Loupe shows how iOS apps can fingerprint users without ATT

What happened

Researchers Tommy Mysk and Talal Haj Bakry released Loupe, an open-source tool showing that apps can still collect enough signals to fingerprint a user even when App Tracking Transparency is turned off.

Disabling ATT blocks the advertising identifier, but it does not make a device impossible to track.

What was found

Available signals include disk timestamps, clipboard counters, locale, screen size and battery state. More advanced methods can enumerate URL schemes or use Keychain persistence across reinstalls.

Data at risk

• Device fingerprint
• Installed apps
• Keychain identifiers
• Clipboard signals
• Locale data
• Usage patterns

What you should do

1. 1Do not treat ATT as complete tracking protection.
2. 2Grant apps only the permissions they genuinely need.
3. 3Use Loupe to review what apps can learn about the device.
4. 4Watch for broader coverage in Apple's App Privacy Report.