Global app user acquisition spend hit 78 billion dollars in 2025, up 13 percent, and AppsFlyer is explicit about where the growth came from: “driven entirely by iOS, which surged 35%”.

In the same year, total downloads across the App Store and Google Play rose 0.8 percent, to just under 150 billion, in Sensor Tower’s count.

So the platform with the least user-level identity absorbed all of the spend growth, into an install market that was effectively flat.

Privacy did not shrink mobile UA. It made certainty more expensive and moved budget toward the channels where aggregated signal is good enough to bid on. Teams still waiting for the old signal to come back are competing for a flat pool of installs against buyers who stopped waiting.

The opt-in debate was the wrong argument

Kochava’s 2026 analysis contains the two numbers that end it. Among iOS users who are shown an ATT prompt, 69.7 percent accept. And only 2 percent of iOS installs are prompted in the first place.

AppsFlyer’s data says the same thing from another angle: about 55 percent of app owners have still not deployed the prompt, and 66 percent of devices sit in “not determined”, the status that means the question was never asked.

The identifier is missing mostly because nobody asked for it, not because users refused. Five years of industry argument about an opt-in percentage, and the dominant failure mode was never running the prompt.

Worth knowing before you compare yourself to anything: the opt-in rate is not one number. AppsFlyer measures 40 percent among users who see the prompt and 30 percent across all targetable users. Adjust reported 35 percent on the prompted denominator in Q2 2025. Kochava reports 69.7 percent on its own network. None of them is wrong. They count different denominators, and most teams have never written down which one they use.

What Apple actually documents, since the vendor summaries drift

Apple’s AdAttributionKit documentation sets three conversion windows: days 0 to 2, days 3 to 7, and days 8 to 35. The random delay is 24 to 48 hours on the first postback, and 24 to 144 hours on the second and third.

Crowd anonymity then decides what each postback contains. At Tier 3 you get a hierarchical source identifier of two to four digits, a fine conversion value, a publisher item identifier and, conditionally, a country code. At Tier 1 you get a two digit source identifier and a coarse value. At Tier 0, in Apple’s words, the first postback contains the source identifier with two digits, and “the system doesn’t send a second or third postback”.

Two consequences that should shape campaign structure rather than reporting:

1. The fine-grained conversion value exists only in the first postback, and only at Tier 2 or above. Every second and third postback, at every tier, collapses to two digits of campaign identity plus a coarse value.
2. Thin campaigns push their own postbacks down a tier. Spreading budget across hundreds of small campaigns is a decision to receive less data, and it is usually blamed on SKAdNetwork afterwards.

On Android there is no equivalent coming. Google announced in October 2025 that it is retiring the Privacy Sandbox technologies, and its own feature status page, updated 14 August 2026, lists Attribution Reporting, Topics, Protected Audience, Protected App Signals, On-device Personalization and SDK Runtime as scheduled for phaseout. No replacement API, and no dates.

What scaling looks like when the signal is aggregate

1. Fix the prompt before touching the bid. AppsFlyer measures 45 percent opt-in when the ATT prompt fires after SDK initialisation against 36 percent when it fires before. A 9 point swing from placement alone is larger than most bidding gains, and it costs one sprint.
2. Design the conversion value schema around Apple’s tiers, not around your funnel diagram. Put the revenue-predictive signal inside the day 0 to 2 window, and consolidate campaigns so a two digit source identifier still carries meaning on its own.
3. Move budget decisions to holdouts and keep postbacks for in-flight optimisation. 52 percent of US brand and agency marketers already run incrementality testing, in EMARKETER and TransUnion’s survey, and 46.9 percent plan to increase media mix modelling investment.
4. Instrument consent as a revenue variable, not a legal one. Usercentrics, a consent platform and therefore an interested party, measures 167 percent higher eCPM on ads served without data restrictions and 136 percent higher match rates. Treat the direction as real and the magnitude as vendor-measured.
5. Report opt-in three ways in your own dashboard: prompted, total installs, and actual identifier collection. Until the denominator is written down, every benchmark comparison your team makes is noise.

The limitations

What you lose is per-user causality inside a 35 day window, and no amount of modelling brings it back.

The third postback arrives up to 144 hours after a window that closes on day 35, and it carries a two digit campaign identifier and one of three coarse values. There is no user in that record. So any decision that depends on knowing which placement produced a specific high-value cohort at day 60 is not available at the postback layer, and aggregated modelling reconstructs the average rather than the tail.

That hurts most where the economics live in the tail and volumes are thin: high-LTV subscription and iGaming titles, small-country campaigns, and any publisher whose crowd size keeps it at Tier 0 or Tier 1, where a single two digit postback is the entire report. Privacy-first UA works well for scaled, mid-frequency, mid-value acquisition. It works poorly for low-volume, long-payback, high-variance acquisition, and the honest answer there is geo holdouts and media mix modelling, not a better dashboard.

One more caution. The most repeated number in this category, “about 25 percent of users opt in”, has no reachable primary source in 2026. Every current measurement is materially higher on the prompted denominator. If a plan is built on 25 percent, it is built on folklore.

Why the commercial model matters more than the measurement stack

Every model above tries to answer one question: what did this spend actually cause. Most media contracts never require an answer, because the invoice settles on impressions delivered, and impressions are the one thing privacy changes did not touch.

For example, at SpinX the model is CPA with MMP-verified attribution, on owned and operated supply plus direct publisher relationships. That does not restore user-level signal and it would be dishonest to say it does. What it changes is where the uncertainty sits. If an action is not recorded by the advertiser’s own measurement partner, it is not billable, so the cost of signal loss lands on us rather than on the budget.

If your iOS spend is growing while your confidence in it is not, testing that on pay-per-result inventory is the cheapest way to find out what is real, at spinx.io.