SKAN-5: Mobile Affiliate Attribution for Sportsbook Apps When IDFA Is Gone

If you run user acquisition or partnerships for a sportsbook, you’ve already felt it: IDFA-based, user-level attribution is effectively over on iOS. Opt-in rates are too low to sustain deterministic measurement at scale, and fingerprinting is off the table.

What replaces it is Apple’s privacy-preserving attribution stack—first SKAdNetwork 4, then the “SKAN-5 era” many of us anticipated, and now Apple’s formal successor: AdAttributionKit (AAK).

Practically speaking, the “SKAN-5 era” is the operating reality in which affiliates and operators must build growth engines that work without IDFA, using postbacks, conversion schemas, and server-side contracts instead of last-click cookies.

This playbook explains what actually changed, how attribution now works for sportsbook apps, what it means for operators and affiliates, and how affiliate software fits into the picture—specifically why Scaleo’s cookieless, S2S-first architecture is built for this environment.

From SKAN 4 to the “SKAN-5 era”: Apple’s pivot to AdAttributionKit

For years the industry expected SKAN 5 to introduce long-requested features like re-engagement and better web-to-app support. In 2024 Apple took a different route and introduced AdAttributionKit (AAK)—positioning it as the evolution of SKAdNetwork, interoperable with SKAN concepts while expanding capabilities such as web-to-app measurement and re-engagement in a privacy-safe way.

In other words: the features many tied to “SKAN-5” landed under AAK’s umbrella instead. Apple and ecosystem analyses describe AAK as a forward path that preserves SKAN’s privacy model but offers more flexible windows, richer eligibility, and broader surfaces for measurement.

By mid-2025 Apple announced further AAK upgrades—overlapping conversion windows, configurable attribution windows and cooldowns, geo-level postback signals, and better testing hooks—giving performance teams levers they simply didn’t have under SKAN 4’s rigid three-postback structure. For sportsbooks that live and die by event calendars and fast payback, those levers matter.

Takeaway: treat “SKAN-5” as shorthand for the post-IDFA, AAK-led world on iOS. Your planning should target AAK’s rules and timetables while remaining compatible with SKAN-style constraints.

How does attribution work now: the new primitives you must design around?

Attribution on iOS is now event-level opaque and cohort-level observable. Media touches (views/clicks) are signed and eligibility-checked; if privacy thresholds are met, Apple issues postbacks to ad networks and/or your chosen endpoint. Those postbacks contain campaign/source identifiers and a conversion value—a compact code you define—plus coarse context such as time windows or geo signals depending on the tier reached. There is no device ID for user-level joins.

Under AAK, the biggest shifts for sportsbooks are:

• Windows you can shape to the business. AAK’s overlapping and configurable windows mean you can align measurement with onboarding milestones (registration, KYC, first deposit, first bet) instead of contorting product flow around one rigid timer. You decide how long the clock runs before a postback locks, and how to cool down between touches to reduce channel collisions.
• Web-to-app and re-engagement support. AAK extends measurement into web-to-app flows that matter to affiliates who start users on content pages or odds comparators, and into re-engagement scenarios like returning bettors around a derby or tournament—long missing from SKAN’s install-only worldview.
• Privacy thresholds still rule. Just like SKAN, AAK only returns richer signals when enough volume exists to protect anonymity. That means your schemas and media plans must anticipate crowd anonymity effects: smaller geos, niche creatives, or narrow targeting can degrade granularity; broader cohorts preserve it.

For Android, Google’s Privacy Sandbox on Android follows a similar philosophy (no GAID for ads, event-level redaction, aggregate reporting).

Most iGaming growth teams now aim for a cross-platform, ID-free plan: AAK on iOS, Android Sandbox on Google, and server-to-server contracts in the affiliate channel to stitch business outcomes into a single source of truth.

What this means for sportsbook operators

First, you must stop thinking in users and start thinking in schemas. Instead of tying a deposit to a device ID and calling it a day, you encode key milestones into conversion values that roll up into postbacks.

A sensible sportsbook schema prioritizes “money moments”: verified registration, KYC pass, first deposit, first settled bet, net-revenue brackets. Your goal is to approximate predictive LTV within the conversion space AAK allows, so media teams can bid and affiliates can be paid on quality, not noise.

Second, you’ll need server-side truth. Postbacks tell you a channel delivered a cohort of valuable users; your CRM and ledger tell you revenue and fraud status. The operator’s job is to reconcile those truths without user-level joins.

That’s why payout rules must move from “user-level last click” to contracted, windowed validation: if an affiliate’s campaign delivered postbacks with high-value codes within X days, and your books show eligible revenue in that cohort, the affiliate is owed under a CPA/Hybrid agreement. Put differently: you reward verifiable outcomes under privacy constraints, not raw installs.

Third, accept that creative and geography now affect data quality, not just performance. Narrow, high-variance flights can push your cohorts below privacy thresholds and downgrade signal. Wider campaigns, consistent creatives, and enough daily volume per source keep the lights on for measurement.

What this means for affiliates

Affiliates can still win big in the SKAN-5/AAK world, but the job changes. Traditional last-click assumptions give way to contract-based proof of influence. You’ll encode sub-IDs into links that survive the journey into the app, map those sub-IDs to AAK source identifiers or campaign slots, and earn on validated postbacks plus server-side conversion evidence instead of device joins.

Web-to-app matters more than ever. iOS’s AAK recognizes compliant web-to-app flows, so affiliates who publish long-form previews, odds explainers, or accumulator calculators can claim credit when a reader lands in the App Store and then converts in-app—so long as your operator partner’s stack preserves that mapping and your software can ingest the postbacks.

Re-engagement also reopens playbooks around tentpole events. If AAK declares eligibility for a returning conversion, affiliates who specialize in “come back and place your first bet of the season” promotions can participate with compensation structures that reward reactivation, not only acquisition.

Finally, understand the compliance line. Fingerprinting and dark joins are not options. Affiliates who cling to them will lose accounts. Those who embrace privacy-safe contracts, clean parameters, and server-side validation will gain preferred status with regulated operators.

Where affiliate software fits—and why Scaleo is purpose-built

In a world without IDFA, affiliate software isn’t just a tracker; it’s the contract engine that binds media proof (postbacks) to finance proof (qualified revenue) and turns that into transparent payouts. The platform must be cookieless, API-first, and flexible enough to express operator-specific validation logic.

Scaleo’s architecture was designed for this exact future:

• It’s cookieless and server-to-server by default, so every credit is grounded in signed signals and first-party events rather than browser storage that iOS will ignore.
• It ingests AAK/SKAN-style postbacks and lets operators map source identifiers and campaign hierarchies to affiliate offers and sub-IDs. That mapping is versioned, so schema changes don’t break historicals.
• It offers configurable conversion schemas aligned with sportsbook onboarding: you can define what each conversion code means (e.g., KYC pass, FTD, first settled bet, revenue band) and tie payout rules to those codes and time horizons rather than to brittle user-level logs.
• It provides validation windows and hold logic that mirror AAK’s attribution windows and cooldowns. You can hold a cohort until risk checks clear, auto-exclude sanctioned geos, and only release payment when ledger events confirm value.
• It includes real-time fraud defenses—IP/device anomaly scoring, click flooding detection, velocity checks—so affiliates aren’t penalized for operator spam, and operators aren’t paying for synthetic traffic. When volume is high enough, Scaleo reconciles aggregate postbacks with aggregate revenue to detect abnormal effective CPAs that indicate abuse.
• It normalizes cross-platform attribution. On iOS you’ll work with AAK postbacks; on Android you’ll work with Privacy Sandbox reports. Scaleo rolls both into unified cohorts so finance sees one truth while respecting each platform’s privacy model.

The net effect is simple: affiliates get timely, transparent credit for the influence they can prove; operators get to pay for verified value without user-level joins; compliance teams sleep at night.

Designing a sportsbook-ready conversion schema

Sports betting funnel value is highly skewed: a registered user who never KYC’s is worth little; a user who deposits $50 but never places a settled bet is worth more, but not much; a user who deposits repeatedly and places settled bets during major seasons is worth a lot. Your schema should reflect that shape.

In practice, you’ll define tiers that encode “milestones plus intent.” Early codes might represent registration + KYC within a short window. Mid codes represent first deposit thresholds and first settled bet. Upper codes represent revenue bands or net-revenue proxies observed within a longer window. Under AAK’s expanded controls, you can stage overlapping windows so the first postback reflects onboarding success and a later postback reflects actual betting behavior.

Media then optimizes against the first signal; affiliates earn blended payouts weighted by the second.

Because privacy thresholds determine the granularity Apple returns, keep your schema simple enough to populate. Ten crisp, business-meaningful codes beat a sprawling plan that collapses to coarse values. As seasons change, revisit codes to ensure the windows still capture reality (e.g., during a major tournament you may want shorter windows to reflect faster payback).

Web-to-app without IDFA

Affiliates often begin the journey on the open web.

In AAK, compliant web-to-app flows are measurable when the click carries Apple’s required parameters and the landing path honors Apple’s privacy rules.

For sportsbooks, this means your promotional pages and odds tools can lawfully hand off to the App Store while preserving campaign/source context that returns later in a postback.

Your affiliate platform must accept those postbacks, match them to the record of the click via the source identifier hierarchy, and then evaluate business outcomes server-side. Scaleo maintains that linkage without cookies or device IDs, relying instead on signed touch data and first-party events.

Re-engagement and the sports calendar

Betting is cyclical. AAK’s introduction of re-engagement eligibility finally acknowledges the reality that ads often prompt a return, not a fresh install. For operators, this is an opportunity to create reactivation bounties tied to events—opening day, playoffs, derbies—paid on postback evidence that a lapsed user returned and hit a schema code like “first settled bet this season.”

For affiliates, event-led content regains direct commercial value. Because AAK allows configurable cooldowns, you can reduce double-credit when the same user sees multiple touches during a heated sports week. Scaleo expresses those guardrails in its payout rules so finance doesn’t fight channel cannibalization after the fact.

Fraud, compliance, and gray-market gravity

Regulated iGaming can’t afford wishful attribution.

Fingerprinting is a policy and platform risk, and low-volume sub-campaigns that never clear privacy thresholds won’t produce usable signals. The answer is not to bypass the rules; it’s to design into them.

Broader cohorts, sufficient daily volume per source, and consistent creative taxonomies keep your anonymity tier healthy.

Server-side KYC, AML checks, and settlement verification keep payouts honest. Scaleo’s fraud graph and anomaly alerts complement AAK’s protections by surfacing campaigns whose effective CPAs drift sharply from expected ranges—often a sign of click inflation or incentive abuse.

Android: don’t build iOS in a vacuum

On Android, Privacy Sandbox Attribution Reporting plays a role similar to AAK: no GAID joins, event redaction, and aggregate summary reports. Sportsbooks that build a coherent cohort playbook—schemas that rhyme across iOS and Android, even if fields differ—see faster optimization and cleaner finance. Scaleo treats AAK postbacks and Android Sandbox reports as siblings in one ledger so partners and finance don’t live in two attribution universes.

Conclusion

As the world of iOS user acquisition and attribution for sportsbooks changes, sportsbooks are relying less on IDFA because opt-in rates are low and fingerprinting is no longer an option. Apple’s release of AdAttributionKit (AAK) is a big change. It moves from SKAdNetwork (SKAN) 4 to a new framework that enables privacy-preserving measurement, including web-to-app conversions and opportunities to re-engage users. With AAK’s customizable, overlapping attribution frames, sportsbooks can align measurement with business goals, which is better than the strict framework of SKAN 4. Attribution now works at the event level without device IDs, analyzing user groups rather than individual users.

Operators need to change by creating robust conversion schemas for high-value actions, eliminating user-level tracking, and adding server-side validation to ensure everything works and complies with privacy rules. Affiliates need to use contracts and encoded identifiers to demonstrate their influence, especially for web-to-app interactions and re-engagement campaigns.

Scaleo’s infrastructure is built to fit this new reality. It focuses on server-to-server communication without cookies and ensures AAK is followed while ensuring everything works together across platforms. In an advertising environment that values privacy, all stakeholders need to accept these changes to keep growing and improve performance.

What to do next?

Shift the team’s mindset from user-level precision to cohort-level confidence. Define a sportsbook-specific conversion schema that mirrors the money moments you care about. Ensure your web-to-app paths are AAK-compliant so affiliates can keep starting the journey on content. Map AAK source hierarchies to affiliate sub-IDs in your tracking. Move your contracts to windowed, schema-based payouts with fraud and cooldown controls that reflect Apple’s rules. And centralize it all in software that was built for this world—not retrofitted.

That’s exactly what Scaleo delivers: cookieless, S2S attribution; AAK/SKAN postback ingestion; schema-aware payout rules; Android Sandbox normalization; and fraud controls that respect privacy while protecting your P&L. In the SKAN-5 era—AAK by another name—that’s how sportsbook operators and affiliates keep growing without IDFA.