Apple’s iOS 17 (released September 2023) introduced Link Tracking Protection as part of Safari’s privacy features. This change affects how Meta, Google, TikTok, and other ad platforms track conversions from Safari users — which means iPhone users who click your ads. Understanding what changed and how to respond is increasingly important as iPhone usage continues to dominate mobile traffic in the US market.
What iOS 17 Link Tracking Protection Does
When a user on iOS 17 clicks a link in Safari (Private Browsing mode), Mail, or Messages, iOS 17 strips known tracking parameters from the URL before loading the destination page. The tracking parameters affected include:
- fbclid: Meta’s click ID (used for Meta Pixel attribution)
- gclid: Google’s click ID (used for Google Ads attribution)
- ttclid: TikTok’s click ID
- msclkid: Microsoft Ads click ID
- utm_id: GA4 click attribution parameter
- Many other known tracking parameters
When the click ID is stripped, the ad platform cannot match the visit to a specific ad click. Attribution breaks for those sessions.
Important nuance: Link Tracking Protection in iOS 17 initially only applied to Safari Private Browsing, Mail, and Messages — not to regular Safari browsing. However, in subsequent iOS releases, Apple has continued expanding where it applies. Monitor Apple’s privacy changelog for the current scope.
How It Affects Meta, Google, and TikTok Attribution
Meta Ads
The fbclid parameter is how the Meta Pixel matches a browser session to a specific Meta ad click. When iOS 17 strips fbclid, the pixel on your Shopify thank-you page cannot attribute the purchase to the Meta campaign that drove it. This is an additional attribution gap on top of the existing iOS 14.5+ App Tracking Transparency impact.
Google Ads
Google’s gclid auto-tagging serves the same purpose. When gclid is stripped, Google Ads cannot attribute the conversion to the specific keyword or campaign. Google Ads conversion tracking relies on gclid matching; without it, conversions from iOS 17 Safari clicks are unattributed in Google Ads Manager.
GA4
Standard UTM parameters (utm_source, utm_medium, utm_campaign) are not on Apple’s current strip list. UTM parameters still pass through in iOS 17. This means GA4 can still attribute sessions to the correct source/medium using UTMs even when click IDs are stripped. This reinforces the importance of adding UTMs to all campaign URLs.
How Server-Side Tracking Helps
Server-side conversion tracking (Meta CAPI, Google Enhanced Conversions) does not depend on click IDs captured by the browser. Instead, it uses first-party customer data (hashed email, hashed phone) to match conversions to ad exposures at the platform level. When the click ID is stripped:
- The browser pixel cannot attribute the purchase (click ID gone)
- The server-side CAPI event still fires with the hashed email
- Meta matches the hashed email to a Meta user who clicked the ad
- The conversion is attributed successfully
Server-side tracking with first-party data is the most effective adaptation to iOS 17 link tracking protection.
What You Can Do Right Now
- Add UTM parameters to all ad campaign URLs: UTMs still pass through iOS 17. Your GA4 data is not affected by link tracking protection as long as UTMs are consistently applied.
- Implement Meta CAPI with hashed email: server-side purchase event matching does not require click IDs and maintains attribution even when fbclid is stripped.
- Enable Google Enhanced Conversions: similar to Meta CAPI, Enhanced Conversions for Web uses hashed email to match conversions without gclid dependency.
- Track performance trends by device type: in GA4, segment conversion rates by device category (mobile vs desktop). If mobile conversion rates dropped after iOS 17, that is a signal of attribution impact rather than genuine performance deterioration.
iOS Privacy Changes Are an Ongoing Challenge
iOS 14.5 required app tracking transparency. iOS 16.4 further restricted certain tracking mechanisms. iOS 17 added Link Tracking Protection. Each iOS release has introduced new privacy features that affect ad tracking. The pattern is consistent and the direction is clear: browser-based, cookie-dependent, click-ID-dependent tracking will continue to erode for Apple device users.
Building server-side tracking and first-party data infrastructure is not a one-time fix for a single iOS change — it is the foundation for resilient tracking regardless of what Apple does next.
Book your free Shopify tracking audit here and we will assess how much of your current tracking relies on click IDs and browser-dependent attribution, and what server-side improvements will protect your data quality going forward.