What are Privacy Sandbox changes coming to Android? (2026)

14 min read | Updated May 2026

Google's Privacy Sandbox for Android is eliminating the Google Advertising ID (GAID) and replacing it with three privacy-preserving APIs. According to Google's official timeline, GAID deprecation begins in 2025 with full enforcement rolling through 2026.

If you run Android UA, this is the most consequential infrastructure change since Apple's ATT.

What is Google's Privacy Sandbox for Android and why does it matter?

Privacy Sandbox replaces Android's device-level ad identifier (GAID) with three APIs: Topics, Attribution Reporting, and Protected Audiences (formerly FLEDGE). According to Android developer documentation, these APIs restrict cross-app tracking while preserving aggregate-level measurement and interest-based targeting.

Key insight: Privacy Sandbox doesn't kill Android advertising. It replaces deterministic device tracking with aggregate, privacy-preserving signals.

• GAID deprecation rolls through 2025-2026
• Three APIs replace one device identifier
• Android holds ~72% global smartphone share
• Testing APIs available before GAID removal
• Google's approach is gradual, not a hard cutoff

The core shift: advertisers lose access to a persistent, cross-app user identifier. Instead, you get three separate systems handling targeting, remarketing, and measurement independently.

This matters because Android still represents roughly 72% of global smartphone market share according to Statista's 2024 data. Any change to Android's ad infrastructure affects the majority of mobile ad spend worldwide.

Unlike Apple's ATT, Google is building replacement APIs before removing the old identifier. That distinction is critical for planning. You can begin testing Privacy Sandbox APIs now while GAID still functions, giving you a transition period Apple never offered.

What are the three main Privacy Sandbox APIs for Android?

The three APIs are Topics API (interest-based targeting), Attribution Reporting API (conversion measurement), and Protected Audiences API (remarketing and custom audiences). Each replaces a specific function previously handled by the GAID.

Key insight: Each API handles one job: Topics for targeting, Attribution Reporting for measurement, Protected Audiences for remarketing.

• Topics: ~470 interest categories, 3-week lookback
• Attribution Reporting: event-level and aggregate reports
• Protected Audiences: on-device remarketing auctions
• Random noise injected into Topics for privacy
• All three APIs operate independently

The Topics API assigns users to broad interest categories (roughly 470 taxonomy topics per Google's developer docs) based on app usage. Advertisers receive a user's top topics from the past three weeks, with one random topic injected for noise.

The Attribution Reporting API provides two report types: event-level reports with limited conversion data and aggregate reports with richer data but added noise. This mirrors how SKAN and AdAttributionKit work on iOS.

The Protected Audiences API (formerly FLEDGE) runs on-device ad auctions for remarketing. Custom audience lists are stored locally on the device rather than on ad servers, preventing cross-app profile building.

What is the Privacy Sandbox for Android timeline in 2025-2026?

Google began beta testing Privacy Sandbox APIs in 2023 and expanded availability through 2024. According to Google's official roadmap, GAID restrictions began rolling out in late 2024 with broader enforcement expected through 2025-2026.

Key insight: Google's gradual rollout means you still have time to test, but waiting until GAID disappears is a strategic mistake.

• 2023: Beta testing began on Android 13+
• 2024: APIs reached general availability
• 2025: User opt-out controls expanding
• 2026: Full GAID deprecation expected
• UK CMA oversight may affect final timeline

Google has been deliberately vague about an exact "kill date" for GAID, unlike Apple's hard ATT enforcement on April 26, 2021. The phased approach gives developers time but also creates complacency.

Key milestones to track: Privacy Sandbox APIs reached general availability on Android 13+ devices in 2024. Google began offering opt-out controls to users in select markets. Full GAID deprecation timing depends on API maturity and regulatory feedback, particularly from the UK's CMA.

Practitioners who weathered ATT's impact on mobile advertising know that waiting for the enforcement date means scrambling. The smart move is treating 2025 as your integration year.

How does Android Privacy Sandbox compare to Apple's ATT?

ATT is a binary opt-in/opt-out prompt with roughly 25% opt-in rates according to AppsFlyer's ATT benchmark data. Privacy Sandbox takes a fundamentally different approach: instead of asking users to opt in to tracking, it replaces the tracking mechanism entirely with privacy-preserving alternatives.

Key insight: ATT asks permission. Privacy Sandbox removes the need for permission by replacing the identifier with aggregate APIs.

• ATT opt-in: ~25% of iOS users
• Privacy Sandbox: no binary prompt
• iOS CPIs rose 30-50% post-ATT
• Android transition expected to be less disruptive
• Both require aggregate measurement approaches

The philosophical difference matters. Apple gave users a prompt and let the market cope with 75%+ opt-out rates. Google is building functional replacements before removing GAID, which should preserve more advertiser utility.

However, don't assume Privacy Sandbox will be painless. The Attribution Reporting API still introduces noise, delays, and data limits that parallel SKAN's challenges. If you've already adapted your measurement framework for post-ATT iOS, many of those skills transfer directly.

One critical difference: Privacy Sandbox doesn't have an opt-in prompt that craters your addressable audience overnight. Targeting degrades gradually as GAID disappears, and the replacement APIs maintain some signal.

Need help scaling your mobile app growth? Talk to RocketShip HQ about how we apply these strategies for apps spending $50K+/month on UA.

According to Adjust's analysis, this means Android CPIs should remain more stable than the 30-50% CPI inflation iOS saw post-ATT.

How will Privacy Sandbox affect Android targeting and audience building?

The Topics API provides ~470 interest categories, which is dramatically coarser than the granular behavioral profiles GAID enables today. According to Google's Topics documentation, advertisers receive a user's top 3 topics per epoch (one week) with 5% random topic noise.

Key insight: Targeting shifts from "this exact user visited competitor apps" to "this user is interested in fitness" level granularity.

• Topics API: 3 interests per user per week
• 5% random noise injected per topic
• Remarketing audiences stored on-device only
• First-party data becomes critical differentiator
• Creative quality matters more as targeting coarsens

For prospecting, this means lookalike audience strategies as they exist today will change. You won't build audiences from device-level seed lists. Instead, contextual and interest-based targeting becomes the norm.

Protected Audiences handles remarketing differently. Custom audience lists live on the user's device, not on your ad server. Bidding logic executes locally. This preserves remarketing functionality but removes your ability to build rich server-side user profiles.

The practical impact: creative quality and first-party data become even more important when third-party targeting signals degrade. Apps with strong login-based first-party data will maintain an advantage, similar to what AppsFlyer's retargeting report found on iOS post-ATT.

How will Android measurement and attribution change under Privacy Sandbox?

The Attribution Reporting API provides two report types: event-level reports (limited to 3 conversion bits for click-through, 1 bit for view-through) and aggregate reports with richer data but differential privacy noise. Per Google's attribution docs, event-level reports are delayed a minimum of 2 days.

Key insight: Android's attribution model mirrors SKAN's constraints: limited conversion data, delayed reporting, and aggregate noise.

• Event-level: 3 conversion bits for clicks
• View-through: only 1 conversion bit
• Reports delayed minimum 2 days
• Aggregate reports include differential privacy noise
• Privacy budget caps data per source

If you've already built workflows to optimize campaigns with limited SKAN data, those frameworks apply. The core challenge is identical: how do you optimize bids when you can't see real-time, user-level conversion data?

The aggregate reports use a privacy budget system. Each source registration gets a capped contribution across all conversions, and noise is added before delivery. This means low-volume campaigns and smaller apps will struggle with statistical significance, exactly as they do with SKAN today.

RocketShip HQ's Weighted Anomaly Scoring approach helps here. Instead of reacting to every noisy data fluctuation, you weight metric changes by business impact: abs(% change) × sqrt(spend). A 15% ROAS drop on $5K/day spend scores higher than a 40% drop on $200/day spend.

This eliminates 70%+ of false alarms when working with noisy, aggregate data.

How should conversion value schemas be designed for Android?

Start with the lessons from iOS. According to SKAN 3.0 vs 4.0 comparisons, the most effective schemas map conversion bits to revenue milestones rather than individual events.

For the Attribution Reporting API's 3-bit event-level limit (8 possible values), prioritize: install, registration, trial start, first purchase, and subscription tier. Compress everything else into the aggregate reports.

The key mistake to avoid: trying to replicate your existing MMP event taxonomy within the constrained bit space. Focus on the signals that drive bidding decisions.

What should Android advertisers do right now to prepare for Privacy Sandbox?

Three immediate priorities: integrate the Privacy Sandbox SDK and begin testing on Android 13+ devices, audit your current GAID dependencies across all measurement partners, and build a measurement framework that doesn't rely on device IDs.

Key insight: The biggest risk isn't the technology change. It's waiting until GAID is gone to discover what breaks.

• Integrate Privacy Sandbox SDK on Android 13+
• Audit all GAID dependencies with your MMP
• Increase creative testing velocity now
• Build first-party data collection immediately
• Test aggregate measurement before GAID dies

Start with measurement. Talk to your MMP (AppsFlyer, Adjust, Singular, Kochava) about their Privacy Sandbox integration timelines. According to Singular's Privacy Sandbox analysis, early adopters who tested SKAN before ATT enforcement saw 20-30% faster performance recovery than those who waited.

Next, invest in creative testing infrastructure. When targeting becomes coarser, creative becomes your primary optimization lever. The wellness app case study that achieved 4x growth did so partly by testing 12+ creatives per month, which is exactly the muscle you need when audience precision degrades.

Finally, build your first-party data strategy. Encourage account creation, collect email and phone for server-side matching, and integrate with Privacy Sandbox preparation frameworks. Apps with rich first-party signals consistently outperform those reliant on platform-provided targeting.

Will Privacy Sandbox affect Android ad fraud detection?

Yes. Removing the GAID eliminates a key signal used for device-level fraud detection. According to AppsFlyer's fraud report, mobile ad fraud costs the industry an estimated $5.4 billion annually, and device-ID based detection is a major line of defense.

Key insight: Fraud detection must shift from device-fingerprinting to behavioral and aggregate anomaly detection.

• GAID removal weakens device-level fraud detection
• Click injection becomes harder to identify
• Behavioral anomaly detection grows in importance
• SDK Runtime isolates ad code from app data
• Integrate fraud monitoring into new measurement stack

Without a persistent device ID, click injection and device farms become harder to identify at the individual level. Fraud detection will rely more on aggregate behavioral patterns: abnormal click-to-install time distributions, geographic anomalies, and statistically impossible conversion patterns.

Google is aware of this gap. The Privacy Sandbox includes an SDK Runtime that isolates ad SDKs from app data, which reduces some surface area for SDK spoofing. But the overall fraud landscape will shift, and MMPs are already adapting their detection models.

Practically, this means your privacy-first attribution setup needs to include fraud monitoring from day one, not as an afterthought.

How will Privacy Sandbox impact Android CPI and campaign performance?

Industry consensus suggests Android CPI inflation will be more moderate than iOS post-ATT. Per Liftoff's analysis, the gradual rollout and replacement APIs should limit the disruption, whereas iOS gaming CPIs rose 30-50% in the 12 months following ATT according to Singular's SKAN benchmark data.

Key insight: Expect CPI pressure, but the gradual timeline and functional replacement APIs should cushion the blow compared to ATT.

• Android CPI impact likely less severe than iOS ATT
• Gaming and dating apps face largest CPI risk
• Google's first-party data gives its own ads an edge
• Diversify channel mix before GAID deprecation
• Establish pre-change baselines across all channels

The magnitude of the impact will vary by app category. Categories that relied heavily on precise behavioral targeting (gaming, dating, finance) will feel more pressure than those with strong contextual signals (weather, utilities).

One factor working in advertisers' favor: Google is the largest Android ad platform. Google Ads, YouTube, and the Google Display Network can leverage first-party Google account data for targeting, independent of GAID. This means Google's own ad products may actually gain competitive advantage as third-party tracking degrades.

The strategic takeaway: diversify your Android channel mix now. Test channels like TikTok, Taboola, and programmatic partners to understand their Privacy Sandbox readiness. Having performance baselines across multiple channels before GAID disappears will be invaluable.

What happens to Android retargeting and remarketing campaigns?

The Protected Audiences API preserves remarketing functionality but moves audience storage and auction logic on-device. According to Google's Protected Audiences documentation, custom audience membership is stored locally and bidding occurs without sending user data to external servers.

Key insight: Remarketing survives but becomes less flexible. Server-side audience manipulation and cross-app profiling disappear.

• Audience lists stored on user devices only
• On-device auctions replace server-side bidding
• Cross-app audience profiling eliminated
• Shift re-engagement to owned channels
• Reserve paid retargeting for high-value segments

Today, you can build a remarketing audience of users who abandoned checkout, layer in signals from other apps they've used, and serve personalized ads through your DSP. Post-Privacy Sandbox, the audience definition happens at the app level, and the ad selection runs on-device.

This means sequential messaging, frequency capping across apps, and complex audience exclusions become significantly harder. According to AppsFlyer's retargeting benchmarks, retargeting already declined 15% on iOS post-ATT. Android will follow a similar but more gradual trajectory.

The practical response: shift re-engagement spend toward owned channels (push notifications, email, in-app messaging) and reserve paid remarketing for highest-value user segments where the reduced precision still delivers positive ROAS.

Privacy Sandbox is coming. The transition will be less abrupt than ATT, but the operational shifts are just as significant. Start integrating Privacy Sandbox SDKs, pressure your MMP for readiness timelines, and use the remaining GAID window to establish performance baselines that will anchor your optimization strategy through the transition.

Frequently Asked Questions

Will Privacy Sandbox affect Google Ads campaigns on Android?

Google Ads will integrate Privacy Sandbox APIs natively, and Google's first-party account data provides targeting signals beyond GAID. However, per Google Ads support documentation, App campaigns will still experience some signal loss, and advertisers should expect 10-20% measurement variance during the transition.

Do I need to update my app's SDK for Privacy Sandbox?

Yes. According to Android's developer documentation, apps must target Android 13+ (API level 33) and integrate the Privacy Sandbox SDK extensions to use Topics, Attribution Reporting, or Protected Audiences APIs.

Can I still use MMPs like AppsFlyer or Adjust after GAID deprecation?

Yes, all major MMPs are building Privacy Sandbox integrations. AppsFlyer, Adjust, and Singular have all announced support for the Attribution Reporting API. According to AppsFlyer's Privacy Sandbox overview, their SDK will handle aggregate report collection and deduplication, similar to how they process SKAN postbacks on iOS.

Will Privacy Sandbox affect Android web-to-app campaigns?

Yes. Cross-surface attribution (web to app) will rely on the Attribution Reporting API's cross-app and web attribution feature. Per Chrome's attribution documentation, this links Chrome browser attribution with Android app installs, but with the same aggregate noise and delay constraints.

Is Google's Privacy Sandbox subject to regulatory review?

Yes. The UK's Competition and Markets Authority (CMA) oversees Privacy Sandbox changes under formal commitments Google made in 2022. Per CMA's published oversight framework, Google cannot finalize GAID deprecation without CMA approval, which could affect the timeline.

How does the Topics API taxonomy get updated?

Google maintains the taxonomy and can add or refine categories over time. The initial taxonomy contains roughly 470 topics across categories like sports, travel, and technology. According to Google's developer docs, apps are classified into topics using an on-device machine learning model, and users can view and remove topics in Android settings.

Looking to scale your mobile app growth with performance creative that delivers results? Talk to RocketShip HQ to learn how our frameworks can work for your app.

Not ready yet? Get strategies and tips from the leading edge of mobile growth in a generative AI world: subscribe to our newsletter.

Related Reading

• Privacy-first attribution and measurement for mobile apps (comprehensive guide)
• What Is AdAttributionKit and How Is It Different from SKAN? (2026)
• AppsFlyer App Retargeting Report: Benchmarks and Post-ATT Strategies (2026)
• AppsFlyer Mobile Ad Fraud Report: Fraud Rates and Protection Benchmarks (2026)
• How Has ATT Changed Mobile Advertising? (2026)