Apple's Privacy Changes Killed Real Businesses. Here Is the Receipt.
Founder, BTB Audits. $150M+ in ad spend managed across Meta and Google
The Tadelis research is the strongest empirical case yet that ATT was not just a measurement disruption but a business-survival event. Coupled with the Haus 640-experiment data showing Meta's actual incremental impact is 15 percent higher than reported, the picture is clear: brands that under-invested in signal layer post-ATT did so on the basis of attribution that was lying to them, and many of them paid for that decision with the business itself.
What happened
What most operators will get wrong
The popular take on ATT, four years after the fact, is some version of: "Yeah, it was annoying, but we adapted. Everyone is fine now." Most operators have moved on. The frame is closed.
The Tadelis data reopens the frame.
ATT did not just change how we measure. It changed who survived. The brands that closed in 2022 and 2023, especially the smaller ones in iPhone-heavy verticals (apparel, beauty, supplements, lifestyle goods), did not close because they were bad at marketing. They closed because their ad systems suddenly had 30 to 50 percent less signal to optimize against, their costs went up, their ROAS visibility went down, and they could not figure out fast enough what to fix. The survivors were the ones who fixed the signal layer fast: CAPI integration, server-side event tracking, customer ID stitching across sessions.
This is the part most operators miss. ATT was a survival filter. The brands you remember from 2020 that are no longer around in 2026, many of them died from compounding signal-layer damage, not from "the market changed." The market changing was a downstream symptom of the signal change.
Why this matters now: the next privacy round is coming. Apple ships changes annually. Chrome's third-party cookie deprecation is ongoing. Regulatory shifts in California, the EU, and other jurisdictions add friction every year. The accounts I audit that have weak CAPI integration are running uphill against a known structural risk. The Tadelis data is the receipt that says that risk is real, measurable, and historically fatal for businesses that ignore it.
The wrong read of this data is "I survived ATT, I am safe from future rounds." The right read is "the brands that survived shared a specific trait: they invested in signal layer ahead of needing to. I should audit my signal layer now, not when the next round forces me to."
What you should actually do
Run this 3-step audit on your account this week. It is the same audit that separated survivors from non-survivors during the ATT transition, applied preemptively for the next round.
The full signal-layer audit lives at Stage 2 of the Meta ad audit method. The one-click Conversions API setup post covers the implementation in detail.
How this changes the audit method
The audit method does not gain a new stage from this data. The Tadelis findings are the historical evidence that already-existing Stage 2 (signal layer) matters more than most operators realize. What changes is how the auditor frames the conversation.
Before Tadelis, the case for CAPI integration was made on the basis of "you will see better ROAS reporting and modest performance improvement." That argument moved some accounts to action. Most others delayed indefinitely. CAPI integration was a "nice to have" with vague promised upside.
After Tadelis, the case is made on the basis of "businesses without your signal hygiene have measurably higher failure rates in privacy-disrupted markets, and Apple ships annual privacy changes." This is a different conversation. The action is no longer "install CAPI for incremental ROAS lift." It is "install CAPI as business-continuity hedge."
This is the only change to the Meta ad audit method. Stage 2 still comes second. The CAPI integration check is still the same check. What changes is that the auditor can now cite specific research showing what happened to brands that skipped this check during the last privacy round.
Signal layer mindset: before and after
| Aspect | Before | After |
|---|---|---|
| What the Conversions API does | Sends event data server-side. Improves reported ROAS accuracy by 5 to 15 percent. "Nice to have." | Same plus: serves as business-continuity hedge against future privacy disruption. Brands without it died at higher rates after the last round. |
| Who needs to prioritize CAPI | Brands with $50K+ monthly Meta spend, where the ROAS improvement justifies developer time. | Any brand with meaningful iPhone share. The smaller your business, the less cushion you have for a future ATT-style shock. Smaller brands need CAPI more, not less. |
| How operators think about future privacy changes | "Apple does something annoying every year. We adapt." | "Apple's 2021 change killed real businesses. Future changes are not less disruptive. Brands with signal hygiene survive better." |
| What the audit checks at Stage 2 | Is Pixel installed, are events firing correctly, is CAPI installed (yes or no). | Same plus: is CAPI deduplicating correctly (not just installed), and is the iPhone share of audience flagging this account as higher-risk for future privacy disruption. |
| What "survived ATT" means | Brand still exists. "We survived the transition." | Brand survived AND maintained signal hygiene. Brands without signal hygiene that survived 2021-2023 are still at higher risk for the next round. |
Frequently asked questions
Common questions
About the research
Who is Steve Tadelis and what is the study?
Steve Tadelis is a professor of economics and business at UC Berkeley's Haas School of Business, with a long-standing research focus on digital advertising effectiveness and platform economics. The study presented at the May 2026 Performance Marketing Summit was a partnership with Meta researchers analyzing hundreds of thousands of advertiser accounts and millions of campaigns spanning the pre-ATT (before April 2021) and post-ATT periods. The methodology used difference-in-differences analysis comparing iPhone-heavy industries (where ATT had bigger effects on signal availability) to less iPhone-heavy industries (where ATT had smaller effects).
Did Meta cherry-pick this research because it makes them look like the victim?
The research has Meta funding and Meta data, which is worth noting. Tadelis is a credentialed academic with a peer-reviewed publication record, which mitigates the conflict of interest concern. The directional finding (privacy disruption increased business failure rates in affected industries) is consistent with separate research from Columbia Business School, MIT Sloan, and other independent academic sources studying the same period. Treat the Tadelis study as one credible data point in a broader pattern, not as a definitive answer.
Does this apply to brands with mostly Android audiences?
Less directly. The Tadelis findings are about industries with iPhone-heavy target audiences specifically. If your customer base skews Android (under 40 percent iOS share), the ATT-specific damage was meaningfully smaller for your account. The general lesson about signal hygiene still applies, because Android privacy changes are coming and Chrome's third-party cookie deprecation affects everyone. But the historical impact and the urgency of the conversation are lower for Android-heavy brands.
What to do next
What does "CAPI mitigation" actually mean in practice?
When the Pixel sends an event from the browser (a user added something to cart, completed a purchase), iOS users with ATT enabled often block or limit the data Meta receives about that event. CAPI sends the same event from your server directly to Meta, bypassing the browser entirely. Meta's algorithm can then optimize against a more complete signal, which means better targeting decisions, better conversion attribution, and better delivery. Brands with CAPI got 50 to 70 percent of their pre-ATT signal coverage back. Brands without CAPI operated on the reduced post-ATT signal indefinitely.
If I have CAPI installed, am I protected from future privacy changes?
More protected, not fully protected. CAPI handles the specific issue of browser-side signal loss. Future privacy changes may affect different layers: cross-device matching, customer ID hashing, on-platform event tracking, regulatory data retention limits. The right posture is to maintain signal hygiene across all of these as they evolve, not just the CAPI layer. The brands that survived ATT well are the ones who treat signal as a continuous discipline rather than a one-time integration project.
What should I tell my CEO or board if they ask about ATT-style risk?
The honest version: "Apple's 2021 privacy changes measurably increased business failure rates in iPhone-heavy industries. Brands with Conversions API integration mitigated that risk. We have CAPI installed and verified working. Our iPhone share is X percent, which puts us in the moderate-risk cohort. The next privacy round is coming and we are positioned to weather it better than the median competitor." That framing acknowledges the risk honestly and positions your hygiene investment as the strategic response, not as a sunk cost.
The Tadelis research is the receipt for why signal-layer hygiene is business-survival work, not just a measurement upgrade. The 3-step check above tells you whether your account is positioned for the next privacy round the way the ATT survivors were. The work is small. The downside of skipping it is the thing that closed a lot of brands you used to know.
If you don't have four to six hours, or you want a second pair of eyes that's managed $150M+ across Meta and Google, the Free Quick Scan is what I built for that. I'll record a private 5 to 7 minute Loom walking through the leaks I find on your account using public data only. You'll have it in 48 hours.
Get Your Free Quick Scan →Keep reading on Meta signal and survival
Aditya Chaturvedi is the founder of BTB Audits. He has managed $150M+ in ad spend across Meta and Google for DTC, SaaS, and lead-gen brands ranging from $10K per month to $500K per month. Industry Updates from BTB Audits cover platform changes and what they actually mean for operators, not what the headlines say they mean. Read more on the BTB Audits blog.