advertising ID and shares it with other SDKs.

Examples that do not require permission:

• Collecting data only within your own app and using it for your own analytics (e.g., crash reporting).
• Using the IDFA for fraud detection or security purposes.
• Attributing an install to an ad campaign, as long as the attribution provider does not combine the data with other apps.

How to Choose Whether to Ask

Developers face a trade-off. If they ask for permission, they get the IDFA for users who say yes, but they risk a low acceptance rate. If they don’t ask, they lose the ability to track but may still use other methods (like SKAdNetwork on iOS) to measure ad performance without user-level data.

Consider these factors:

• User trust: A prompt can annoy users, especially if the app has no obvious reason to track. Many apps see acceptance rates below 30%.
• Revenue model: If your app is free and relies on personalized ads, tracking may be essential. If you use contextual ads or subscriptions, you may not need it.
• Alternative solutions: On iOS, SKAdNetwork provides install attribution without IDFA. On Android, Google’s Privacy Sandbox (in beta) aims to offer similar functionality.

Many developers choose to show the prompt only when the user has completed a meaningful action (like finishing onboarding) to increase the chance of acceptance, but that is a product decision, not a technical one.

Common Problems and Misconceptions

A frequent misconception is that ATT blocks all tracking. It does not – it only blocks tracking that uses the IDFA or similar identifiers. Apps can still collect data within themselves and use it for their own purposes. Another misconception is that Android has no tracking restrictions. Android does have restrictions, but they are less visible to users.

Common technical issues developers face:

• Missing usage description: If you don’t provide NSUserTrackingUsageDescription, the app crashes when you call requestTrackingAuthorization.
• Testing on iOS: On iOS 14.5+, the prompt only appears once per install. To test again, you must reinstall the app or reset the advertising identifier.
• Delayed prompt: Some developers call requestTrackingAuthorization at launch, but Apple recommends waiting until you actually need to track. The prompt can be shown at any time, but you should not show it before the app has loaded.
• User denial: If the user denies, you cannot prompt again. You can only respect the decision. There is no “ask later” option.

Comparison: Apple vs. Google

Apple’s ATT is a hard prompt: the user sees a system dialog and must choose. Google’s approach is softer: the user sets a global preference in Android settings, and the app must check that setting. In practice, both lead to the same outcome: if the user opts out, the app cannot use the advertising ID for tracking.

One key difference is that Apple’s prompt is per-app, while Google’s is per-device. On iOS, a user can allow tracking in one app and deny it in another. On Android, the “Opt out of Ads Personalization” setting applies to all apps. Also, Apple’s prompt appears when the app requests it; Google’s setting is not prompted at all – the user must find it in Settings > Privacy > Ads.

Costs and Alternatives

For developers, the main cost is lost ad revenue. Without IDFA, personalized ads are less effective, so eCPMs (effective cost per mille) may drop. Many developers have seen a 20-30% decrease in ad revenue after ATT. However, there are alternatives:

• Contextual advertising: Show ads based on the content of the app or website, not the user’s history.
• SKAdNetwork: Apple’s privacy-preserving attribution API for installs and conversions.
• Google’s Privacy Sandbox: A set of APIs for Android that aim to replace the advertising ID with more private methods.
• First-party data: Encourage users to log in and use their own data for personalization, with consent.

Frequently Asked Questions

Do I have to ask permission if I only use analytics?

No, if you only collect data for your own analytics and do not share it with third parties for tracking, you do not need to show the ATT prompt. However, if you use a third-party analytics SDK that collects the IDFA and shares it with other companies, that counts as tracking.

What happens if the user taps “Ask App Not to Track”?

The app cannot access the IDFA, and it must not use other methods to track the user. You can still use SKAdNetwork for attribution, but you cannot link the user’s activity across other apps.

Can I show the prompt again if the user denies?

No, on iOS the user’s choice is permanent for that app installation. You cannot re-prompt. On Android, there is no prompt – you must respect the global setting.

Does this apply to web browsers?

No, ATT applies to native iOS apps. For websites, tracking is governed by cookies and browser settings (like Intelligent Tracking Prevention). Android’s restrictions also apply to apps, not browsers.

How do I test the ATT prompt in development?

On iOS, you can reset the advertising identifier in Settings > Privacy > Advertising, or reinstall the app. On Android, you can change the “Opt out of Ads Personalization” setting and check if the advertising ID becomes zeros.

Is there a way to track without asking?

You can use server-to-server attribution (like SKAdNetwork) that does not require user-level tracking. You can also use your own first-party data with user consent, but you cannot link data across other companies’ apps without permission.

Related

• Compare Supermicro AI Servers vs Dell, HPE, Lenovo
• Alternate DNS Misleading Label? Truth Explained
• Selling Your Quest Headset: Do This First