Apple's iOS 14.5 release (April 2021) introduced the App Tracking Transparency (ATT) framework: any app that wants to use the IDFA (Identifier for Advertisers) across other apps or websites must first show a system prompt asking the user for permission. Meta's iOS app, like every other ad-network SDK, now depends on the user's ATT answer. This guide explains what changed, why your Meta iOS attribution numbers dropped, and what a modern setup looks like.
The mechanism: what ATT actually blocks
Before iOS 14.5, Meta's iOS SDK could read the device's IDFA without asking. That IDFA let Meta match a click inside its own app to an off-app conversion (a purchase on your Shopify store, a lead form fill on your site) with near-perfect fidelity. After iOS 14.5, the SDK must call requestTrackingAuthorization() and the user sees a prompt: "Allow [app] to track your activity across other companies' apps and websites?" Apple's User Privacy and Data Use policy on developer.apple.com enforces the wording and the runtime API. Opt-in rates settled in the 20–40% range across US e-commerce audiences, meaning 60–80% of iOS Meta traffic has no IDFA available.
Attribution windows shrunk
Meta's default attribution window used to be 28-day click / 1-day view. After iOS 14.5, the default became 7-day click / 1-day view, and view-through iOS attribution effectively vanished for opted-out users. Your Meta Ads Manager reporting will show fewer conversions than your Shopify orders dashboard, and the gap is largest on high-consideration products (7+ day sales cycles) where the 28-day window used to catch a converting click a week or two later.
Aggregated Event Measurement (AEM)
Meta's answer for iOS opted-out users is Aggregated Event Measurement, a privacy-preserving reporting layer that aggregates conversions at the domain level (not the user level). AEM caps you at 8 verified events per domain, in a priority order you set inside Events Manager. If you have not verified your domain and prioritized your events, iOS-opted-out conversions are silently dropped from your ad-set reporting. Meta's Aggregated Event Measurement guide on developers.facebook.com documents the verification flow.
Server-side CAPI restores the reliable-conversion path
Because iOS opted-out users still convert (they just can't be tracked via IDFA), the Conversions API path is the recovery: your server posts the conversion directly to Meta with hashed customer PII, and Meta matches on hashed email or phone rather than IDFA. Setup detail is in Meta CAPI setup, step by step. Meta reports 8-percentage-point median cost-per-purchase improvement on iOS-heavy audiences after CAPI is turned on, per its own conversions API case studies on developers.facebook.com.
What PixelProof surfaces
The scanner emits a warning-severity finding when the browser pixel is the only tracking present on an iOS-eligible audience, and an info finding when the CAPI+browser hybrid is detected. Because Meta's own docs and Apple's ATT documentation on developer.apple.com both recommend the hybrid, PixelProof escalates to critical if a Shopify checkout still relies on browser-only tracking on a store that spends more than $10K/month on Meta. Full finding tour is in understanding your PixelProof scan results.
Related articles
FAQ
Does ATT affect Android? No. ATT is iOS-only. Android has its own Privacy Sandbox for Advertising ID initiative on a slower timeline, documented in Google's Privacy Sandbox for Android on developers.google.com reference.
Can I ignore iOS traffic and only optimize for Android? No, iOS users on US e-commerce audiences typically over-index in AOV. The right move is CAPI + AEM, not deprioritizing iOS.
What should my ATT opt-in rate look like? 20–30% is normal for a well-integrated CAPI setup. Rates below 15% are usually caused by rushing the pre-prompt user education screen; Meta's own guidance suggests educating users on value before triggering the system prompt.
Still stuck? Email support@digitalempireholdings.com or support@digitalempireholdings.com.