# Android attribution paths

What Android gives an app for attribution today and how to record it so failures stay visible. Facts checked against Google's live documentation on 2026-10-17. Android privacy policy has moved several times; verify status live before advising.

## Contents

- Google Play Install Referrer
- Passing a referrer from a Play Store link
- Stores other than Google Play
- The advertising ID
- How network claims work on Android
- Privacy Sandbox on Android: current status
- Google Ads app conversions
- Recording the result

## Google Play Install Referrer

- The Install Referrer API is exposed by the Google Play Store app (version 8.3.73 or later) and needs a Google Play Console account. Kotlin and Java apps use the Play Install Referrer Library.
- It returns the referrer URL of the installed package, the referrer click time and the install begin time (each client-side and server-side, in seconds), the app version at first install, and whether the user used the app's instant experience in the past 7 days.
- The data stays available for 90 days and does not change unless the app is reinstalled. Google says to call the API only once, on the first run after install, and to call `endConnection()` afterwards.
- Response codes include `OK`, `FEATURE_NOT_SUPPORTED` (API not available on this Play Store app) and `SERVICE_UNAVAILABLE` (connection failed). Other codes mean other errors.
- It is a single installation-source record from Google Play. It is not an aggregate postback, does not see other stores, and says nothing about ads the user saw without clicking.

Practitioner rules:

- Persist the first response, the response code and the read time. Re-read on a later launch only when the first attempt returned `SERVICE_UNAVAILABLE` or a connection error, and only inside the 90-day availability period.
- An install with no referrer because of an error is `referrer_unavailable`, not organic. Report the two separately.
- If an MMP SDK reads the referrer, do not read it a second time in app code. Take the value from the MMP's attribution callback or raw data.

## Passing a referrer from a Play Store link

- A Play Store listing URL takes `id` (package name), per Google's Linking to Google Play page. The Android Install Referrer pages say the API returns the referrer URL of the installed package; Google's Play Games PC Install Referrer page spells out the same pattern, where the `referrer` query parameter on the listing link comes back as the same string after install. Confirm the round trip on a test install. Example: `https://play.google.com/store/apps/details?id=com.example.app&referrer=utm_source%3Dexample_site%26utm_campaign%3Dspring_promo`.
- URL-encode the value. Keep it short and non-sensitive: anyone can read or alter it, so never put an email, token, coupon secret or user ID in it.
- This is the Android half of most web-to-app and referral flows. Treat the value as a claim to validate (known campaign values only), not as trusted input.

## Stores other than Google Play

- The Install Referrer API comes from the Google Play Store app, so installs from other Android stores need that store's own mechanism. Ask the MMP which stores it supports and how each is labelled, and keep `store` as a field on the install record.

## The advertising ID

- Apps targeting Android 13 or later must declare `com.google.android.gms.permission.AD_ID` to read the advertising ID. Some SDKs merge it into the manifest automatically; check the merged manifest, not only the source.
- Users can delete the advertising ID; after that, reads return a string of zeros. Users can also reset it.
- Rules: log an `ad_id_status` (present, zeros, permission missing) on first launch so a drop in match rates can be traced; do not fall back to a persistent device identifier for advertising.
- Google Play's policy page covers what the advertising ID may be combined with. Check the current wording there before approving any identity design that uses it.

## How network claims work on Android

- Self-attributing networks (the large social and search platforms) do not send click data for the MMP to match. The MMP passes them the install, and the network claims it if it matches its own ad engagement, typically on the advertising ID. Ask each network and the MMP which identifiers the match uses.
- When `ad_id_status` is zeros or permission missing, expect those networks' claimed installs to fall and organic to rise, with no change in real performance.
- Some networks offer their own install referrer for clicks inside their apps, which needs app and MMP configuration. Check per network whether one exists and whether the MMP has it configured; verify live.
- Rule: a jump in Android organic after an SDK or manifest change is a collection question first. Compare `ad_id_status` shares and Install Referrer response codes for the release where it started.

## Privacy Sandbox on Android: current status

- Google's AdMob documentation states that as of 17 October 2025 Privacy Sandbox on Android is deprecated.
- Google's announcement of the same date says it has decided to retire the Attribution Reporting API (Chrome and Android), SDK Runtime, Protected Audience, Topics and Protected App Signals, among others, and will follow Chrome and Android processes to phase them out. Feedback on attribution goes into a proposed interoperable attribution standard at the W3C Private Advertising Technology Working Group.
- Describe the status as deprecated, with retirement announced on 17 October 2025. Check the phase-out status live before saying an API no longer works.
- Consequences for a plan written today:
  - Do not schedule an Attribution Reporting API migration or present it as a coming requirement.
  - Android attribution still rests on Install Referrer, the advertising ID where permitted, network claims and the MMP's methods.
  - Watch for the W3C work and any new Android announcement. Search the Android developers blog and Google Play policy updates at run time, and record the date checked.

## Google Ads app conversions

- Google Ads can import app conversions from Google Analytics for Firebase, a third-party app analytics provider (an MMP) or, for Android, Google Play.
- Rule: pick one source per conversion action. Importing the same install or purchase from Firebase and from the MMP double counts in bidding.
- Since 15 April 2023, Google Play conversions cannot be used for installs or in-app purchases of Android apps intended only for children.

## Recording the result

Store these on the install record, in your own tables or the MMP export:

- `store` and `install_referrer_status` (the response code)
- `referrer_raw` (validated, length-limited) and parsed campaign fields
- `referrer_click_ts` and `install_begin_ts`, server-side values where available
- `attribution_method` (`install_referrer`, `mmp_click`, `network_claim`, `unknown`)
- `ad_id_status`
- `app_version` at first install