TLDR: Apple's iOS 14 ATT change in 2021 quietly destroyed the last-click attribution model that powered a decade of digital advertising. Five years later, brands and platforms are still adjusting. The fix isn't a new tracking pixel or a bigger data clean room. It's a new layer of attribution that starts in the physical world and works backward. Here's what broke, why it matters, and what comes next.
If you're a brand in 2026 and you've ever asked yourself "is this campaign actually working," the reason you can't get a clean answer goes back to a single feature Apple shipped in April 2021.
This post is the long version of why mobile attribution is broken, what brands and platforms tried to do about it, and where the new attribution layer is being built. It's not a sales pitch. It's the context every founder, marketer, and creator should have before making a decision in 2026.
What iOS 14 actually changed
Before 2021, every iPhone shipped with a unique advertising identifier called the IDFA. Every app could read it. Facebook (now Meta), Google, Snap, TikTok, and every ad network used the IDFA to stitch together a person's behavior across apps and websites. If you saw a Nike ad in Instagram on Tuesday and bought sneakers on the Nike app on Friday, the IDFA was what tied those two events together.
In April 2021, Apple shipped App Tracking Transparency. Every app now had to ask the user for permission before reading the IDFA. The text of the prompt was deliberately blunt: "Allow [App Name] to track your activity across other companies' apps and websites?"
Roughly 75% of users said no.
In one quarter, Meta's ability to attribute conversions on iOS dropped by an estimated 60% to 70%. Meta's stock lost over $230B in market cap on a single earnings call later that year. Snap's revenue growth halved. Every direct-to-consumer brand that relied on Facebook Ads to scale had to rebuild their entire measurement stack from scratch.
Last-click attribution, the model that said "the last ad someone clicked before buying gets the credit," was effectively dead on iOS.
What broke for local businesses
The iOS 14 story usually gets told from the perspective of big direct-to-consumer brands. The impact on local businesses is bigger and less talked about.
A Toronto cafe that wants to know if an Instagram ad drove someone into the store has three problems:
1. The ad click can no longer be tied to a person across apps. ATT killed that. 2. Even if you tie the click to a session, that session ends when the person closes the app. A real visit happens hours or days later. 3. The "visit" itself is a physical event with no digital signal. No one taps a "I came in" button.
Last-click attribution always failed at point 3. ATT made points 1 and 2 fail too. The result: local brands have been flying blind on creator and ad attribution for the better part of five years.
What web tracking did next
Apple wasn't done. Safari rolled out Intelligent Tracking Prevention, which capped the lifetime of third-party cookies, then first-party cookies set by ad-tech, then eventually nuked most cross-site tracking entirely. Firefox made the same moves. Chrome announced and then delayed the deprecation of third-party cookies repeatedly, but the writing is on the wall.
Add to that the rise of in-app browsers (the version of Safari that opens inside Instagram or TikTok when you tap a link) which have their own cookie limitations, and the situation gets worse. A user might tap a creator's link in TikTok, land on a brand's site inside the in-app browser, and then close the app. From the brand's analytics, that visitor looks like a stranger with zero source attribution.
Roughly 64% of mobile web sessions originating from a creator post in 2026 carry no usable referrer data. The brand has no idea where the visit came from.
What brands tried to replace it with
Three replacements got the most attention.
First, Apple's SKAdNetwork (SKAN). Apple's own privacy-preserving attribution framework, designed to give advertisers an aggregated, delayed signal of conversions. It works for app installs but is borderline useless for brick-and-mortar foot traffic. Cafe owners can't run SKAN.
Second, marketing mix modeling (MMM). Statistical models that ingest historical sales and ad spend and output an estimate of which channels drove what. MMM works at scale for brands spending millions per month. It's nearly useless for a $1,000/month cafe budget. There's not enough data for the model to converge.
Third, data clean rooms. Shared environments where a platform (like Meta) and an advertiser can match data without exposing individuals. These work for enterprise. They are technically and contractually inaccessible to a salon in Liberty Village.
None of these solve the core problem for local brands and creators: there's no clean way to verify that a creator post drove a real, physical, in-store visit.
The shift: physical-first attribution
The fix isn't a new tracking pixel. It's a new attribution layer that starts in the physical world.
The logic is straightforward. Instead of trying to tie a digital impression to a digital conversion, tie a digital impression to a physical action that the brand can verify directly.
The physical action that works is a redemption. A creator distributes an offer (free coffee, 20% off, a freebie tied to a code). The consumer redeems it in-store. The redemption is the attribution event. It happens at the point of sale, where the brand has full visibility.
That single shift, from "did anyone click" to "did anyone walk in and redeem," sidesteps every broken layer of digital attribution. No cookies, no IDFA, no clean room. Just verified physical events tied to verified creators.
What this means for local brands
Three takeaways for any brand that does creator or local marketing:
1. Stop measuring creator campaigns with last-click logic. The signal is broken. You'll under-count creator-driven visits by 60% or more. 2. Use offer redemption as your attribution event, not website clicks. A redeemed coupon is verified data. A click is increasingly fiction. 3. Lean on platforms that give you physical-first verification. If your creator platform can't tell you exactly which creator drove which redemption, you're back to guessing.
What this means for creators
For creators, the upside is bigger than most realize.
Once attribution moves to verified physical events, follower count stops being the main pricing input. A creator with 2,000 hyper-local followers who drives 30 verified visits per campaign is suddenly worth more than a creator with 100,000 followers who drives 3 verified visits.
That re-pricing is just starting. The creators who get on verified-attribution platforms early will set the new market rate. The creators who don't will keep getting paid based on follower count, an increasingly broken metric.
Where Onlure fits
Onlure is one of the platforms building toward verified, physical-first creator attribution. If you're a brand or creator who wants in on that next wave, sign up free and we'll bring you along.