Deferred matching, and how well it works

Two completely different cases

When somebody who already has your app taps a link, iOS hands your app the address. We look it up and tell you which link it was. There is no guessing involved and the confidence is exactly 1. This is most of your traffic and it is not what this page is about.

When somebody who does not have your app taps a link, they go to the App Store, install, and open it — and iOS tells your freshly installed app nothing whatsoever about what brought them there. Apple provides no mechanism for this on iOS. Nobody has one.

So what everybody does instead, including us, is match on coarse signals: we wrote down a few blunt facts at the moment of the click, your app reports the same facts at first launch, and we look for a click inside the last 60 minutes that fits.

What we compare

A salted hash of the network address, the platform, the major OS version (“17”, never “17.4.1”), a device class (“phone”, never a model), the primary language (“en”, never “en-GB”), the timezone offset, and a screen size bucket.

Every one of those is shared by millions of people, deliberately. Anything sharp enough to identify one device would be a device identifier by another name, and we do not build those — what we collect is the complete list.

The rule we follow when we are unsure

A false match is worse than no match. A wrong attribution pays the wrong affiliate and, worse, teaches you that none of our numbers can be trusted. So:

• we require the network to agree. A click from one address and an install from another is never matched, even if everything else fits;
• we require corroboration beyond that. The network alone is not enough;
• when two different links fit equally well, we attribute neither and tell you it was ambiguous. Picking the higher score would be a coin toss reported as a fact.

The measured numbers

Against four thousand simulated journeys, built to be harder than reality — everybody on one of five networks, half the decoy clicks on identical hardware:

Read the second row before you build a commission programme. If your affiliates or your customers share one office network — a conference, a call centre, a university hall, a single company — then roughly one attribution in five may be wrong, and no amount of engineering on our side can fix it. When two people on one network have the same phone on the same OS in the same language, there is nothing in the data that distinguishes the person who tapped from the person sitting next to them.

That is the ceiling of the method rather than a defect in our implementation, and it is true of every product that does this. We would rather say so here than have you discover it from a disputed invoice.

The match rate is also the number to read carefully in the other direction: about six deferred installs in ten are never attributed at all and are reported as unattributed. They are usually people who tapped on wifi and opened the app on cellular. We could match many of them by relaxing the network requirement, and the false positive rate would rise sharply. We have chosen not to.

What the confidence score means

Most attribution products give you a number. This one gives you the number and the confidence behind it, because the two together are worth something and the number alone is not. Every attribution carries one, and your report shows the distribution.

• 1.0 — certain. The app was opened by the link. No inference.
• 0.75 to 0.80 — high. Matched after the install, with every signal we can compare in agreement. 0.80 is the ceiling for a deferred match: two of the eight things we score — your timezone and your screen size — are not in an HTTP request, so a click can never earn them.
• 0.65 to 0.75 — medium. Matched, with less corroboration.
• Below 0.65. Not attributed, and not reported as an install at all. You will never see this band with a number beside it; it is described here so you know where the line is.

If a third of your attributions are medium, you should know that, which is why the distribution is on the report rather than behind it.

Turning it off

Probabilistic matching can be switched off per app, in the app’s settings. With it off, an install is attributed only when the app was opened by one of our links, every attribution has confidence 1, and everything else is reported as unattributed. Some customers’ own privacy positions require this, and some would simply rather have fewer, certain numbers.

Android does not guess

Everything above describes iOS. Google provides the Play Install Referrer, which tells a freshly installed app exactly which link produced it, so on Android there is no inference and no confidence score below 1 — the numbers on this page do not apply.

That does not make Android’s match rate 100%. It moves the uncertainty somewhere we cannot measure: whether the referrer reaches the app at all. The Android page sets out what is measured and what is not, rather than putting one number beside the other as though they were comparable.

Next: when it does not work.