CGNAT stands for carrier-grade NAT (network address translation). It’s the reason a huge share of South African mobile users share a single public IP address — and it quietly breaks a lot of assumptions that web analytics and attribution are built on.
The short version
The internet is running out of IPv4 addresses. Rather than give every phone its own public address, mobile networks (MTN, Vodacom and others) keep subscribers on private addresses internally and translate them onto a small pool of shared public IPs at the edge. One public IP can front 50,000 to 200,000 subscribers at once.
Two consequences that matter for tracking
- The IP isn’t unique. Thousands of unrelated people look identical from the outside. You can’t tell them apart by IP.
- The IP isn’t stable. As a subscriber moves between towers — or the carrier rebalances its pool — the public IP they present can change within a single browsing session.
Add the mobile reality that in-app browsers (TikTok, Instagram, WhatsApp) frequently block or drop third-party cookies, and the two signals attribution relies on most — IP and cookie — are both unreliable on exactly the traffic that dominates SA e-commerce and iGaming.
Why “last-click” quietly fails
Last-click attribution tries to match a conversion back to the click that preceded it, often using IP + cookie as the glue. Under CGNAT, that glue dissolves: the conversion may arrive from a different IP than the click, with no surviving cookie. The system can’t confidently connect the two, so the credit is dropped or mis-assigned. It doesn’t error — it just under-reports.
What actually works
The durable fix is to stop treating the IP as an identity. Anchoring a click to a device-bound cryptographic token lets a later conversion be resolved even when the IP has rotated — no shared-IP ambiguity, no cookie dependency. Here’s how that plays out for affiliate attribution specifically.