Back to Intelligence Hub
platform-policyGlobalRisk Level: medium
Apple ATT Refresh & SKAdNetwork 5 May 2026: Privacy Manifests, Postback Schemas & Mobile Advertiser Measurement Workflow
Apple's iOS 19 Spring 2026 release refreshed App Tracking Transparency, ratcheted SKAdNetwork to version 5, and tightened privacy manifest requirements. Mobile advertisers face a measurement reset.
Quick Answer
Apple's iOS 19 Spring 2026 release refreshed App Tracking Transparency, ratcheted SKAdNetwork to version 5, and tightened privacy manifest requirements. Mobile advertisers face a measurement reset: postback schemas changed, conversion value model evolved, and unmanifested SDK use blocks app submission.
iOS 19 Spring 2026 Privacy Refresh
Apple's iOS 19 Spring 2026 release shipped a coordinated refresh of the privacy regime that the App Tracking Transparency framework has produced since iOS 14.5. The refresh covers four distinct areas — the ATT prompt itself, the SKAdNetwork attribution framework, the privacy manifest requirements for third-party SDKs, and the IDFA enforcement on apps that have not received user consent. The combined direction is tighter than the iOS 17 baseline and produces material work for mobile advertisers and the SDK ecosystem.
The ATT prompt refresh focuses on language and timing. The default prompt language has been refined to reduce ambiguity about what tracking means in practice, and the prompt is now eligible to fire at multiple in-app moments rather than only at first launch. The multi-moment eligibility is opt-in for app developers and supports the design pattern where the prompt fires at a contextually meaningful moment rather than at first launch when users have not yet experienced the value of the app.
The SKAdNetwork refresh moves the framework to version 5 with new postback parameters, expanded conversion value range, more granular attribution windows, and improved view-through attribution. The privacy manifest refresh extends manifest requirements to all third-party SDKs and tightens the reason-code declarations. The IDFA enforcement refresh closes alternative identifier workarounds that emerged in 2024 and 2025.
"The iOS 19 refresh is a measurement reset, not an incremental update. Mobile advertisers should plan a coordinated transition across SDKs, conversion value models, and platform algorithms during Q2 and Q3 2026."
— AuditSocials mobile measurement brief, May 2026
For the broader Meta policy framework that interacts with iOS measurement, see Meta Ad Policies. Track in-flight platform updates through the Policy Tracker.
Privacy Manifest Requirements
Privacy manifests are an Apple iOS feature introduced in iOS 17 that requires apps and third-party SDKs to declare the data they access, the reasons for accessing that data, and the tracking domains they communicate with. The 2026 refresh tightens several aspects of the framework and removes the earlier exception that allowed some SDKs to operate without a manifest under the parent app's coverage.
Refreshed Manifest Requirements
| Requirement | iOS 17 Baseline | iOS 19 Refresh |
|---|---|---|
| SDK manifest scope | Some exceptions for parent-app coverage | All third-party SDKs require own manifest |
| Reason code list | Short approved list with ambiguous categories | Expanded list with fraud prevention, performance measurement separated |
| Tracking domain declaration | May include unused domains | Must match actual configured behaviour |
| Alternative identifier declaration | Not specifically required | Required as tracking-equivalent functionality |
| Apple review validation | Static analysis | Dynamic analysis of binary behaviour |
Mobile Measurement Partner Status
- AppsFlyer: Updated SDK with refreshed manifest available since Q1 2026
- Adjust: Updated SDK with refreshed manifest available since Q1 2026
- Branch: Updated SDK with refreshed manifest available since Q1 2026
- Singular: Updated SDK with refreshed manifest available since Q1 2026
Advertisers integrating these SDKs should verify that the version they ship is the post-refresh version. For automated review of mobile measurement configurations, run AI Compliance Audit.
SKAdNetwork 5 Postback Schema
SKAdNetwork 5 is the most substantive technical change in the iOS 19 Spring 2026 refresh. The version introduces several new postback fields, expands the conversion value range, supports multi-window attribution, and improves view-through attribution mechanics.
New & Updated Postback Fields
| Field | Purpose | Notes |
|---|---|---|
| Campaign hierarchy identifier | Granular campaign organisation | Operates within differential privacy budget |
| Redownload indicator | Distinguishes new install from reinstall | Supports retention measurement |
| Expanded conversion value | 8-bit fine-grained value (256 states) | Tighter privacy budget |
| Multi-window attribution | Three configurable windows per campaign | Short, medium, long-term measurement |
| Improved view-through indicator | Explicit view-through signalling | Aligns with cross-platform measurement |
Conversion Value Range Comparison
- SKAdNetwork 4: 6-bit fine-grained (64 values) OR 2-bit coarse-grained (3 states)
- SKAdNetwork 5: 8-bit fine-grained (256 values) under tighter privacy budget
- Operational implication: Conversion value mapping requires deliberate redefinition
For automated review of conversion value modelling configurations, route through AI Compliance Audit.
IDFA & Alternative Identifier Enforcement
The IDFA enforcement refresh targets alternative identifier strategies that emerged in 2024 and 2025 — device fingerprinting, deterministic email matches, SSO identifier abuse, and probabilistic matching techniques. The refresh extends ATT-equivalent restrictions to alternative identifier use through privacy manifest declarations and through expanded App Store review validation.
Workaround Patterns Now Restricted
- Device fingerprinting: Any technique combining device characteristics into a stable cross-app identifier
- Probabilistic matching: Restricted beyond narrow fraud-prevention use cases
- SSO identifier cross-app tracking: Permitted within SSO scope; prohibited for cross-app tracking when ATT denied
- Deterministic email match without consent: Requires ATT-equivalent prompt
- Bundled consent flows: Insufficient — explicit ATT prompt required
App Store Review Mechanics
Apple's review process now applies dynamic analysis of app binaries against privacy manifest declarations and against the alternative identifier prohibitions. Apps that ship with non-compliant SDKs or that exhibit prohibited identifier behaviour face rejection. The dynamic analysis is more aggressive than the static analysis of earlier review iterations.
For audit of mobile measurement infrastructure against the refreshed framework, run AI Compliance Audit.
Cross-Platform Measurement Impact
Each major mobile advertising platform has updated its measurement framework through Q1 and Q2 2026 to leverage SKAdNetwork 5 signals and to align with the refreshed ATT and privacy manifest requirements. Advertisers running cross-platform mobile campaigns should expect a recalibration period as the platforms adjust to the refreshed framework.
Platform-Specific Update Status
| Platform | Measurement Framework | 2026 Update Status |
|---|---|---|
| Meta | Aggregated Event Measurement (AEM) | Updated for SKAN 5 postbacks; conversion value range expanded |
| TikTok | TikTok Ads Manager attribution + SKAN | Updated for SKAN 5 postbacks; algorithm recalibrating |
| Firebase + Google Ads attribution | Updated for SKAN 5; aligning with Android Privacy Sandbox | |
| Snapchat | Snap Pixel + Conversions API + SKAN | Updated for SKAN 5 postbacks |
The cross-platform recommendation is to coordinate measurement infrastructure updates in a single workstream rather than platform-by-platform. For platform-specific guidance, see Meta Ad Policies and Google Ads Policy Guide.
Mobile Advertiser Transition Checklist
- [ ] Update every third-party SDK to post-refresh version
- [ ] Verify privacy manifest reason codes match SDK behaviour
- [ ] Validate tracking domain declarations against actual SDK communication
- [ ] Declare any alternative identifier use in privacy manifest
- [ ] Update mobile measurement partner integration for SKAdNetwork 5 postbacks
- [ ] Expand conversion value mapping to leverage the new 8-bit range
- [ ] Configure multi-window attribution aligned with measurement objectives
- [ ] Transition campaigns relying on alternative identifier strategies to compliant measurement
- [ ] Update downstream analytics to ingest new postback fields
- [ ] Plan budget and reporting expectations for platform algorithm recalibration
- [ ] Submit App Store update with refreshed configurations before iOS 19 install volume peaks
- [ ] Track in-flight Apple developer guidance through the Policy Tracker
Frequently Asked Questions
What did Apple change in App Tracking Transparency and SKAdNetwork with the iOS 19 Spring 2026 release?
Apple's iOS 19 Spring 2026 release shipped a coordinated refresh of the privacy regime that the App Tracking Transparency framework has produced since iOS 14.5. The refresh covers four distinct areas — the ATT prompt itself, the SKAdNetwork attribution framework, the privacy manifest requirements for third-party SDKs, and the IDFA enforcement on apps that have not received user consent. The combined direction is tighter than the iOS 17 baseline and produces material work for mobile advertisers and the SDK ecosystem. The ATT prompt refresh focuses on language and timing. The default prompt language has been refined to reduce ambiguity about what tracking means in practice, and the prompt is now eligible to fire at multiple in-app moments rather than only at first launch. The multi-moment prompt eligibility is opt-in for app developers and supports the design pattern where the prompt fires at a contextually meaningful moment rather than at first launch when users have not yet experienced the value of the app. The user-facing controls have also been updated — the system-level Allow Apps to Request to Track toggle now produces clearer state transitions and supports per-app overrides more directly. The SKAdNetwork refresh moves the framework to version 5, which is the most substantive technical change. SKAdNetwork 5 introduces several new postback parameters, expanded conversion value range, more granular attribution windows, and an improved view-through attribution mechanic. The new postbacks support more accurate measurement of campaign performance under the privacy-preserving framework while maintaining the differential privacy guarantees that prevent cross-app tracking. The privacy manifest refresh tightens the requirements that Apple introduced in iOS 17. Privacy manifests must now be present on all third-party SDKs that integrate into iOS apps, must declare the specific reason codes for each data access type, and must align with the parent app's manifest declarations. Apps that ship with non-compliant SDK manifests are blocked from App Store submission. The IDFA enforcement refresh targets a workaround pattern that appeared in 2024 and 2025 where apps would prompt users to consent to alternative identifiers as a substitute for IDFA when ATT was denied. The refresh extends ATT-equivalent restrictions to alternative identifier use, requires the privacy manifest to declare the alternative identifier, and produces App Store rejection for apps that use alternative identifiers without proper declaration. For the broader Meta policy framework that interacts with iOS measurement, see Meta Ad Policies and track in-flight platform updates through the Policy Tracker.
How do privacy manifest requirements work in practice for mobile advertisers and what changed in 2026?
Privacy manifests are an Apple iOS feature introduced in iOS 17 that requires apps and third-party SDKs to declare the data they access, the reasons for accessing that data, and the tracking domains they communicate with. The manifests are bundled with the app or SDK in a structured file format and Apple's App Store review process validates the manifest contents against actual app behaviour. The 2026 refresh tightens several aspects of the privacy manifest framework. The manifest is now required on all third-party SDKs that integrate into iOS apps regardless of the SDK's market position or category. The earlier framework allowed some SDKs to operate without a manifest as long as the parent app's manifest covered the SDK's behaviour. The 2026 refresh removes that exception and requires every SDK to ship its own manifest. The reason codes that justify each data access type have been expanded and tightened. The earlier framework offered a relatively short list of approved reason codes including App Functionality, Analytics, Product Personalization, App Functionality, and a handful of others. The 2026 refresh expands the list to cover specific use cases that previously fell into ambiguous categories — fraud prevention is now a distinct reason code separate from analytics, performance measurement is distinct from analytics, and so on. The refinement supports more accurate manifest declarations and reduces the ambiguity that produced reviewer rejections under the earlier framework. The tracking domain declaration must now align precisely with actual SDK behaviour. The earlier framework allowed SDKs to declare tracking domains that the SDK might communicate with even if the specific app integration did not exercise those domains. The 2026 refresh requires the declaration to match the SDK's actual configured behaviour in the parent app, and Apple's review process validates the alignment through dynamic analysis of the app binary. SDKs that declare domains they do not actually communicate with face manifest rejection, and apps that bundle non-compliant SDKs face App Store rejection. From the mobile advertiser perspective the privacy manifest requirements affect campaign measurement and audience-building infrastructure. Mobile measurement partners — AppsFlyer, Adjust, Branch, Singular, and others — have updated their SDK manifests through Q1 and Q2 2026 to align with the refreshed framework, and advertisers integrating these SDKs should verify that the version they ship is the post-refresh version. Advertisers running custom-built measurement infrastructure must produce their own manifests that satisfy the refreshed framework. The advertiser-side compliance check is straightforward but must be completed before App Store submission of any update. For automated review of mobile measurement configurations, run AI Compliance Audit and reference the broader privacy regulatory frame through EU DSA Compliance.
What are the specific changes in SKAdNetwork 5 and how do they affect campaign measurement?
SKAdNetwork 5 is the most substantive technical change in the iOS 19 Spring 2026 refresh and produces material improvements in measurement accuracy under the privacy-preserving attribution framework. The version represents the fifth major iteration since SKAdNetwork was introduced in iOS 14.5 and consolidates lessons learned from the earlier iterations. The first set of changes covers postback parameters. SKAdNetwork 5 introduces several new postback fields including a campaign hierarchy identifier that supports more granular campaign organisation under the differential privacy budget, a redownload indicator that distinguishes new installs from reinstalls, an updated conversion value field with expanded range, and a refined view-through indicator that distinguishes view-through from click-through attribution more reliably. The new fields support more accurate downstream analysis without compromising the privacy-preserving guarantees of the framework. The second set of changes covers conversion value range. The earlier SKAdNetwork iterations offered a fine-grained conversion value of six bits — sixty-four possible values — and a coarse-grained alternative of two bits with three states. SKAdNetwork 5 expands the fine-grained range to eight bits — two hundred fifty-six values — under tighter privacy budget constraints. The expanded range supports more nuanced conversion value modelling for advertisers running sophisticated measurement, and the tighter privacy budget protects against the cross-correlation attacks that academic research identified in the earlier framework. The third set of changes covers attribution windows. The earlier framework offered a single primary attribution window with a randomised postback delay. SKAdNetwork 5 supports three configurable attribution windows of different durations within a single campaign, and the multi-window structure enables advertisers to measure short-term, medium-term, and long-term conversion behaviour through separate postbacks. The multi-window structure produces operational complexity but supports the measurement use cases that retention-focused advertisers had been requesting. The fourth set of changes covers view-through attribution. The earlier framework provided limited support for view-through measurement and produced inconsistent results across measurement partners. SKAdNetwork 5 introduces an improved view-through attribution mechanic with explicit signalling, and the improvement aligns the iOS measurement framework more closely with Android's measurement framework and with cross-platform measurement systems. From the advertiser perspective SKAdNetwork 5 produces measurement improvements but also requires infrastructure updates. Mobile measurement partners have updated their integrations through Q1 and Q2 2026 to support the new postback fields, the expanded conversion value range, and the multi-window attribution structure. Advertisers running campaigns with conversion value modelling should validate that their conversion value mappings align with the expanded range, that their attribution window configuration matches their measurement objectives, and that their downstream analysis can ingest the new postback fields. Campaign optimisation algorithms on Meta, TikTok, Google, and other major platforms have been updated to leverage SKAdNetwork 5 signals, and advertisers should expect a brief recalibration period as algorithms adjust to the new signal base. For automated review of mobile measurement configurations, route through AI Compliance Audit.
How does the IDFA enforcement refresh affect alternative identifier strategies that emerged in 2024 and 2025?
The IDFA enforcement refresh in the iOS 19 Spring 2026 release targets alternative identifier strategies that emerged in the App Tracking Transparency framework's earlier years. The strategies attempted to substitute alternative identifiers — typically device fingerprints, deterministic email matches, or shared identifier services — for IDFA when ATT was denied, and the strategies operated in a grey area between technical compliance and substantive evasion of the privacy framework's intent. The refresh extends ATT-equivalent restrictions to alternative identifier use through several specific mechanisms. The privacy manifest framework now requires apps and SDKs to declare alternative identifiers as tracking-equivalent functionality and to obtain user consent through an ATT-equivalent prompt before using the identifier. Alternative identifiers without proper declaration produce App Store rejection. Apps and SDKs that obtain consent through other mechanisms — bundled consent flows, pre-installed acceptance, opaque opt-in — are flagged by Apple's review process as non-compliant. The Single Sign-On Identifier framework that several major platforms introduced as an alternative identifier substitute is now subject to specific Apple guidance. The guidance permits SSO identifiers for the platform's own use within the SSO scope but prohibits cross-app tracking using the SSO identifier when ATT has been denied. The platform-side enforcement requires the SSO identifier provider to verify ATT status before exposing the identifier for cross-app tracking, and Apple's review process validates the verification mechanic. Device fingerprinting techniques are now subject to expanded restrictions. The earlier framework prohibited device fingerprinting under specific circumstances but left some ambiguity about what techniques constituted fingerprinting. The refresh expands the prohibition to cover any technique that combines device characteristics in ways that produce a stable identifier across apps, and Apple's review process applies the expanded definition more aggressively. SDKs that use fingerprinting techniques in any configuration produce App Store rejection. Probabilistic matching techniques face similar restrictions. The earlier framework prohibited probabilistic matching for cross-app tracking but allowed some forms of probabilistic matching for fraud prevention and other narrow use cases. The refresh tightens the narrow use cases and requires explicit declaration of probabilistic matching in the privacy manifest. Apps and SDKs that use probabilistic matching without proper declaration face rejection. From the mobile advertiser perspective the IDFA enforcement refresh closes several measurement workarounds that emerged in 2024 and 2025 and pushes the measurement infrastructure further toward the SKAdNetwork 5 framework. Advertisers running campaigns that relied on alternative identifier strategies should plan for measurement transition during Q2 and Q3 2026, and the transition typically requires conversion value model recalibration, attribution window reconfiguration, and downstream analytics adjustment. The transition is operationally significant but produces a more sustainable measurement posture aligned with the broader privacy regulatory direction. For audit of mobile measurement infrastructure against the refreshed framework, route through AI Compliance Audit.
How do Meta, TikTok, Google, and Snapchat measurement frameworks adapt to the 2026 ATT and SKAdNetwork refresh?
Each major mobile advertising platform has updated its measurement framework through Q1 and Q2 2026 to leverage SKAdNetwork 5 signals and to align with the refreshed ATT and privacy manifest requirements. The platform-side updates cover SDK integration, conversion value modelling, audience targeting, and campaign optimisation, and advertisers running cross-platform mobile campaigns should expect a recalibration period as the platforms adjust to the refreshed framework. On Meta the measurement framework continues to operate through the Aggregated Event Measurement architecture that Meta introduced in 2021 in response to the original ATT framework. AEM has been updated to ingest SKAdNetwork 5 postbacks, to leverage the expanded conversion value range, and to support the multi-window attribution structure. Advertisers running Meta App Ads campaigns should expect modestly improved conversion value precision and access to longer attribution windows for retention-focused campaigns. Meta's privacy manifest has been updated to align with the 2026 refresh, and advertisers integrating Meta SDKs should ensure that the version they ship is the post-refresh version. On TikTok the measurement framework operates through the TikTok Ads Manager attribution system with SKAdNetwork integration. The 2026 update integrates SKAdNetwork 5 postbacks and supports the new conversion value range, and TikTok has indicated that campaign optimisation algorithms will leverage the expanded signal base for improved targeting precision. TikTok's privacy manifest has been updated and advertisers integrating TikTok SDKs should verify the post-refresh version. On Google the measurement framework operates through the Firebase analytics integration and the Google Ads attribution system. The 2026 update integrates SKAdNetwork 5 postbacks and aligns the measurement infrastructure with Privacy Sandbox developments on Android. Advertisers running Google App campaigns benefit from improved cross-platform measurement consistency between iOS and Android. Google's privacy manifest has been updated and advertisers integrating Google SDKs should verify the post-refresh version. On Snapchat the measurement framework operates through the Snap Pixel and Conversions API integration. The 2026 update integrates SKAdNetwork 5 postbacks and supports the new conversion value range. Snapchat's privacy manifest has been updated and advertisers integrating Snap SDKs should verify the post-refresh version. The cross-platform recommendation is to coordinate the measurement infrastructure update across all platforms in a single workstream rather than platform-by-platform. The coordinated approach reduces the recalibration period and produces more consistent cross-platform measurement during the transition. For platform-specific guidance, see Meta Ad Policies, Google Ads Policy Guide, TikTok Community Guidelines, and Snapchat Advertising Guide.
What practical workflow should mobile advertisers follow to complete the iOS 19 measurement transition by Q3 2026?
The practical workflow for mobile advertisers to complete the iOS 19 measurement transition by Q3 2026 involves five workstreams that should run in parallel during the second and third quarters of 2026. Advertisers running large-scale mobile campaigns should treat the iOS 19 Spring 2026 release as a forced measurement reset rather than an incremental update, and resourcing should reflect the operational burden. The first workstream is SDK update and privacy manifest verification. Every third-party SDK integrated into the app must be updated to the post-refresh version, and the privacy manifest must be verified against the refreshed framework requirements. The verification process includes review of declared reason codes, validation that tracking domain declarations match actual SDK behaviour, and confirmation that alternative identifier use is properly declared. The workstream typically takes four to six weeks for a multi-SDK app and produces remediation work that takes another two to four weeks. The second workstream is SKAdNetwork 5 measurement infrastructure update. The mobile measurement partner integration must be updated to ingest the new postback fields, the conversion value mapping must be expanded to leverage the new range, and the attribution window configuration must be aligned with measurement objectives. The downstream analytics infrastructure must be updated to ingest the new postback fields and to support the multi-window attribution structure. The workstream typically takes six to eight weeks. The third workstream is conversion value model recalibration. The expanded conversion value range supports more nuanced modelling but requires the advertiser to define the value mapping deliberately. The recalibration process includes analysis of historical conversion data, definition of the new value mapping aligned with business objectives, validation against measurement partner integrations, and rollout to active campaigns. The workstream typically takes four to eight weeks and may require iterative refinement during the rollout. The fourth workstream is alternative identifier transition. Advertisers running campaigns that relied on alternative identifier strategies must transition the affected campaigns to SKAdNetwork 5 measurement or to other compliant measurement approaches. The transition requires identification of affected campaigns, configuration update on the platform side, validation that conversion volume and quality remain acceptable, and downstream analytics adjustment. The workstream depends on the advertiser's prior reliance on alternative identifiers. The fifth workstream is platform-specific algorithm recalibration. Each platform's campaign optimisation algorithm has been updated to leverage SKAdNetwork 5 signals, and active campaigns may require a recalibration period during which performance volatility is elevated. The recalibration is typically two to four weeks per platform and may produce temporary cost-per-action degradation. Advertisers should plan budget and reporting expectations accordingly. For end-to-end audit of mobile measurement infrastructure against the refreshed framework, run AI Compliance Audit. Reference the broader Meta policy frame through Meta Ad Policies.
Don't miss the next policy change.
Create a free account — track every policy change across 8 platforms, get instant alerts, and access every free compliance tool. Or try our Meta Rejection Predictor first.
Report Keywords — Run AI Compliance Audit
#Apple ATT#SKAdNetwork#Privacy Manifests#iOS Privacy#Mobile Measurement#App Install Ads#Conversion Tracking#2026 Policy#Advertisers#Compliance Guide 2026#Data Minimization#Privacy
Related Posts
May 2026 Enforcement Digest: Who Got Banned, Fined or Paused Across 8 Platforms
May 2026 was the heaviest enforcement month of the year so far. Every advertiser-facing action across the eight major platforms — bans, fines, pauses, and the patterns brands need to read before June.
California Age-Appropriate Design Code in 2026: The NetChoice Ruling, DPIAs and What Survives for Advertisers
California's Age-Appropriate Design Code has been narrowed by the courts, not erased. A 2026 Ninth Circuit ruling reshaped which provisions survive for advertisers.
Synthetic Media Enforcement Index Q1 2026 — DSA Transparency Database Findings
Q1 2026 DSA Transparency Database snapshot — 299 million enforcement actions across eight major platforms, with the demoted-content layer, automation rates, and EU30 geographic spread broken out.