An Associated Token Account is the SPL-token account whose address is deterministically derived from (owner, mint) by the Associated Token Account program. It is itself a PDA, but with fixed seeds ([owner, TOKEN_PROGRAM_ID, mint]) so there is exactly one ATA per owner-mint pair. Wallets, dApps, and indexers all assume that "the USDC balance of wallet X" lives at X's USDC ATA.
SolMask's withdraw flow always sends to the recipient's ATA for the chosen output mint. If the ATA does not yet exist (a fresh wallet that has never held that token), the withdraw transaction creates it using the Associated Token Account program's idempotent_create instruction. The rent for the new ATA — roughly 0.002 SOL — comes out of the withdraw amount in the same way the relayer fee does.
This matters operationally because the recipient never has to "approve" or "open" anything before receiving funds. As long as you have the recipient's Solana wallet address, SolMask can compute the ATA and route to it.