Device Graph Decay: MAID and HEM Freshness Math

Every identity graph carries a decay rate that nobody prints on the catalog sheet. The MAID graph that was 250M unique identifiers a year ago is not 250M reachable-today identifiers — some fraction has fallen out due to app deletion, device replacement, Apple App Tracking Transparency (ATT) opt-outs, and simple cohort aging. The hashed-email (HEM) graph tied to those MAIDs decays on a separate but correlated clock — addresses go dormant, people migrate platforms, and the email-to-identity link rots at a rate that depends on how the graph was built. Buyers who don't account for decay pay for past-tense coverage and are surprised when activation underperforms. This piece is the working math. For the economics framing see MAID graph economics: why identity resolution costs what it costs; for the catalog surface see MAID Feed and Core Email File.

MAID Decay Rates Under ATT

The single largest driver of MAID graph decay since 2021 has been Apple's App Tracking Transparency framework, which moved the iOS IDFA from universally-observable to permission-gated. Post-ATT, observable IDFA on iOS is roughly 20-30% of instrumented app sessions, compared to the effectively-100% baseline before ATT rolled out. The operational consequence: the month-over-month decay rate of an iOS-skewed MAID graph is in the 4-7% range, driven by a combination of new device activations with ATT-off-by-default, existing user upgrades to new devices that reset the ATT state, and app deletions. Android-dominant graphs decay slower (roughly 2-4% per month) because Google's AAID remains generally available, though Google's own Privacy Sandbox proposals are slowly migrating the Android ecosystem toward similar constraints. The composition of the graph matters: a graph sourced heavily from iOS gaming apps decays faster than one sourced from Android utility apps, and a graph built on location-panel partners that lost partners in the wake of the FTC X-Mode/Outlogic order decays in step-functions rather than smooth curves. Buyers should ask vendors for the source-mix breakdown and the observed month-over-month decay rate separately.

HEM Decay Is Slower But Real

Hashed-email decay is slower than MAID decay but not zero. The Radicati Group's email statistics research and similar industry tracking put the baseline active-email churn rate in the 8-15% annual range — people switch primary addresses when changing jobs, consolidate multiple addresses into one, abandon accounts after email-provider breaches, and age out of platforms. The more consequential decay type for identity graphs is dormant-email decay: addresses that exist and still receive mail but are no longer actively read or acted upon. A HEM graph that counts addresses still present in the email infrastructure is a larger graph than one that counts addresses with observable recent engagement, and the two can differ by 20-30%. The honest freshness metric is observable-engagement HEM: addresses that have shown recent signal (opens, clicks, authenticated session use, CRM interaction) within a defined window. For the catalog surface see Core Email File.

Sensitive-Category Panel Losses Moved the Curve

The FTC's 2024 enforcement actions against X-Mode/Outlogic, InMarket, and Mobilewalla reshaped the supply-side of identity-graph construction in ways that matter for decay math. Panel partners that supplied signal into identity graphs — and whose data was collected under consent scopes that didn't cover sensitive-category exclusions or fine-grained purpose limitation — were forced to restructure or exit. The immediate consequence on graph size: a non-trivial share of the historical MAID cohort in some graphs was sourced from panels that no longer contribute in the same way, which creates a step-function decay rather than a smooth curve. Buyers should ask vendors two questions: (1) which panel sources have changed status (contract termination, restructuring, sensitive-category exclusion) since January 2024, and (2) what fraction of the historical MAID cohort is affected? A vendor that can't answer precisely is quoting against a partially-unreachable cohort at catalog price.

Observable-Today Is the Honest Denominator

The single change buyers should make to freshness math: ask for observable-today graph size, not historical cohort size, as the denominator in every pricing calculation. A graph advertised as 250M MAIDs may have 175M observable-today identifiers after decay, and the per-reachable-identifier price is the only honest measure. This flips the procurement conversation. A vendor pricing at $X per historical-cohort identifier with a 30% monthly gap between historical and observable is materially more expensive than a vendor pricing at $1.2X per observable-today identifier. The headline rate card frequently hides the decay differential, and buyers who re-denominate the price get substantially different rankings than the ones the sales decks imply. For the underlying economics see MAID graph economics: why identity resolution costs what it costs. IAB Tech Lab's identity guidance treats observable-reachable as the relevant measure for any 2026 activation buyer.

Refresh Cadence Is the Operational Lever

Freshness is ultimately a function of refresh cadence. A graph delivered weekly with monthly observable-cohort diagnostics outperforms a graph delivered quarterly even if the quarterly file looks cheaper per record — because the weekly file captures the current-reachable pool, while the quarterly file is stale-by-construction the day it ships. The working cadence rules for different use-cases:

1. Real-time activation (programmatic bidding, live campaign audiences): daily to weekly refresh, monthly observable-cohort diagnostic, kill-switch on decay-triggered audience sizing breaks.
2. Campaign measurement (cross-channel attribution, reach/frequency): weekly refresh acceptable if the measurement window is ≤4 weeks; monthly refresh requires an explicit decay adjustment in the measurement model.
3. Audience planning and forecasting (budget allocation, scenario modeling): monthly refresh acceptable; quarterly-refresh graphs should not be used for forward-looking spend decisions because the historical cohort has already drifted.
4. Customer-data-platform (CDP) enrichment: at minimum monthly, ideally weekly; CDPs that enrich against quarterly-refresh identity graphs ship stale joins that downstream campaigns will miss.
5. Fraud and identity-verification: real-time (sub-hour) refresh on the identifier-level data; graph-level refresh weekly, because stale graph joins are the dominant source of false-positive and false-negative identity-resolution decisions.

A vendor whose refresh cadence matches or exceeds the use-case cadence is shippable; a vendor whose refresh cadence is behind the use-case cadence is selling a graph that is out-of-money by the time it is activated. For the procurement framing see MAID Feed, Core Email File, and Audience Targeting solution. Decay is not a flaw in the data — it is the nature of identity in 2026, and the right response is operational (refresh cadence, observable-cohort diagnostics) rather than denial (quoting against peak-cohort numbers forever).