SKAN 101: Understanding Apple’s Attribution Framework and What Comes Next

When Apple rolled out App Tracking Transparency (ATT) in April 2021, it did more than limit access to the IDFA. It rewired the entire iOS user acquisition playbook. Nearly five years later, SKAdNetwork (SKAN) has matured from an obscure 2018 API into the default privacy-safe attribution standard for iOS advertising. Apple now reports that AdAttributionKit (AAK) and SKAN together cover 77% of all referral-based conversions to the App Store.

And yet, marketers are still split on whether it actually works. In AppsFlyer's 2025 app marketer survey, only about 25% of respondents said SKAN had a noticeably positive impact on iOS UA, while 30% still reported challenges and negative impact, and 32% said it made no difference at all.

That disconnect is why we're writing this SKAN 101. If you're a UA manager trying to understand how we got here, what AdAttributionKit actually changes, and why the industry hasn't rushed to adopt the latest versions, this guide is for you.

What SKAN Actually Is, in Plain English

The Core Mechanics Worth Knowing

Before getting into SKAN, it’s worth covering a few terms that come up repeatedly. Here’s what they mean:

• Conversion value: A small data payload (6 bits in early versions, expanded in SKAN 4) that the advertiser updates after install to encode user behavior or value
• Postback: The signed message Apple sends to ad networks (and optionally advertisers) after an install or action is validated
• Crowd anonymity: Apple's tiered system that determines how much detail appears in a postback based on campaign volume. Low-volume campaigns return less data
• Source identifier: The campaign ID field, which expanded from two digits in SKAN 3 to up to four digits in SKAN 4 at higher privacy tiers
• Postback windows: The time periods over which conversion values can be updated and postbacks returned

What Is SKAN?

With these terms in mind, SKAdNetwork is Apple's privacy-preserving attribution framework for iOS app advertising. Instead of passing user-level identifiers – like IDFA – between publishers, networks, and advertisers, SKAN works like this:

1. A user sees or clicks an ad inside a publisher app.
2. If the user installs the advertised app, Apple cryptographically validates the install.
3. After a random delay, Apple sends an aggregated, signed postback to the ad network, and optionally a copy to the advertiser or their MMP.
4. The advertiser can update a conversion value post-install to signal user quality, but only within Apple's privacy thresholds.
   

The tradeoffs are familiar to anyone who has operated an iOS campaign post-ATT: delayed reporting, aggregated data, crowd-anonymity suppression at low volumes, limited conversion-value real estate, and far less granular campaign visibility than the pre-ATT era. 

Since 2021, every new SKAN version has been Apple's attempt to add signal without breaking those privacy guardrails.

A Timeline of SKAN and the Leap to AdAttributionKit

SKAN 1.0, 2018

Launched quietly with iOS 11.3. It established the basic install-validation postback flow but offered no post-install signal, so practically no marketer used it.

SKAN 2.0, 2020

Released alongside iOS 14 and the ATT framework, SKAN 2.0 is where the industry's measurement reality fundamentally changed. ATT required users to explicitly opt in before an app could access their IDFA. For most apps, opt-in rates landed well below 50%, which meant the deterministic, user-level attribution that had powered iOS UA for years was gone for the majority of traffic. SKAN 2.0 was Apple's answer to that attribution gap.

The framework introduced conversion values, giving advertisers a way to encode post-install behavior into a small data payload. It also added postback parameters like version, source app ID, and redownload flag. On paper, it was a workable privacy-safe alternative. In practice, the mechanics created a set of constraints that upended how UA teams had to think about measurement.

One postback, one winner

Under SKAN 2.0, only one ad network could receive a postback per install, and only if that network "won" the attribution. There was no second-place signal. If your network drove the install but lost the attribution window to another network, you received nothing. For networks used to receiving impression or click confirmation signals on every event, this was a significant operating change. It also introduced real tension in multi-network campaigns, since two networks could both claim credit for the same install with no reconciliation mechanism.

The conversion value timer

The conversion value mechanic worked through a rolling 24-hour timer. After install, the advertiser's SDK could update the conversion value to reflect user behavior, such as completing a tutorial, reaching a revenue threshold, or starting a trial. Each update reset the 24-hour clock. When the timer expired without a new update, it locked the conversion value in place and started Apple's postback delay.

This created a direct tradeoff. The more events you tracked to capture a richer signal, the longer you delayed your postback. An app that updated its conversion value five times over four days would wait until day five before the postback process even began. For UA teams trying to optimize bids quickly, that lag was a real problem. It forced a hard decision: capture more post-install signal and wait longer, or lock in an early signal and get data back sooner.

The random delay

Once the conversion value locked, Apple did not send the postback immediately. It added a random delay of 24 to 48 hours before the postback was delivered. The stated purpose was privacy: making it harder to correlate a specific postback with a specific user based on timing. The operational effect was that even in the best case, a UA manager was looking at a minimum of 24 to 48 hours from install before any signal came back, and often several days when combined with conversion value update windows.

For teams accustomed to real-time or near-real-time reporting, this was a significant adjustment. Bid optimization cycles that previously ran on hourly data now had to account for multi-day attribution lag. Any creative or targeting decision that depended on conversion feedback was effectively operating on delayed, incomplete data.

What SKAN 2.0 actually delivered

SKAN 2.0 gave the industry a functional privacy-safe attribution framework at a moment when it urgently needed one. But the combination of single-winner postbacks, the conversion value timer tradeoff, and the random delivery delay meant that the signal it returned was coarser, slower, and less actionable than what UA teams had lost with the IDFA. The versions that followed were largely attempts to address those gaps.

SKAN 2.1 and 2.2, 2020 to 2021

Version 2.1 strengthened postback validation with a 256-bit public key. Version 2.2, released with iOS 14.5, added view-through attribution via SKAdImpression APIs and fidelity types to distinguish view-through from StoreKit-rendered ads.

SKAN 3.0, 2021

Available on iOS 14.6, SKAN 3 introduced non-winning postbacks. One winning network and up to five other eligible networks could receive postbacks flagged did-win = false, giving losing bidders useful signal and insights. iOS 15 also added developer copies of winning postbacks, which made MMP-centralized reporting viable.

SKAN 4.0, 2022

The biggest functional leap, released with iOS 16.1. SKAN 4 introduced:

• Hierarchical source identifiers (2-, 3-, or 4-digit returns depending on privacy tier)
• Fine and coarse conversion values (coarse = low, medium, high, to preserve signal when volume is thin)
• Three postback windows (days 0-2, 3-7, and 8-35) for longer monetization visibility
• Web-to-app attribution in Safari
• A LockWindow feature to send postbacks faster when a user hit a target event

SKAN 4 was powerful, but operationally heavy. Marketers now had to think in windows, tiers, coarse vs. fine schemas, and source-identifier strategy.

SKAN 5.0, Announced Then Quietly Replaced

Apple teased SKAN 5 with promised re-engagement support, but the "SKAN 5" branding never shipped. Instead, at WWDC24, Apple introduced AdAttributionKit (AAK) as the successor framework.

AdAttributionKit, 2024 to Present

AAK launched with iOS 17.4 and has been expanded through 2025. Apple describes it as "built on the functionality of SKAdNetwork" and fully interoperable with it. The key additions:

• Re-engagement measurement via Universal Links (SKAN only tracked net-new installs)
• Support for alternative app marketplaces, driven in large part by the EU's Digital Markets Act
• Custom click ads and richer ad format support
• JWS-formatted impressions and postbacks
• Developer Mode, which shortens postback delays from 24 to 48 hours down to roughly 5 to 10 minutes for testing

2025 updates added configurable attribution windows, configurable cooldowns, country codes in postbacks at high anonymity tiers, and conversion tags for granular re-engagement measurement. Apple Ads itself joined AdAttributionKit/SKAN on April 10, 2025.

Why AAK Has Not Been Widely Adopted

This is the question UA managers ask us most often. Four reasons stand out.

1. Networks Moved at Wildly Different Speeds

Adoption has been uneven across the ecosystem. Apple can ship a new attribution framework, but it only delivers value when every part of the stack—publishers, ad networks, MMPs, and advertiser implementations—supports it. In reality, those pieces don’t upgrade in lockstep, which slows adoption and limits how much signal marketers can actually use.

2. Implementation Cost Rose Faster Than Perceived Value

SKAN 4 and AAK introduced more moving parts: coarse vs. fine conversion schemas, three windows, source identifier hierarchies, crowd-anonymity implications, and dual postback-copy endpoints. AppsFlyer's current SDK integration still requires developers to configure both SKAN and AAK postback endpoints separately in Info.plist to flow data into the MMP. For smaller UA orgs, the question became: will this extra work materially change optimization outcomes?

3. The Market Engineered Around the Problem

By 2025, most sophisticated UA teams had stopped waiting for any single Apple framework upgrade to solve iOS measurement. Instead, they built blended measurement stacks: ATT-consented deterministic data, SKAN/AAK postbacks, MMP modeling, incrementality testing, and first-party analytics. AppsFlyer reports global ATT opt-in has reached roughly 50%, and Adjust places the industry average around 35% in Q2 2025, enough deterministic signal to enrich modeling on top of SKAN.

4. Urgency Outside the EU Is Low

AAK was shaped heavily by the Digital Markets Act's requirement to support alternative app stores. For advertisers running solely on the App Store outside the EU, SKAN 4.0 remains fully functional, which blunts the urgency to rebuild on AAK.

What This Means for UA Managers Right Now

Here's the practical playbook we recommend to Bidease clients.

1. Treat SKAN/AAK as One Layer, Not the Whole Stack

Pair it with consented first-party data, MMP modeling, incrementality testing, creative analysis, and cohort monetization. That's where the market has landed, and it's the only way to produce decision-grade ROAS reporting in the privacy era.

2. Keep Conversion Value Mappings Outcome-Led

Don't try to encode every event. Pick business-critical early signals that correlate with downstream value. These signals often vary by app vertical. For example:

• Subscription apps: trial start, paywall view, subscription, early revenue bucket
• Gaming apps: tutorial completion, level reached, IAP bucket, ad engagement
• Commerce apps: account creation, add-to-cart, purchase bucket
  

Adjust's case study with VividJoan Games is a useful reference point: moving from a 6-value setup to a 64-value schema based on behavior and revenue bucketing improved reported ROI by 32%.

3. Consolidate Campaigns to Beat Crowd Anonymity

Fine-grained data and full source-ID digits only return at higher anonymity tiers. Running 50 hyper-segmented iOS campaigns guarantees masked, coarse data. Consolidate into fewer, higher-volume campaigns to unlock richer postbacks.

4. Plan Source Identifiers Intentionally

Use the hierarchical structure deliberately: for example, put “campaign” in the leading digits, “placement,” “geo,” or “creative bucket” in later digits. Assume lower privacy tiers will return fewer digits, and design the schema so the most important dimension is always in the first two digits.

5. Use All Three Postback Windows

If your monetization curve extends beyond day 2 (and for subscription, fintech, and commerce apps it almost always does), design your conversion strategy to capture signal across days 3-7 and 8-35, not just the first window. Use LockWindow selectively when a user hits a target KPI early, so DSPs like Bidease can optimize bidding faster.

6. Configure Postback Copies and Use Developer Mode

Send postback copies to your MMP for centralized reporting. Ask your partners to use AAK's Developer Mode to validate data flows in minutes instead of waiting 24 to 48 hours for real postbacks. This alone removes one of the biggest historic frictions in SKAN setup.

The Bottom Line

SKAN succeeded at becoming the default privacy-safe measurement standard for iOS. It did not succeed at becoming a complete measurement solution on its own, and AdAttributionKit, for all its improvements, hasn't changed that reality. The limiting factors in 2026 go beyond Apple's framework: they include ecosystem adoption, operational setup, and whether your media mix actually supports the latest features.

The winners on iOS are the teams that understand SKAN and AAK deeply, operationalize them cleanly, and pair them with first-party signals, modeled measurement, and incrementality testing.

At Bidease, our DSP is built for exactly this environment: predictive algorithms designed to optimize against coarse and delayed signals, full support for the latest SKAN postback structures, and transparent reporting that helps UA teams make sense of privacy-era data. If you want to pressure-test your iOS measurement setup or explore how a programmatic partner can help you get more signal from SKAN, get in touch with our team.

Privacy-era UA isn't about having less data. It's about using the signals you have more intelligently.