How it works
The app calls Apple's API to show a system prompt with two choices: "Ask App Not to Track" and "Allow". The developer cannot change the buttons, only add a short text explaining why permission is requested. The prompt can be shown once per install; after that the choice is changed in iOS Settings. If the user allows tracking, the app can read the IDFA. If they decline, or have switched off tracking requests for the whole device, the IDFA is returned as zeros. Apple's rules also forbid working around a refusal by fingerprinting the device.
Why it matters for an app team
ATT decides which iOS users can be attributed at user level. For everyone else, campaign measurement relies on Apple's aggregated frameworks, SKAdNetwork and AdAttributionKit. When and how you show the prompt therefore changes how much detailed data you get.
In practice
Example with made-up numbers: an app shows the prompt to 10,000 new users and 3,500 tap Allow. User-level attribution with the IDFA is possible for those 3,500. Campaigns that reached the other 6,500 are measured through SKAN postbacks.
Common confusion
ATT is not GDPR consent. It is a platform permission that applies on iOS worldwide, while consent under European law is a separate legal requirement, usually collected through a consent management platform. Many apps need both. ATT also does not block first-party analytics: measuring what users do inside your own app is not tracking in Apple's sense.