Since iOS 14.5, mobile attribution has been a survival struggle. By iOS 17 and mid-2026, we've reached this point: deterministic signals hover at 15-20%, modeled conversions dominate, SKAdNetwork 4 matured but isn't standard, and every platform trusts its own estimates. CMOs still can't answer "how much budget goes to which channel" because the attribution stack is fragmented and contradictory. This post breaks down the post-iOS 17 mobile measurement architecture, the reliability hierarchy of signal sources, and why incrementality testing has become more critical than attribution itself.

Deterministic signals are no longer the majority

When ATT (App Tracking Transparency) launched with iOS 14.5, IDFA opt-in rates crashed to 5-15%. By iOS 17, that band has climbed to 15-20%—but it's still a minority. Deterministic attribution—matching a specific user's ad click to an in-app event—is now sample-level data. You can segment by opt-in cohorts, but you can't extrapolate aggregate performance from them because opt-in users behave differently (they're privacy-conscious and ad-resistant).

For the remaining 80-85%, three signal sources exist: SKAdNetwork (Apple's privacy-preserving framework), probabilistic matching (fingerprinting remnants), and platform modeling (Meta/Google's machine learning estimates). None are deterministic. SKAdNetwork postbacks aggregate events and arrive with 24-144 hour latency, with limited conversion value encoding (0-63, a 6-bit integer). Apple forbids probabilistic matching; caught vendors face App Store removal. What remains is modeling—Meta's Aggregated Event Measurement (AEM), Google's Privacy Sandbox noise injection—but these estimates can't be reconciled cross-platform.

The bottom line: your attribution stack is now probabilistic, not deterministic, and you need to accept that.

SKAdNetwork 4: mature but not standard

SKAdNetwork transitioned to version 4 in 2023. Key improvements: postbacks are now three-stage (0-2 days, 3-7 days, 8-35 days), web-to-app attribution support, and hierarchical source identifiers let you tag ad sources across four levels (campaign / ad group / creative). The conversion value encryption scheme didn't change, but Apple added crowd anonymity thresholds to postbacks—low-traffic campaigns may get no postback at all.

As of mid-2026, adoption is around 60%. Meta and Google support SKAdNetwork 4, but networks like Unity Ads, ironSource, and AppLovin still span versions. This means the same campaign gets measured by different DSPs using different SKAdNetwork versions, creating irreconcilable rows in dashboards.

Another issue: SKAdNetwork postbacks credit only the last-clicked ad (last-click attribution). No view-through or assisted touchpoints. In a multi-channel user journey, the final touch takes all conversion value; earlier contributions vanish.

Conversion value mapping example

Postback 0 (0-2 days):
- conversion_value = 1 → install
- conversion_value = 2 → install + onboarding completed

Postback 1 (3-7 days):
- conversion_value = 10-20 → first 7-day in-app purchase encoded in $10 bands

Postback 2 (8-35 days):
- conversion_value = 30-40 → 35-day LTV estimate encoded in $50 bands

The 6-bit ceiling forces you to encode revenue instead of reporting it directly. Your encoding scheme is custom and varies across campaigns. Result: you need an external mapping layer for apples-to-apples comparison.

Modeled conversions: estimate is now the majority signal

Meta's Aggregated Event Measurement (AEM) and Google's Privacy Sandbox models are now the center of the mobile attribution stack. These models predict the behavior of non-IDFA users via machine learning: a user saw your campaign, installed the app, but no deterministic link exists—the model statistically predicts based on past behavior of cohorts with similar campaign, demographic, and behavioral traits.

Per Meta's 2025 report, 70% of iOS install conversions are modeled. On Google Ads, that's 60-65%. The ROAS number on your dashboard is mostly estimate. How close is this estimate to reality? Meta claims 85-90% accuracy in its own validation tests (compared against incrementality holdout tests). But that's aggregate-level—run a campaign-level incrementality test and you'll see ±30% variance between modeled ROAS and actual lift.

Second problem: modeled conversions are platform-specific. Meta's model doesn't talk to Google's. If the same user is modeled differently on both platforms, cross-platform deduplication is impossible. Without MMM (Marketing Mix Modeling) or geo-holdout tests, you can't tell which platform drove what.

Third problem: model refresh cadence. If Meta updates its model weekly, then stop your campaign, the model's learning lags 7-14 days. This makes "pause and observe" tests harder because the model has inertia.

Incrementality testing is now decision-making, not measurement

In a world where modeled conversions own 70% of the signal, you can't trust dashboard numbers alone. The solution: incrementality testing—controlled experiments that measure the true lift caused by a campaign. The two most common approaches: geo-holdout and audience holdout.

Geo-holdout: You pause your campaign in specific regions and measure the difference in installs or revenue. For example, disable your iOS Meta campaign in 10 states while continuing in 40 others; after 14 days, observe how much the install rate dropped in paused regions. That drop is your campaign's true causal effect. The advantage: no user-level data needed, ATT-independent. The disadvantage: macro differences between control and treatment geos (local holidays, competition density) can skew results.

Audience holdout: Use PSA (Public Service Announcement) campaigns or ghost bidding to exclude a random user group from ads and compare against the rest. Meta offers this as Conversion Lift tests; Google as Brand Lift. Keep holdout to 5-10% and you'll need a minimum 100,000-person sample for statistical power—impossible on small campaigns.

Both methods take 14-28 days, slowing iteration. But post-iOS 17, there's no other way to allocate budget without trusting modeled ROAS. In performance marketing work, we repeat incrementality tests quarterly—not pre-launch, but ongoing—to track model drift.

Privacy Sandbox and web-to-app attribution

iOS 17 tightened Safari's ITP (Intelligent Tracking Prevention) rules. Users directed from a web view to the app store now enter SKAdNetwork 4's web-to-app flow, but the conversion window is 24 hours. If someone sees your campaign on web and installs 48 hours later, that attribution is lost.

Google's Privacy Sandbox Topics API and FLEDGE (First Locally-Executed Decision over Groups Experiment) offer alternatives on web, but they're not yet standard for in-app attribution. There are whispers that Apple will release its own Topics-like API in 2026, but no official announcement.

Critical detail: even when web-to-app chains are cookieless, SKAdNetwork postbacks can't properly credit the campaign because you can't pass the web-side click ID through the app store redirect. Apple is testing a "web attribution token" mechanism in StoreKit 2, but it's not production-ready.

Post-lookback maturity: is 35 days enough?

SKAdNetwork's longest postback window is 35 days. But games, fintech, and subscription apps show true LTV over 90-180 days. By day 35, you're encoding a cohort-level LTV estimate into conversion value—but it misses early churn or late monetization.

Solution: post-attribution modeling layers from MMPs (Mobile Measurement Partners—Adjust, AppsFlyer, Singular). These tools ingest SKAdNetwork postbacks, train a model on their deterministic pool (opt-in users), and estimate 90-day LTV. But that estimate is also a model—if the MMP's training data doesn't match your app behavior, the forecast drifts.

Alternative: cohort analysis done manually. Take your first 35 days of SKAdNetwork data, track the same cohort through day 90 in BI dashboards, then retroactively correct campaign ROAS. It's manual, but it's closest to ground truth post-iOS 17.

What to do now

The post-iOS 17 attribution stack is fragmented, delayed, and model-heavy. If you distrust your dashboard ROAS, you're right. Follow these steps: audit your SKAdNetwork 4 conversion value mapping—ensure your first 7-14 day events are encoded correctly. Pull modeled conversion ratios from your MMP dashboard; if >70%, quarterly incrementality testing is mandatory. When choosing between geo-holdout and audience holdout, let your daily install volume decide—sub-1,000 daily installs won't reach statistical significance with audience holdout. If you have web-to-app flows, respect the 24-hour attribution window; test shifting retargeting to longer-window channels. Finally: don't ignore attribution, but don't let it be your only input. Build a triangle with MMM, cohort LTV analysis, and incrementality tests. Post-iOS 17, the game isn't won with deterministic signals—it's won by matching the right estimate to the right decision.