Why the Cookie Fell: App Tracking Transparency and What Marketers Built Instead

The tracking marketers relied on quietly broke

For most of the 2010s, digital advertising was measured by following people. A third-party cookie in the browser and a tracking identifier on the phone let an ad platform stitch a viewer of an ad to a later buyer, and then report, with apparent precision, which campaign earned which sale. That machinery is what a dashboard means when it shows a return on ad spend next to a specific campaign.

Apple ended the default version of that on mobile. App Tracking Transparency, introduced with iOS 14.5 in April 2021, required every app to ask explicit permission before tracking a user across other companies' apps and websites. The prompt was plain, the choice was the user's, and a large share of users declined. On the browser side, third-party cookies were being restricted by Safari and Firefox and were the subject of a long, repeatedly delayed deprecation plan in Chrome. The net effect was the same from a measurement seat: the identifiers that let a platform recognize the same person twice were disappearing.

This was not a tuning problem to be fixed with a better tag. It was the removal of the raw material, the persistent individual identifier, that person-level attribution had always assumed it would have.

What the numbers say, and who counted them

The direction of the change is not in dispute. The magnitude is where the figures get unreliable, because the most-quoted numbers come from companies with a commercial stake in the story they tell.

Industry and ad-tech reporting, summarized across marketing trade press, put the pieces at roughly this: about three quarters of iOS users opted out of cross-app tracking once prompted, the accuracy of one large platform's ad tracking was estimated to fall by around thirty to forty percent, and pixel-based revenue attribution for e-commerce dropped from capturing something like eighty to ninety-five percent of sales down to sixty to seventy percent. Read those as directional, not settled. They are drawn from vendor studies, not independent peer-reviewed research, and the vendors sit on the side of the market that benefits when the loss looks severe.

The responsible way to hold both facts at once: the event and its direction are established and dated, while the specific percentages are the least reliable part of the record and should never be repeated as if they were laboratory constants.

The cookie's fall exposed a measurement that was already unreliable

It is tempting to mourn person-level attribution as a lost source of truth. The stronger reading is that it was never as truthful as its precision suggested, and its collapse simply removed the illusion.

The clearest evidence predates the privacy changes. Gordon, Zettelmeyer, Bhargava and Chapsky ran fifteen large-scale randomized field experiments at Facebook, more than 500 million user-experiment observations across 1.6 billion ad impressions, and compared the true causal lift each experiment measured against what standard observational attribution methods would have estimated from the same data. The observational methods, the same family that underpins most multi-touch attribution, frequently produced effect estimates in the wrong direction or of the wrong magnitude, even after conditioning on rich demographic and behavioral detail.

So the framing of the last few years is not that a reliable ruler was taken away. It is that a ruler which routinely disagreed with controlled experiments became harder to build, which forced the industry toward methods that had a stronger claim to causality in the first place.

What marketers built, part one: consented server-side signals

The first response was to rebuild the plumbing on a lawful, consented footing. Instead of relying on a browser cookie or a device identifier set by a third party, a business collects the events it owns, a booking, a form, a purchase, on its own server, and forwards them to ad platforms through a server-side interface with the user's consent recorded.

On the major platforms this is the Conversions API and its equivalents, paired with a consent framework that decides what may be sent at all. The point is not that this restores person-by-person surveillance; it does not, and should not. The point is that the events a business is entitled to measure are counted once, at the right value, and delivered reliably, rather than being lost in a browser that now blocks the old tag. It is durable measurement infrastructure, not a workaround to keep tracking people who declined to be tracked.

What marketers built, part two: aggregate methods that never watched a person

The second response was more consequential. If you cannot follow individuals, you can still measure what advertising caused by working at the level of totals and geographies. Two methods carried this, and both were open-sourced by the largest ad platforms during exactly this period, which is itself a signal that the platforms now treat them as the credible fallback.

Why the aggregate methods survived the collapse

The common thread is that neither method depends on recognizing the same person twice. Mix modeling reads totals; geo-experiments read regions. Privacy prompts, cookie restrictions and regulation take away individual identifiers, and both methods keep working because they never needed them.

There is a second, quieter reason they endured. Because a geo-experiment measures a genuine counterfactual, and because a mix model can be calibrated against such an experiment, these methods have a stronger claim to answering the real question, what did the spending cause, than a person-level report that credits the ad for sales that were already coming. The privacy changes did not invent that question; they just made it impossible to keep avoiding it.

The caveats at a single location's scale

A local business owner should hear the loud caveat before adopting any of this. The aggregate methods were validated at the scale of national brands with large budgets and many markets. Whether they perform as well for a single-location med spa or a home-services firm with a modest spend is an open, emerging question, not a settled one. A mix model needs enough history and enough variation to separate signal from noise; a geo-experiment needs enough comparable markets to build a credible control.

This is not a reason to retreat to the flattering platform number. It is a reason to be modest about precision, to prefer the method the available data can actually support, and to say plainly when a read is directional. It is also the argument for pooling: many similar small businesses measured on a common method recover statistical power no single one of them has alone. Any figure presented without that honesty, at any scale, is worth less than it looks.

How to read any claim that your attribution is fixed

The practical test for a buyer is short. Ask whether a reported return is a platform's account of its own work or an independent measurement of what the spend caused. Ask whether the number came from following individuals, which is now degraded and consented at best, or from an aggregate method that never needed to. Ask whether the point estimate carries a sense of its own uncertainty, or is quoted as a clean fact.

The cookie fell, and with it the pretense that individual tracking gave marketers the truth. What replaced it is less precise about persons and more honest about causes. The businesses that measure well now are not the ones clinging to the old pixel; they are the ones asking, of every dollar, what it actually changed, and accepting a directional answer over a confident wrong one.