For many iOS app marketers, Apple Search Ads (ASA) is no longer an optional line item in their ad spend budget. Brands must bid on their own brand keywords or risk losing visibility in the App Store. Throw in Apple’s Store Kit ad network (SKAdNetwork), which severed the adtech industry’s near real-time feedback loop, leaving brands guessing, struggling to understand the relationship between their paid media and conversions, and you have the perfect catalyst forcing even more demand into ASA.

It’s the perfect storm, and it’s all thanks to Apple’s AppTrackingTransparency (ATT) framework and SKAdNetwork. Thankfully, you don’t have to  passively accept the new normal. To take control of your performance potential, consider implementing a strong test-and-learn strategy and partnering with a mobile measurement partner (MMP) like Kochava.

Let’s start by looking at a single advertiser. They’re a streaming entertainment brand we’ve all heard of that has been around much longer than I’ve been alive. This brand is likely front of mind for most users in the U.S. when they think of “Entertainment Media.”

Three years ago, this brand spent ~$2.4M monthly on iOS user acquisition (UA) for their main app. The spend was spread across 17 networks, and the UA team had a strong test-and-learn strategy. The networks at the time included DSPs (e.g., Aarki, Liftoff, ironSource, Molocco), self-attributing networks (SANs) (e.g., Facebook/Instagram, Google, Snap, TikTok, etc.). At the time, ASA was 13th on the list, with a monthly spend of ~$44k.

Fast forward to the present (Q1 2023) – the brand now runs on two networks:

• ASA $830k
• Owned media (via Smartlinks)

As you can see, their growth has greatly flattened.

This is a sad new reality for most brands: 38% of iOS install attributions are now awarded to ASA. And when we break down the keywords tied to that spend, 95% are against their own brand’s term.

What is being purchased with ASA? A light blue ad with white text that the user likely doesn’t even know is a paid placement? It’s reasonable to assume that most users were looking for the brand they knew but were snared by ASA. If you don’t bid against your own brand, your competitors will.

Here’s the broader view of how media attribution has been redistributed over the past two years in the iOS advertising ecosystem.

What the heck happened? The ATT framework and SKAdNetwork happened. ATT enforcement hit at the end of April 2021, and by May, most devices were capable of carrying the ATT prompt. SKAdNetwork started to see wide adoption in the summer of ’21.

Let’s take a beat for a history lesson on direct response mobile marketing.

Within the mobile marketing ecosystem, an MMP provides the ability to track the relationship between an advertiser’s conversions and their paid media. In the case of Kochava, the advertiser implements our software development kit (SDK) into the app, and to the extent the advertiser wants to track conversions, they implement those conversions to be read by our SDK. These conversions could be installs, post-install registrations, paid sign-ups, purchases, etc. 

The advertiser (brand) comes into the MMP platform and creates campaigns to be trafficked by the ad networks. Links are used when ads are served, and different links are used when users click on or interact with the ads. Additionally, Kochava has control servers located all over the planet, allowing us to read an ad signal in real time. Our SDK can also read the conversions that advertisers wish to tie back to media (installs, registrations, purchases, etc.) in real time. Depending upon the advertiser’s attribution waterfall logic (which is fully customizable with Kochava), we answer the question of what the ads did relative to the target conversion(s), and we can syndicate that answer anywhere on the planet within 120ms. Then came SKAdNetwork.

If you’re interested in the detail of how SKAdNetwork works, I’ll refer you to this page, which has a wealth of resources on the topic.  

In summary, the 120ms feedback loop that the mobile adtech industry relied on was severed; iOS campaign results via SKAdNetwork are mostly NULL (more on that later), but even when visibility occurs, it’s delayed and aggregated. So whereas the programmatic engine of a brand’s mobile advertising was making decisions in near real time, with SKAdNetwork they now have to wait days to get a partial answer at best.

Bottom line: Unless consent is captured via Apple’s ATT framework on both the publisher and advertiser apps, the only way to describe the relationship between your paid media and iOS conversions is through SKAdNetwork.  

Ostensibly, ATT and SKAdNetwork are focused on consumer privacy and removing the ability to triangulate persistent identification of individual records using metadata like timestamps and device identifiers without the end users’ consent. All of the ad data required for attribution is sent directly to Apple servers from the OS (no middleware), such that no massive customer leakage can occur and it severs the measurement-targeting feedback loop marketers were used to.

Do consumers feel better about it? Probably, for those paying attention. But we have not seen a migration from Android to Apple. The world is still roughly 27% iOS / 73% Android, with a heavier skew in the US at 56% iOS users. This hasn’t materially changed since ATT and SKAdNetwork 2.0 were announced in June of ’20 at Apple’s Worldwide Developer Conference.   

So, SKAdNetwork has created a lot of challenges for marketers. It’s opaque. It’s slow. And it’s so generalized as to be meaningless for performance insights in most cases, particularly SKAd 2.0 and below (which is sadly where most publishers are still stuck in terms of their adoption).

But the solution for many brands is obvious: Run on ASA! It’s real time, it’s deterministic, and it doesn’t live within the confines of SKAdNetwork’s rules. Whether any of us actually believes that ASA deserves 40% of the media funnel is a topic for another discussion. 

My first recommendation is to perform a test – pulse your ASA campaigns and see what happens. A two-week pause should do it in most cases. As you stopped spending on ASA, did you see your overall conversions decrease? You might. You might not.

But let’s say you do see a bump – meaning what you spent can be seen to have driven installs. What then? You need a way to understand the incrementality behind your spend; conversions tied to ad spend should increase or decrease reasonably as the spend moves. We can help marketers observe these fluctuations with our new Always-On Incremental Measurement (AIM) product. 

AIM sits above the direct response attribution data marketers are accustomed to, applying media mix modeling and AI atop custom models built using two main aggregate inputs:

– Network cost/day/region/app

– Conversions by day/region/app

With always-on incremental insights, you can decrease unwarranted cannibalization, reducing your costs without starving genuine and incremental growth.

ASA is good for ‘closing the deal,’ and as long as it sits with unique advantages over other paid channels on iOS, we may as well all play along in trying to conquest competitors’ brands.

(Not to date myself, but I used to send cease & desist orders to other brands that were bidding on my brand’s keywords in Google search. It worked most of the time. The reason being twofold; it’s my brand, not theirs, and they could do undue harm depending on the offer; and overall channel confusion. Of the 14 times we sent a letter, it worked 12. Note, this was typically around the descriptions in the marketing language of the keyword – which doesn’t really apply in Apple’s case.)

There are some real wins to be had, particularly in the generic and conquesting spaces. Understanding the quality of the performance tied back to the keyword is critical. It’s no big surprise that users searching your company name likely have a higher take rate in the app. After all, they ‘raised their hand’ to be part of the brand and got snared by a search ad, but they self-qualified, and it’s expected they would be a better long-term customer (i.e. higher quality). On the other hand, we see the quality really drop off below the brand terms – with a couple of exceptions in the conquesting space. This is where the opportunity lies, and it’s why Kochava built Search Ads Maven.

Search Ads Maven is an ASA campaign management platform that uses data connectors with Apple, app store optimization and keyword intelligence, and MMPs to automate your keyword bidding optimization based on install performance and lower funnel key performance indicators that are deterministic signals.

This is possible because ASA doesn’t live under the boot of SKAdNetwork. As such, you can do some VERY interesting things with it. For instance, the attribution is both real time and deterministic, plus the keyword code is actually written to the app binary on download and can be retrieved by the MMP. What does this mean?

It means there is a keyword tied to an actual device, thereby allowing post-install performance to be tied back to the keyword.

Quality in the keyword analysis table above refers to the number of installers who had a paid subscription within 7 days of installing. It becomes clear the ‘quality’ is much higher on the branded terms – these are the users who ‘raised their hand’ to the brand by searching for the actual company name (i.e., a brand effect, not a media effect). But there’s value to be won within the Generic and Conquest buckets as well, where we see significant variance in the quality of the customers. Not much can be done about winning more brand conversions, BUT building a solid, deterministic test-and-learn strategy within the non-brand terms is possible.

What no ASA marketer wants to see is an out-of-control keyword bidding war driving their ROAS into the red. With Search Ad Maven’s Automation Studio, marketers can customize rule logic based on a variety of triggers, including ROAS that takes into account in-app revenue or other custom goals based on post-install event data piped in from their MMP. Keyword bids can be paused when the winning bid cost drives ROAS into the “pit of despair,” as we like to call it, but then resumed again once positive ROAS territory is reached. Typically, this is something marketers only observe after the damage is done, but with Search Ads Maven, your positive ROAS can be maintained around the clock, 24/7/365.

The loss of row-level data doesn’t mean the end of accurate  performance insights

The adtech industry has been undergoing monumental changes in how it accesses, measures, and analyzes data. While there have been, and continue to be, disruptions in how advertisers receive campaign data, there are solutions to obtaining detailed insights through incrementality testing. Although traditionally cumbersome, modeled synthetic control groups enable accurate and more affordable lift measurement.

In today’s real-time attribution system, the question of causality, that is, did an ad cause a conversion, is left unanswered. Real-time attribution simply tells you the user was in the vicinity of the media served; lift measures the value of the media itself. The two are not interchangeable. 

To answer the question of impact means performing incrementality testing, which historically has been time-consuming and costly. With Kochava Foundry’s MediaLift_TM, however, we can perform incrementality testing using modeled synthetic control groups.

The benefits of using synthetic control groups

With traditional incrementality testing, an advertiser must withhold advertising from a holdout (a.k.a. control) group which is often 10% to 20% of the total addressable target audience. Withholding advertising to a portion of your audience is costly as you are potentially losing revenue from them. 

MediaLift avoids this by leveraging an innovative device scoring system within the Kochava Collective identity graph to build a modeled synthetic control group that mirrors the attributes and behaviors of the exposed group who received the ad. 

Device scoring also eliminates having bias creep in between the exposed and control groups, which is an inherent problem with traditional incrementality testing. When the control group is carved out before the campaign is run, the final test group that actually gets reached by the digital ad campaign often ends up looking a lot different than the control group.

Another costly aspect of traditional incrementality testing is the serving of public service announcements (PSAs). PSAs are often served to the control group as a way to compare their behavior against the exposed group’s. However, this practice is not even possible with some marketing channels such as with out-of-home (OOH) billboards. 

Because MediaLift’s synthetic control groups are based on devices that have exhibited similar behavior to the exposed group’s, no PSAs are needed to compare behavior between the two groups. This ability lends itself to channels where measurement has been based more on estimates, such as OOH and television. By applying the mobile data available in the Collective, advertisers can see how OOH and/or connected TV (CTV) campaigns influence their users on mobile.

• Minimized opportunity cost: no “holdback” groups who may have otherwise received ads (in the case of a pure holdout)
• No hard cost on having to spend media on a non-responsive group (in the case of PSAs)

MediaLift incrementality testing for OOH

Like many other industries in 2020, the out-of-home (OOH) industry took a hit, but it has been healthily rebounding in the past year. As the OOH industry recovers (with OOH still leading the way in comparison to digital OOH), the ability to measure it alongside mobile will help amplify your marketing strategy. The two channels no longer have to be siloed, and measurement will show their correlation.

Billboard publishers have been using MediaLift to prove the efficacy of their clients’ ad spend. To perform incrementality testing, the Kochava Foundry team defines a universe of known devices that were in the vicinity of the billboard display. This group represents the exposed group eligible for attribution.

Measuring true incrementality requires a commitment of time and resources, but advanced A/B testing can determine the effectiveness of campaigns without the same undertaking.

A UA manager runs a campaign for $50K that reached 500K consumers. Of those, 30K installed. Was the campaign successful? 

To answer that, you need to know how many people would have purchased in the absence of seeing the ad. This is what incrementality testing promises to answer, but to get it, marketers must endure an often complicated and expensive process. There are other, more affordable avenues that can also answer the question of how effective are your ad campaigns. 

The answer—like most things— is “maybe.” But oftentimes, attribution is confused with incrementality. Yet they are very different measurement approaches, and each seeks a different outcome.

Incrementality and lift

Incrementality has become a buzzword of late as marketers want to not simply measure campaign outcomes but determine whether their ads truly influenced conversions. The problem is, what they’re asking for may not be what’s most practical for them as a business. Performing an incrementality exercise requires a commitment of time and money, which also includes an opportunity cost.

What is true incrementality?

To measure incrementality (aka lift or causality), you need to measure the amount of consumers who would have converted (ie, purchased) regardless of whether they saw your ad.

One thing to clear up—performing an incrementality exercise is not the same as attribution. A click does not drive an install, as is commonly discussed in the ecosystem. Too often, we have equated a consumer interaction with an ad with direct correlation to an action (event), but correlation does not equal causality. There are many factors that drive an install, and we’ll never know all of them. 

Incrementality testing oftentimes involves segmenting an eligible audience from which you carve out a holdout or control group. This group is suppressed and receives no advertising. You then advertise to the other half and compare conversion rates. This is where incrementality testing starts to get tricky. 

From the group that received advertising, you can’t verify that everyone in that group saw the ad. Of those who saw the ad, you still won’t know if some in the group are brand loyalists and would have converted regardless of seeing the ad. Additionally, of those who received your ads, there is the likelihood of data bias since you are competing for the same pool of high quality consumers as other advertisers. Chances are, you will win more bids for lower quality consumers. Lastly, to measure lift, requires multiple tests, which is costly in addition to the opportunity cost lost from not advertising to the holdout group.

Let’s talk about PSAs and ghost ads 

When you perform an incrementality test with a holdout group, you can’t compare the outcome of an ad campaign fairly because they haven’t been served any ads. To create a fairer comparison, you can split the holdout group and serve public service announcements (PSAs) or ghost ads (flagged consumers who would have been served an ad) and then compare their behavior. Bids must be the same as the group you advertised to because you want this population to look like the ones who saw your ad. 

In spite of the efforts to create an apples-to-apples comparison between the two groups, the groups still look different because with PSAs there is no call to action (CTA). The PSAs act as a placeholder to see if what consumers do after they see a PSA is on par with what those in the advertised group do. However, the two segments won’t have had the same ad experience (as with a CTA). 

Possible comparisons

How likely is it that two populations will match?

Can you comply and thrive amidst emerging data regulations?

The news lately is full of data breaches, and those from major corporations—and the tech giants—have thrust consumer data privacy into the political arena. The impact of these breaches has brought about much awareness and scrutiny over the commercial use of personal data. With the advertising industry still grappling with the General Data Protection Regulation (GDPR) in the EU, more regulations, such as the California Consumer Privacy Act (CCPA), are impending stateside. These well-intentioned, but often contradictory policies have created the perfect storm for industries like digital advertising, who rely on data for business.

The tools Kochava uses to identify fraud are part of the Fraud Console, which is comprised of a comprehensive Global Fraud Blocklist and reports. The Global Fraud Blocklist consists of three components: network/site IDs, IP addresses and device IDs that have been flagged by our algorithms. It acts in real-time and dynamically updates as new fraudulent entities are identified across all Kochava traffic.

In addition, customers can add their own site IDs, IP addresses and device IDs directly from their account’s Fraud Console to curate their own account level blocklist. In this post, I’ll explain the different levels and views we use to mitigate fraud in real time and how to enable the Blocklist.

Blocklisted sites

Three separate criteria can land a network’s site ID on the Global Fraud Blocklist: MTTI outliers, ad stacking and invalid install receipts. Each entity must surpass an established threshold to be considered fraudulent. The threshold required to land a site ID, IP address or device ID on the Blocklist is much higher than what is used for reports in the Fraud Console which flag statistical anomalies for marketers to investigate.

MTTI Outliers: With mean-time-to-install (MTTI), our Fraud Console will highlight any outliers that are 2.5 standard deviations from the network mean time for a given app. However, for the Blocklist we are more stringent. For a specific site ID to be blocklisted, we look at a rolling timeframe where the behavior was observed against multiple apps and exceeded a volume floor on the minimum number of installs reported for the outlier site. We only blocklist an additional deviation from the norm. Preload and self-attributing networks (SANs) are excluded from our algorithms.

The criteria for blocklisting sites is as follows:

• Significant statistical outlier (more of an outlier than what’s reported in the Fraud Console)
• Behavior must be observed on multiple apps
• Rolling time window
• Minimum volume of 50+ installs

An earlier post I wrote explored MTTI fraud in detail.

Ad stacking: As with MTTI, we’re more stringent with the blocklist than what we report in the Fraud Console. We set a minimum click threshold for stacked clicks. Anything beyond that threshold is blocklisted. In my previous post, I discussed ad stacking in detail.

Invalid install receipt: For installs originating from the iTunes or the Google Play Store, we receive a receipt that an installation occurred. In the cases when the App Store returns a non-verified install receipt, we deem the install fraudulent as reported by the site. Again, we set a minimum on the number of unverified receipts to warrant blocklisting a site ID.

Blocklisted IP addresses

We flag instances of anonymized IP addresses including proxies, VPNs and TOR exit nodes. These are sites purposefully trying to mask their traffic source.

Bad actors take steps to obscure their true IP address using proxies or VPNs (Virtual Private Networks) to circumvent geolocation restrictions; both are used in botnet traffic.

TOR or “The Onion Router” is a process by which web traffic is routed through a byzantine maze of encrypted relays with the purpose of anonymizing traffic. A TOR exit node is the gateway where encrypted traffic hits the internet. Legitimate traffic sources should not mask the sources of their traffic.

Blocklisted device IDs

Device IDs are placed on the Global Fraud Blocklist if they have an exorbitant click volume. When adding a device to the Blocklist because of click volume, it must surpass a threshold of clicks within a 24-hour period.

Not all devices with high click volumes are automatically blocklisted. A device may be reported on an individual app’s fraud report from Kochava but not blocklisted. For more information, read my previous post about devices with high click volume.

Devices, where we’ve observed an invalid purchase receipt, are also added to the Global Fraud Blocklist. There are two primary methods for generating false receipts to spoof the verification from iTunes or the Google Play Store:

1. A hijacked device with malicious code on it pretends to be the App Store
2. “Man-in-the-middle” attacks where the malicious code sits between the device and the App Store

In both instances, a false receipt is generated and sent back to the device. The app accepts the receipt as a legitimate transaction, but there is no record of the transaction from the respective App Store.

Enabling the Global Fraud Blocklist

Marketers can begin using the Global Fraud Blocklist by contacting their Client Success Manager for the service. From that point on, marketers are in control of how they use the Blocklist.

There are two ways to enable the list:

1. Navigate to Fraud Console (under Account Options) select to apply the Blocklist to your entire account or to specific apps in the account
2. At the tracker level (under Campaign Manager and Traffic Verification), you can select to apply the list by IP, site, device ID or all three in addition to other criteria to verify the traffic delivered by networks

Marketers can also customize their Blocklist by adding their own list of fraudulent device IDs, site IDs and IP addresses they’ve encountered to the list in the Fraud Console.

With the Fraud Console, marketers have a powerful suite of preventative tools to eliminate fraudulent activity from their traffic. Because fraud is evident in most app traffic, employing the real-time Global Fraud Blocklist is a necessary step to protect ad spend and run effective campaigns with legitimate impressions, clicks, installs and post-install events.

In case you missed them, read also Parts 1, 2, 3 and 4 of the Fraud Abatement Series.

About the Author

Grant Simmons is the Director of Client Analytics at Kochava and leads the team in analyzing campaign performance and business value assessments. He is the former head of Retail Analytics at Oracle Data Cloud where he worked with over 1,500 retail directors, VPs, CMOs and agencies to develop individualized test-and-learn strategies.

For more information about the Kochava Fraud Console, Contact Us.

Ad stacking is a fraud technique where multiple ads are layered on top of each other in a single ad placement. While only the top ad is visible, if a user clicks on the visible ad, a click is registered for all ads in the stack.

Kochava is unique in the ecosystem because we see billions of ad impressions for a variety of ad campaigns across thousands of publishers, networks and exchanges, all in real time. Our fraud algorithms detect and report cases where multiple clicks are registered at the exact same date timestamp for a given ad placement. The following table and graph detail this behavior for a gaming app during the month of January:

When we look specifically at the site IDs, we see that there is one main offender (Site_OEP) with 698,000 ads that shared the same date timestamp, and there are 164,000 instances of stacking (at an average of 4.3 clicks for different apps per ad unit). Overall, there were relatively few installs (97).

What’s going on here?

There are several reasons fraudsters employ the ad stacking tactic:

• Click stuffing: Once the user clicks on the visible ad, the click is registered for all the ads stacked behind it. If the fraudster is strategic, they may stack ads for similar apps, meaning apps the user is likely to install in the future. If they can register a click for what the user may eventually install, they stand a chance of receiving attribution for it. This type of fraud focuses on scamming the marketer by gaming attribution.
• Impression stuffing: I wrote earlier about high click-to-install rates. If an impression is sent to a click endpoint, it is registered as a click even though a user never clicked. The scam is twofold: First, no actual click took place; and second, the scam sends multiple “clicks” en masse against multiple apps with the intent of 1.) Gaming attribution (scamming the marketer) and 2.) Delivering bogus impressions (scamming the network).
• Viewability fraud: In addition, if impressions are stacked, all the impressions stacked within the ad container may be reported as “viewed.” In this instance, fraudsters are scamming viewability metrics as well.

Prevent Ad Stacking with the Fraud Console

Luckily, ad stacking is a relatively easy fraudulent tactic to catch and is one of the fundamental fraud behaviors we surface in our Fraud Console. The Fraud Console surfaces 11 indicators of fraud. Any site ID, device ID, or IP address flagged in the advertiser’s Fraud Console can easily be added to their Account Blocklist to abate fraud in real-time.

In addition, sites that execute this tactic across multiple marketers are automatically added to the Global Fraud Blocklist. The list is dynamically updated with new entities added if they regularly participate in fraudulent activity. Networks and publishers may work to remove themselves from the list by demonstrating aggressive anti-fraud processes and solutions.

In my next post, we’ll explore the Global Fraud Blocklist and how to make it work for you.

In case you missed them, read also Parts 1, 2, 3 and 5 of the Fraud Abatement Series.

About the Author

Grant Simmons is the Director of Client Analytics at Kochava and leads the team in analyzing campaign performance and business value assessments. He is the former head of Retail Analytics at Oracle Data Cloud where he worked with over 1,500 retail directors, VPs, CMOs and agencies to develop individualized test-and-learn strategies.

For more information about the Kochava Fraud Console, Contact Us.