Routing Is Not Attribution

Two jobs, two answers

How tracking redirects break routes

Both platforms associate an app with a domain. Apple's association file lists the apps that may open URLs on that domain, and each subdomain needs its own entitlement entry and file. Android verifies the hosts named in the app's intent filters, each with its own assetlinks.json. The domain in the link the person taps is the one that counts. The two files are set side by side in assetlinks.json and apple-app-site-association compared.

A typical campaign link breaks this chain. The tap goes to a tracking domain, which records the click and redirects to your domain. If the tracking domain is not itself associated with your app, the tap was not on one of your app links. Whether the app opens after the redirect is then up to the browser, and neither Apple's nor Android's documentation promises that it will; their rules describe the link that is tapped. Treat the redirect as a likely break and test it on devices. The fix is to make the tapped link your own verified https address and record the campaign another way, for example with a short campaign parameter your page or app reads. The tap on that tracking link is step three of the search-to-app route.

What deferred links can and cannot do

A deferred deep link tries to remember the original destination through an install, so the app opens that screen on first launch. On Android, the Play Install Referrer returns "the referrer URL of the installed package," which an app can read on first launch. On iOS, AdAttributionKit reports conversions from ads shown in other apps at campaign level, not clicks from your own website, email or QR codes, with postbacks Apple signs that do not include user or device-specific data; it is designed for measurement, not for opening a screen for one person. Neither route is guaranteed, and in a market where the app is not offered the install branch never starts. Design for the case where the person continues on the web, as the guide on deep link fallbacks when the app is not installed recommends.

Keep parameters minimal

• Short campaign identifiers, mapped to campaigns on your server, rather than long tracking strings.
• No personal data or session tokens in the URL.
• No full destination URL as a parameter. The Open Worldwide Application Security Project (OWASP) advises mapping a "short name, ID or token" to a destination on the server.

The measurement tools themselves, and what each returns, are in the web-to-app measurement guide; parameter handling is covered in the deep link security guide.