Cross-Device Attribution: Tracking Users Across Devices

Users do not live on a single device. A user might see your ad on their phone during their commute, research your product on their laptop at work, and finally convert on their tablet at home. Without cross-device attribution, each device looks like a separate user, and the conversion appears organic on the tablet while the phone ad and laptop visit get no credit.

This guide covers how cross-device attribution works. For web-to-app attribution, see web-to-app attribution: bridging the gap. For fingerprinting methods, see fingerprinting vs deterministic matching.

The Cross-Device Problem

Why It Matters

Consider a typical user journey for a fintech app:

1. Phone (Day 1): Sees a Facebook ad for a savings account with 4.5% APY. Does not tap.
2. Laptop (Day 2): Searches for "high yield savings account," finds the company's website, reads about features.
3. Phone (Day 3): Sees a retargeting ad. Taps it. Installs the app. Opens an account.

Without cross-device attribution:

• The Facebook ad gets no credit (the install happened on a different session).
• The website visit appears as a separate user.
• The retargeting ad gets full credit for the install.

With cross-device attribution:

• All three touchpoints are linked to the same user.
• The Facebook ad gets credit for awareness.
• The website visit gets credit for consideration.
• The retargeting ad gets credit for conversion.

Scale of the Problem

Users typically have 3-5 connected devices. Studies show that 60-70% of conversions involve more than one device. Ignoring cross-device journeys means misattributing the majority of conversions.

Deterministic Cross-Device Matching

Deterministic matching links devices by a known identifier, typically a logged-in user account.

How It Works

When a user logs in on multiple devices with the same account (email, phone number, user ID), those devices are linked:

Phone: login([email protected]) → Device A
Laptop: login([email protected]) → Device B
Tablet: login([email protected]) → Device C

All three devices → same user graph

Strengths

• High accuracy. If the user logged in on both devices, the match is definitive.
• Privacy-friendly. Based on first-party data (your own user accounts).
• No guessing. No probabilistic models or assumptions.

Limitations

• Requires login. Only works for logged-in users. Pre-login touchpoints (ads, website visits before signup) cannot be matched.
• Limited graph. Only covers devices where the user has your app or has logged into your website.
• Shared devices. A family tablet shared by multiple users creates false matches.

Implementation

interface DeviceGraph {
  userId: string;
  devices: Device[];
}

function linkDevices(loginEvent: LoginEvent): void {
  const userId = loginEvent.userId;
  const deviceId = loginEvent.deviceId;
  const deviceType = loginEvent.deviceType; // phone, tablet, desktop

  // Add device to user's graph
  const graph = deviceGraphDB.getOrCreate(userId);
  graph.addDevice({
    id: deviceId,
    type: deviceType,
    firstSeen: loginEvent.timestamp,
    lastSeen: loginEvent.timestamp
  });

  // Retroactively attribute pre-login events on this device
  const unattributedEvents = eventDB.getUnattributed(deviceId);
  for (const event of unattributedEvents) {
    event.userId = userId;
    eventDB.update(event);
  }
}

Probabilistic Cross-Device Matching

Probabilistic matching uses statistical signals to infer that two devices belong to the same user, without a login-based identifier.

Signals Used

Signal	Reliability	Privacy Impact
IP address	Medium (shared networks create false matches)	Low
Location (GPS/Wi-Fi)	High (if precise)	High
Browser fingerprint	Medium (changes over time)	High
Usage patterns (app open times)	Low	Medium
Language/locale settings	Low	Low
ISP/carrier	Low	Low

How It Works

The system builds a probabilistic model that scores the likelihood two devices belong to the same user:

def calculate_match_probability(device_a, device_b):
    score = 0.0

    # Same IP address at the same time
    if share_ip_simultaneously(device_a, device_b):
        score += 0.4

    # Same Wi-Fi network
    if same_wifi_network(device_a, device_b):
        score += 0.3

    # Similar usage patterns (both active at similar times)
    time_correlation = calculate_time_correlation(device_a, device_b)
    score += time_correlation * 0.15

    # Same language and locale
    if device_a.locale == device_b.locale:
        score += 0.05

    # Same carrier/ISP
    if device_a.carrier == device_b.carrier:
        score += 0.05

    # Penalty for different geographies
    if not same_city(device_a, device_b):
        score -= 0.3

    return min(max(score, 0.0), 1.0)

Accuracy

Probabilistic matching typically achieves 60-80% accuracy. This means 20-40% of matches are wrong (false positives linking different users) or missed (false negatives failing to link the same user).

Privacy Concerns

Probabilistic cross-device tracking is under increasing regulatory scrutiny:

• GDPR: Probabilistic matching that creates a profile of users across devices likely constitutes profiling under GDPR and requires consent.
• ATT: Apple considers cross-device linking as "tracking" and requires ATT consent on iOS.
• Browser restrictions: Safari, Firefox, and Chrome are blocking or restricting the fingerprinting signals that probabilistic matching relies on.

Platform-Provided Solutions

Google Signals

Google Signals uses logged-in Google account data to link devices. When a user is signed into their Google account on multiple devices, Google can provide cross-device attribution within Google Analytics and Google Ads.

Apple's SKAdNetwork

SKAdNetwork does not support cross-device attribution. Each install is attributed independently on the device where it occurred.

Privacy Sandbox (Android)

Google's Privacy Sandbox does not include a cross-device attribution API. Attribution is per-device.

Deep Links for Cross-Device Journeys

Deep links can bridge cross-device journeys by carrying context:

Email as a Cross-Device Bridge

A user browses products on their laptop, adds items to a wishlist, and receives a deep-linked email. When they tap the email on their phone, the deep link opens the app to their wishlist:

https://links.app.com/wishlist?user_ref=encrypted_user_id

The email serves as a deterministic cross-device bridge because it is sent to a known user who opens it on a different device.

QR Codes

A QR code on a desktop screen opens the app on the user's phone:

https://links.app.com/checkout/CART-123?source=desktop_qr

The QR code links the desktop session to the mobile install/open.

SMS/Push to App

After a web session, send an SMS with a deep link to continue in the app:

Continue in the app: links.app.com/continue?session=abc123

Measurement Without Cross-Device Tracking

If cross-device tracking is not feasible (privacy constraints, insufficient login rates), you can still estimate cross-device impact:

Survey-Based Attribution

Ask new users how they first heard about the app:

• "Where did you first learn about us?" (options: social media ad, web search, friend recommendation, etc.)

Marketing Mix Modeling (MMM)

Use aggregate data (total ad spend, total installs) to model the relationship between marketing activities and conversions without user-level tracking. See media mix modeling for apps for details.

Incrementality Testing

Run controlled experiments (geographic holdouts or randomized treatment/control) to measure the true impact of campaigns across all devices.

Tolinku for Cross-Device Attribution

Tolinku's analytics track deep link clicks with attribution parameters that persist across devices. When a user clicks a Tolinku deep link on one device and converts on another (via email, QR code, or shared link), the attribution context is preserved. Configure cross-device tracking in the Tolinku dashboard.

For mobile attribution, see mobile attribution: a developer's guide. For web-to-app attribution, see web-to-app attribution: bridging the gap.