The short answer: Apple's App Tracking Transparency (ATT), rolled out with iOS 14.5 in April 2021, is the privacy change that most dramatically destroyed retargeting accuracy. ATT forced every app to ask users for explicit permission before tracking them across other apps and websites. Most users said no. That single shift turned Apple's Identifier for Advertisers (IDFA) from an opt-out default into an opt-in exception, and in doing so, it broke the cross-app behavioral data pipeline that retargeting depended on.
The damage wasn't limited to Apple's ecosystem. It triggered a chain reaction across the entire digital advertising industry — reshaping how Meta, Google, and thousands of smaller ad platforms collect data, build audiences, and measure results. This article explains exactly what changed, why retargeting accuracy collapsed, what the industry tried to do about it, and what still works today.
What Exactly Was the Privacy Change?
Before iOS 14.5, Apple assigned every iPhone and iPad a unique identifier called the Identifier for Advertisers (IDFA). Apps could read this ID by default. Users who wanted to opt out had to dig into their device settings and enable "Limit Ad Tracking." Very few people did.
ATT flipped that model. After the update, any app that wanted to access the IDFA had to display a system-level prompt: "Allow [App] to track your activity across other companies' apps and websites?" Users could tap "Ask App Not to Track" or "Allow." If they chose not to track, the app received a string of zeros instead of the IDFA — effectively making that user invisible to cross-app tracking.
Apple framed this as a user privacy feature. For advertisers, it was a structural earthquake.
Why the Default Mattered So Much
The critical detail is the default setting. Before ATT, tracking was on unless a user actively turned it off. After ATT, tracking was off unless a user actively turned it on. Behavioral economics tells us most people stick with defaults. Studies and industry reports consistently showed that the majority of iOS users — often cited between 75% and 85% globally — chose "Ask App Not to Track."
That meant the pool of trackable iOS users shrank from nearly everyone to a small fraction. Retargeting audiences built on IDFA data collapsed overnight.
How Retargeting Worked Before the Change
To understand what was lost, it helps to recall how retargeting functioned in the pre-ATT world.
Retargeting relied on a simple but powerful chain:
- User action: Someone visits an online store, views a product, adds it to a cart, or downloads an app.
- Tracking event: A pixel or SDK fires and records that action against a unique identifier — often the IDFA on mobile or a cookie on desktop.
- Audience building: The advertiser groups users by behavior (e.g., "viewed product X but didn't purchase").
- Ad delivery: When those users open another app or browse another site, the ad platform recognizes their identifier and serves a relevant ad.
- Attribution: If the user converts, the platform ties the conversion back to the original ad impression or click.
Every link in that chain depended on persistent, cross-context identifiers. ATT severed the mobile link entirely for users who opted out.
The Mechanics: Why Retargeting Accuracy Collapsed
When a user opts out of tracking, the app doesn't just lose the IDFA. It loses the ability to:
- Recognize that the same user who browsed a product in one app is now opening a different app.
- Build cross-app behavioral segments.
- Attribute a conversion in one app to an ad click in another.
- Measure frequency and recency of ad exposure across apps.
- Optimize campaigns toward users most likely to convert based on past behavior.
Retargeting didn't disappear — but it became aggregated, delayed, and imprecise. Platforms could still report on groups of users through Apple's SKAdNetwork framework, but SKAdNetwork was designed for privacy. It provides:
- No user-level data.
- Delayed postbacks (often 24–48 hours).
- Limited conversion windows (originally 7 days, later expanded).
- Threshold-based reporting that hides small audiences.
In practice, this meant an advertiser could no longer reliably say, "Show this ad to the 5,000 users who abandoned their cart last week." They could only approximate that audience through modeled behavior — and the model was working with far less data.
The Impact by the Numbers
Meta (then Facebook) was the most vocal about the damage. In its Q3 2021 earnings call and subsequent filings, Meta estimated that ATT would cost the company roughly $10 billion in revenue for 2022. Other platforms reported similar, if less publicized, hits.
The table below summarizes the key differences between the pre-ATT and post-ATT retargeting environment.
| Aspect | Before ATT (Pre-iOS 14.5) | After ATT (Post-iOS 14.5) |
|---|---|---|
| IDFA access | Default on (opt-out) | Default off (opt-in) |
| Cross-app tracking | Automatic | Requires user permission |
| Retargeting audience size | Broad; nearly all users | Significantly reduced; only opted-in users |
| Attribution window | 28-day click, 7-day view | 7-day click (SKAdNetwork), limited view-through |
| Data granularity | User-level | Aggregated, thresholded |
| Reporting delay | Near real-time | 24–48 hours (or more) |
| Retargeting precision | High | Low to moderate |
The numbers told a clear story: fewer trackable users, less precise data, longer delays, and weaker attribution. Retargeting accuracy didn't just decline — it was structurally dismantled for the majority of mobile users.
Beyond Apple: The Broader Privacy Shift
ATT was the most abrupt change, but it wasn't the only one. It accelerated a broader privacy movement that had been building for years:
- Safari's Intelligent Tracking Prevention (ITP): Starting in 2017, Apple's browser began blocking third-party cookies and limiting cross-site tracking. This eroded desktop retargeting long before ATT.
- Firefox Enhanced Tracking Protection: Mozilla enabled cookie blocking by default in 2019, further shrinking trackable audiences.
- GDPR and CCPA: European and California privacy laws required explicit consent for data collection, reducing the pool of users available for behavioral targeting.
- Google's Privacy Sandbox: Google announced plans to phase out third-party cookies in Chrome and replace them with privacy-preserving APIs. The timeline has shifted multiple times, but the direction is clear.
Together, these changes created a landscape where cross-context tracking is the exception, not the rule. Retargeting had to adapt or die.
What Advertisers Tried to Do About It
The industry didn't sit still. Platforms and advertisers developed several workarounds, each with trade-offs.
1. Probabilistic Modeling and Aggregated Data
Instead of relying on user-level identifiers, platforms began using statistical models to infer who might be interested in a product. Meta's Aggregated Event Measurement (AEM) and Google's modeled conversions are examples. These systems use aggregated data to estimate conversion likelihood — but they're approximations, not precise retargeting.
2. First-Party Data and Server-Side Tracking
Advertisers shifted toward collecting their own data through logins, email sign-ups, and loyalty programs. Server-side tracking (e.g., Meta's Conversions API) sends events directly from the advertiser's server to the ad platform, bypassing some browser and device restrictions. This improves measurement but doesn't restore cross-app retargeting for opted-out users.
3. Contextual Targeting
Instead of targeting users based on past behavior, advertisers target based on the content they're currently viewing. Contextual advertising doesn't require personal identifiers, so it's immune to ATT. But it's less precise for bottom-of-funnel retargeting.
4. SKAdNetwork and AdAttributionKit
Apple provided SKAdNetwork as a privacy-preserving attribution framework. It allows advertisers to measure installs and some post-install events without user-level data. Apple later introduced AdAttributionKit as an evolution. These frameworks are useful for measurement but not for building retargeting audiences.
5. On-Device Processing
Some platforms moved targeting logic onto the device itself, so personal data never leaves the phone. Apple's own ad platform uses this approach. It preserves some personalization while satisfying privacy requirements, but it's limited to Apple's ecosystem and not available to most third-party advertisers.
Why the Replacements Fall Short
None of these solutions fully restored what was lost. Here's why:
- Modeled data is probabilistic: It can be directionally useful but lacks the certainty of deterministic user-level tracking.
- First-party data is limited: Not every business has a login wall or loyalty program. And even those that do only track users within their own properties, not across the wider app ecosystem.
- Contextual targeting is top-of-funnel: It works for awareness and consideration, but it's weaker for "bring back the user who abandoned their cart" scenarios.
- SKAdNetwork is privacy-first: Its limitations are intentional. It was designed to prevent the kind of granular tracking that made retargeting accurate in the first place.
- On-device processing is siloed: It works within one platform's ecosystem, not across the open internet.
The result is a retargeting landscape that is less precise, less scalable, and less measurable than it was before ATT.
What Still Works for Retargeting Today
Retargeting isn't dead. It's just different. Here's what still works — and what doesn't.
What Still Works
- Email and CRM-based retargeting: If you have a user's email, you can retarget them through email, SMS, or custom audiences on platforms that support hashed email matching.
- First-party website retargeting: On your own website, you can still track user behavior (with consent) and retarget through display ads or onsite personalization.
- Contextual retargeting: Serving ads on pages related to the product category the user previously engaged with.
- Platform-specific retargeting: Within a single walled garden (e.g., Amazon, YouTube), you can retarget users based on their behavior on that platform.
- Consented IDFA retargeting: For the minority of users who opt in, precise retargeting is still possible.
What No Longer Works (or Works Much Worse)
- Cross-app behavioral retargeting at scale: The majority of iOS users are invisible to this.
- Long attribution windows: Most platforms now default to 7-day click or less.
- Real-time optimization: Delayed postbacks make it impossible to optimize in real time.
- Small audience segments: SKAdNetwork's thresholding hides small conversion events, making niche retargeting difficult to measure.
The Future of Retargeting
The trajectory is clear: privacy will continue to constrain cross-context tracking. Google's Privacy Sandbox, Apple's ongoing privacy features, and regulatory pressure from governments worldwide all point in the same direction.
For advertisers, the practical implications are:
- Invest in first-party data. Build direct relationships with customers through logins, newsletters, and loyalty programs.
- Diversify channels. Don't rely solely on one platform's retargeting. Combine email, SMS, onsite personalization, and contextual advertising.
- Embrace modeling and experimentation. Use aggregated data and incrementality testing to guide decisions when user-level data is unavailable.
- Focus on creative and context. When you can't target precisely, the ad itself and the context in which it appears matter more.
- Prepare for a cookie-less future. Even if Google delays third-party cookie deprecation again, the direction is set. Build systems that don't depend on third-party cookies.
Retargeting accuracy as it existed before 2021 is not coming back. The advertisers who succeed will be those who adapt to a world where privacy is the default and precision is earned through trust, not tracking.
Frequently Asked Questions
What is App Tracking Transparency (ATT)?
ATT is an Apple privacy framework introduced in iOS 14.5 that requires apps to ask users for permission before tracking them across other apps and websites. If a user declines, the app cannot access the IDFA.
Did ATT completely kill retargeting?
No. It severely reduced the accuracy and scale of cross-app retargeting on iOS. Retargeting still works through first-party data, email, contextual targeting, and within walled gardens — but it's less precise than before.
What is IDFA?
IDFA stands for Identifier for Advertisers. It's a unique, resettable identifier that Apple assigns to each device. Advertisers used it to track users across apps and deliver targeted ads. ATT made IDFA access opt-in.
What is SKAdNetwork?
SKAdNetwork is Apple's privacy-preserving attribution framework. It allows advertisers to measure app installs and some post-install events without accessing user-level data. It provides aggregated, delayed reporting.
How did Meta respond to ATT?
Meta estimated a $10 billion revenue impact for 2022. It introduced Aggregated Event Measurement (AEM), shifted toward modeled conversions, and encouraged advertisers to adopt the Conversions API for server-side tracking.
Will Google phase out third-party cookies?
Google has announced plans to deprecate third-party cookies in Chrome and replace them with Privacy Sandbox APIs. The timeline has been delayed multiple times, but the long-term direction is toward fewer third-party cookies.
What should advertisers do now?
Focus on first-party data collection, diversify beyond any single platform, use server-side tracking where possible, test incrementality, and prepare for a future where cross-context tracking is limited.
The Bottom Line
Apple's App Tracking Transparency was the privacy change that destroyed retargeting accuracy — not by banning retargeting outright, but by making the data that powered it opt-in. Most users opted out. The result was a fundamental shift in how advertisers can find, target, and measure audiences.
The industry is still adjusting. Some replacements work better than others. But the era of effortless, precise, cross-app retargeting is over. The advertisers who thrive will be those who build direct relationships, respect user privacy, and get creative with the data they do have.
If you're navigating this shift, start by auditing your first-party data strategy. That's the foundation everything else builds on.