Post-iOS Attribution: A Practical Guide for Australian Ecommerce

Post-iOS attribution is the work of measuring which ads drive sales when Apple devices no longer hand over user-level tracking data by default. For an Australian ecommerce brand, the fix is not one tool. It is a stack: server-side events sent alongside your pixel, a sensible conversion-event priority list, aggregated reporting you learn to read, a blended view of revenue against ad spend, and a consent setup that holds up under the Privacy Act.

This guide walks through each layer in the order we would build it, and where brands most often misread their numbers.

TL;DR

• Since Apple’s App Tracking Transparency (ATT) arrived, platforms see fewer iOS conversions. Low reported numbers do not automatically mean weak campaigns.
• For websites, run the browser pixel and server-side Conversions API together, with matching event IDs so nothing is counted twice.
• For apps, Apple’s SKAdNetwork delivers aggregated data, and low-volume campaigns often return limited or empty values. Plan for modelling, not exact counts.
• Judge performance on blended results (total revenue against total ad spend) as well as platform dashboards.
• Australian law does not ban tracking pixels, but consent and data minimisation now matter, especially for sensitive categories.

Table of Contents

• What actually changed after iOS 14.5
• Web versus app: two different problems
• Step 1: Send events from the server as well as the browser
• Step 2: Prioritise your conversion events for Aggregated Event Measurement
• Step 3: Understand SKAN if you run an app
• Step 4: Judge performance on blended numbers
• Step 5: Fix the data your ads learn from
• Privacy and consent in Australia
• Our perspective
• Working with Moor Marketing on measurement
• A 30-day plan to fix attribution
• FAQ
• Sources

What actually changed after iOS 14.5

When ATT arrived with iOS 14.5, apps had to ask permission before accessing the Identifier for Advertisers (IDFA). As Branch’s documentation on Meta’s Aggregated Event Measurement explains, users who decline leave advertisers without the device-level link between an ad click and a later purchase.

For an ecommerce store, three things followed:

1. Fewer conversions are visible. A sale that happened still happened, but the ad platform may not see it, or may see it late.
2. Optimisation gets weaker. Ad algorithms learn from conversion signals. Fewer signals means slower learning and less efficient delivery.
3. Dashboards disagree. Meta, Google, GA4 and your Shopify admin each count differently, so no two reports match.

The result is a common scene in our work: an owner sees a platform ROAS that looks poor, cuts spend, and revenue drops afterwards. The ads were working. The measurement was not.

Web versus app: two different problems

Most Australian ecommerce brands live mainly on the web, so start there. But the two environments behave differently, and mixing them up causes confusion.

If you only sell through a Shopify or WordPress store, the left column is your priority. If you also run an app, you need both.

Step 1: Send events from the server as well as the browser

A browser pixel depends on the visitor’s browser cooperating. Safari and iOS limit what it can store and send. A server-side connection sends the same purchase, add-to-cart and checkout events from your own infrastructure straight to the platform, so it is far less exposed to those limits.

The approach that works is running both together:

• The pixel still captures browsing behaviour and fires quickly.
• The server connection backs it up and recovers events the browser dropped.
• A shared event ID on each pair lets the platform keep one and discard the duplicate.

Deduplication is where most DIY setups go wrong. Without it, purchases are double counted and ROAS looks better than it is, which is just as damaging as under-reporting. We cover the sequence in detail in our guide to Facebook Conversions API setup with event ID deduplication. For Shopify stores specifically, there is a phased dual-tag rollout for server-side tracking that keeps the live store safe during the changeover.

If you want a refresher on how the browser side works first, read how pixel tracking works in digital ads.

A quick sanity check after setup

Once both streams are live, open Events Manager and look for three things: a healthy share of events marked as received from both browser and server, no spike in purchases that your Shopify orders do not support, and event match quality that is stable rather than collapsing. If purchases in Meta exceed orders in your store, deduplication is failing.

Step 2: Prioritise your conversion events for Aggregated Event Measurement

Meta’s Aggregated Event Measurement (AEM) is the protocol it uses for web conversions from people who opted out of tracking on iOS. According to Branch’s explanation of AEM, advertisers can configure up to eight conversion events per domain, and Meta reports only the highest-priority event when several happen in one session.

That last detail matters. A shopper who adds to cart and then buys, all in one visit, will be reported against whichever event you ranked higher. Rank them wrongly and your purchases vanish behind lesser events.

A sensible order for most stores is:

1. Purchase
2. Initiate checkout
3. Add payment info (if used)
4. Add to cart
5. View content
6. Lead or email signup (if you run list-building)

Revisit the list whenever you change the funnel, launch a new product line, or start collecting leads before sales. Priorities that made sense a year ago can quietly hide the event you now care about.

Step 3: Understand SKAN if you run an app

For apps, Apple’s SKAdNetwork (SKAN) is the privacy-preserving attribution channel. AppsFlyer’s SKAN guide notes that it works without the IDFA and without ATT consent. The trade-off is that it returns aggregated, signed postbacks rather than user-level records.

Apple introduced SKAdNetwork 4.0 in October 2022, and its newer framework, AdAttributionKit, is designed for measurement across multiple channels while still preserving privacy. Apple also documents how AdAttributionKit and SKAdNetwork work together, which matters while both are in use.

The null value trap

The most common misreading we see among scaling app brands is treating empty conversion values as failure. When a campaign’s volume is too low to meet Apple’s crowd anonymity thresholds, the postback carries limited or no fine-grained value. AppsFlyer’s guide to single source of truth reporting describes combining SKAN with other attribution signals to fill those gaps and avoid double counting.

Practical consequences:

• Do not judge a small test campaign on SKAN alone. Give it enough budget to clear thresholds, or judge it on blended results.
• Decide which post-install events your conversion value schema encodes before you launch, not after.
• Use one agreed reporting source so the media buyer and the finance team quote the same number.

Step 4: Judge performance on blended numbers

Platform attribution is now an estimate. That is not a reason to ignore it, but it is a reason to anchor decisions elsewhere. The simplest anchor is the blended view.

Blended ROAS = total store revenue in a period divided by total ad spend across all channels in the same period.

MER (marketing efficiency ratio) is the same idea by another name, and some teams track it against total marketing cost.

Here is a worked example with made-up round numbers, to show the logic only:

If you only watched the Meta column, you might cut spend in week 3 because 1.9 looks weak. The blended number shows the business stayed efficient. When spend rises and blended ROAS holds roughly steady, the ads are doing real work even though the platform undercounts.

Blended numbers have limits. They cannot tell you which campaign is best. For that you need:

• Consistent attribution settings. Pick a window and keep it, so week-to-week comparisons mean something.
• Post-purchase surveys. A single “How did you hear about us?” question at checkout often surfaces channels the platforms miss, such as podcasts, creators and word of mouth.
• Holdout and geo tests. Pause a channel in selected regions or audiences and watch what happens to total sales. It is slow and blunt, but it is the closest thing to proof.
• Discount code and UTM discipline. Clean, consistent UTM tagging on every link means your analytics can at least reconcile the click path.

Step 5: Fix the data your ads learn from

Attribution is not just reporting. The same events feed the bidding algorithm. If purchase signals are thin or wrong, delivery suffers, and stores often see symptoms like stalled spend or erratic results. If that sounds familiar, our three quick checks for Meta ads not spending is a good place to rule out the basics.

Creative also matters more as targeting signals thin out. When the platform can lean less on granular tracking, the ad itself does more of the audience-finding work. We explain why in how ad creative quality affects ROAS.

Privacy and consent in Australia

Better tracking has a legal side in Australia, and it is easy to get wrong.

The OAIC’s guidance on tracking pixels states that the Privacy Act does not prohibit tracking pixels, but organisations that deploy third-party pixels should do due diligence so they are used in a way that complies with the Act. The guidance has been in place since November 2024.

In June 2026 the Privacy Commissioner published findings from a tracking pixel investigation. The decision found that using pixels to track visitors to health-related websites, then targeting them with advertising on social media, amounts to collecting sensitive information. If you sell in health, wellbeing or any sensitive-service category, take that seriously and seek legal advice before running retargeting.

For most retail stores the practical steps are:

• Collect only the data your advertising purpose genuinely needs.
• Tell visitors what you collect, and offer a simple opt-out for direct marketing.
• Make sure your consent banner actually controls your tags rather than just displaying a notice.
• Keep a record of why each pixel and event exists, so you can explain your setup if asked.

Two of our guides cover the wiring: cookie consent in Australia, including how to audit your CMP so pixels stop firing without permission, and Consent Mode V2 for Australian ecommerce. Server-side tracking does not remove consent obligations. Moving data collection to the server changes where it happens, not whether you need a lawful basis for it.

Our perspective

We see the same pattern with brands that come to us after a rough quarter. The ads are not the main problem. The measurement is, and the decisions made from it.

Our view is that attribution should be treated as a business decision framework, not a technical project. Before touching any tags, we ask what the owner needs to decide: whether to scale spend, which products to push, where to put the next dollar. Then we build the minimum tracking that supports those decisions, and we agree on the one number everyone will use.

A few things we hold firmly:

• Never optimise on a single dashboard. Every platform grades its own homework. We compare it against store revenue.
• Consent first, then clever tracking. A setup that cannot withstand a privacy review is a liability on the balance sheet, especially for brands planning an exit.
• Senior people on the data. Interpreting aggregated, modelled numbers takes judgement. That is why we work directly with owners rather than handing the analysis to a junior team or outsourcing it.

The brands that scale cleanly in this environment are not the ones with the most tools. They are the ones who decide in advance what a good week looks like and measure against it consistently.

— Liza

Working with Moor Marketing on measurement

If you want a second pair of senior eyes on your tracking, we build the measurement foundation into our ecommerce work. Our Facebook advertising service pairs campaign management with the server-side setup described above, and our 12 Week DOUBLE Your Revenue Challenge is built for owners who want hands-on mentoring while they scale. For a wider plan that ties revenue to your analytics, see our 90 day ecommerce digital strategy. You can also start from our main site and tell us where you are stuck.

A 30-day plan to fix attribution

If you want a sequence you can start on Monday, this is the order we would follow.

Week 1: Audit. List every pixel, tag and event on your site. Compare purchases in Shopify, GA4 and each ad platform for the last 30 days. Note the gaps. Check what your consent banner really blocks.

Week 2: Build. Set up server-side events for purchase, checkout and add to cart, with event IDs shared between browser and server. Rank your AEM events with purchase first.

Week 3: Standardise. Lock your attribution settings and UTM naming. Add a post-purchase survey. Set up a simple weekly sheet of spend, revenue, blended ROAS and new customer count.

Week 4: Test and decide. Check deduplication. Compare platform results against blended results. Choose one incrementality test, such as a regional pause, and schedule it for the following month.

After 30 days you will not have perfect data. You will have consistent data, which is what lets you make confident decisions.

FAQ

Is iOS attribution still broken in 2026?

It is not broken so much as permanently aggregated. ATT is still in place, and Apple’s SKAdNetwork and AdAttributionKit return summarised data rather than user-level records. Brands that combine server-side events, consistent settings and blended reporting get a workable picture, though never a perfect one.

Do I still need the Meta pixel if I use the Conversions API?

Yes, for most stores. The pixel and the server connection complement each other, and running both with matching event IDs gives the platform the most complete and deduplicated signal. Check that your purchase counts in Events Manager line up with real orders.

Why do my SKAN numbers look so low?

Usually because of volume. When a campaign is too small to meet Apple’s crowd anonymity thresholds, postbacks carry limited or no fine-grained values. Increase test budgets, simplify your conversion value schema, and use a modelled source of truth rather than concluding the campaign is failing.

Is server-side tracking legal in Australia?

The OAIC says the Privacy Act does not prohibit tracking pixels, and the same logic applies to server-side collection: what matters is purpose, transparency and consent. Sensitive information, such as health data, carries stricter expectations. If your business touches that area, speak to a privacy lawyer before you run retargeting.

Sources

• Meta Aggregated Event Measurement (Branch)
• SKAdNetwork (SKAN) solution guide (AppsFlyer)
• Single Source of Truth (SSOT) guide for iOS attribution (AppsFlyer)
• SKAdNetwork 4.0 now available (Apple Developer)
• Ad Attribution (Apple Developer)
• AdAttributionKit and SKAdNetwork interoperability (Apple Developer)
• Tracking pixels and privacy obligations (OAIC)
• Privacy Commissioner finds privacy breaches in third-party tracking pixel investigation (OAIC)

Recommended

• Ecommerce performance metrics: the 2026 guide for Australian stores
• Ecommerce retargeting strategy step by step (2026)
• Fix Match Rate, Prove ROI: Data Driven Ecommerce Marketing in 90 Days
• How referral programs work in ecommerce: 2026 guide