When an app isn't installed yet, an ad click can't hand off a URL directly — there is no app to receive it. Deferred deep linking instead stores a click "fingerprint" server-side, and once the app installs and opens for the first time it asks a matching service: which recent click was probably mine?
score = 0.35·ip_match + 0.25·device_match + 0.15·os_match + 0.25·time_decay(Δt, W)
time_decay = max(0, 1 − Δt / W)
match if score ≥ threshold (else: unmatched)
Each click and each install carry a coarse fingerprint — IP bucket, device model, OS version — drawn from a limited pool. When many clicks land inside the same attribution window W, two different users can share the same fingerprint by pure chance, exactly like the birthday paradox: collision probability grows with the square of the pool's occupancy, not linearly.
- Match threshold — how high the weighted score must climb before the engine accepts a match. Low thresholds catch more real conversions but also more coincidences.
- Attribution window — how long a click stays eligible. A wider window raises match rate but also raises the number of candidate clicks competing for one install, which raises collision risk.
- Device-pool entropy — how many distinct IP/device/OS combinations exist. Low entropy (a handful of shared carrier IPs, a few popular phone models) is the real-world condition that makes probabilistic attribution error-prone — this is why deterministic methods (universal links / app links with real URLs) are preferred whenever they're available, and probabilistic fingerprinting is only a fallback.
- Click spawn rate — traffic volume. More simultaneous clicks in the same window is the direct analogue of "more people in the room" in the birthday-paradox intuition.
Real-world relevance: this weighted-score-plus-window model (or a close variant of it) is what mobile attribution SDKs (Branch, AppsFlyer, Adjust-style services) run millions of times a day to stitch pre-install ad clicks to post-install app opens.