How it works
Both are random identifiers that the user controls, not hardware serial numbers. On iOS an app can read the IDFA only after the user has allowed tracking through the App Tracking Transparency prompt; otherwise the system returns a string of zeros. On Android the GAID, also called the Android advertising ID, is available by default to apps that declare the advertising ID permission, but the user can reset it or delete it in system settings, and a deleted ID is also returned as zeros. When an ad is clicked, the network records the device's ID. When the app is opened, the SDK reads the same ID and the two records are matched.
Why it matters for an app team
A shared device identifier is the most direct way to attribute at user level. As fewer devices expose one, attribution depends more on other signals: the Play Install Referrer on Android and SKAdNetwork on iOS.
In practice
Example with made-up numbers: out of 5,000 iOS installs in a month, 1,500 come from users who allowed tracking and expose an IDFA. The other 3,500 have no usable IDFA and are measured in aggregate.
Common confusion
Neither ID is permanent or tied to a person's account; resetting it makes the device look new. The IDFA is also different from the IDFV, an identifier shared only between apps from the same developer, which needs no tracking permission and cannot be used to match users across companies.