Skip to content

iOS 26 Attribution

iOS 26 attribution is the question of how Safari's iOS 26 privacy defaults change what ad platforms and analytics tools can see about a visit. Apple documents the removal of known tracking parameters from URLs only for some contexts, and tests of the released Safari 26 found click IDs still arriving in normal tabs.

Three platforms, three answers, one budget to defend. Your GA4 export already holds the answer, and the first finding is free and never leaves your browser. Get your first finding free

By , Founder & CEOUpdated 5 min read

Run the numbers for your store: the free blended ROAS (MER) calculator.

What is iOS 26 Attribution?

The label comes from a question that arrived with Safari 26: do its privacy defaults remove the click identifiers, such as gclid and fbclid, that last-click tracking uses to join an ad click to a later order? The answer depends on which of two separate Safari features is meant and on where the visit happens.

Link Tracking Protection removes known tracking parameters from URLs. Apple's privacy features page describes it for links shared in Messages and for Private Browsing, and WebKit's notes for Safari 17.0 list blocking for known tracking query parameters in links under Private Browsing. An Improvado article published on 23 September 2026 reports that normal tabs keep the full URL unless the user switches Advanced Tracking and Fingerprinting Protection to All Browsing.

Advanced Fingerprinting Protection is the feature that, according to Able CDP and Improvado, Safari 26 applies to all browsing by default. WebKit's notes for Safari 26.0 say it prevents known fingerprinting scripts from reliably accessing certain web APIs, from setting long-lived script-written storage, and from reading state that could be used for navigational tracking, such as query parameters and the referrer. That limits what those scripts can read. WebKit does not describe it as removing parameters from the URL.

Tests point the same way. Able CDP reported on 23 August 2026 that click IDs still reach the server in standard Safari browsing, and that the planned expansion of Link Tracking Protection to standard browsing was not part of the Safari 26 release. Improvado notes that Apple does not publish the list of parameters it removes, so any list of stripped parameters is a third-party observation.

Why iOS 26 Attribution matters for ecommerce

A browser privacy change alters what a platform can link and report without changing how well the advertising worked. A team that believes click IDs are removed everywhere, when Apple documents removal in only some contexts, will explain a fall in reported ROAS with the wrong cause. It may cut budget from a channel that was working, or spend weeks on Safari when the real gap is consent, tagging or cookie lifetime. The first step is to measure how much of your own Safari traffic is affected, because the scope differs by surface and by user setting and Apple does not publish the parameter list.

How to use iOS 26 Attribution

  1. Count, by browser and by week, the share of landing-page visits and orders in your own data that still carry a click ID in the landing URL. Compare Safari with Chrome.
  2. Before reacting to a drop in one platform's reported ROAS, check MER: total revenue divided by total ad spend. If MER is stable while one platform moved, suspect measurement before performance.
  3. Write down the date of each browser or operating system change next to the numbers you recorded, so a later comparison is made against a known measurement regime.
  4. Where a decision is large, test it without click IDs: a holdout or geo test compares order totals between exposed and unexposed groups, so it does not depend on joining a click to an order.
  5. Read the result both ways. If Safari visits carry click IDs at a similar share to Chrome, the loss is elsewhere, so look at consent, tags and cookie lifetime. If the share is much lower, treat that platform's Safari numbers as incomplete and lean on MER and the holdout.

Common mistakes

  1. Stating that iOS 26 strips click IDs by default in Safari. Apple documents removal in Messages links and Private Browsing, and tests of the released Safari 26 found click IDs still arriving in normal tabs. The cost is blaming Safari for a drop that has another cause.
  2. Treating Advanced Fingerprinting Protection and Link Tracking Protection as one feature. The first limits what known fingerprinting scripts can read, the second removes parameters from URLs, and they apply in different places.
  3. Reading a fall in one platform's reported ROAS as a fall in performance without checking total revenue and total spend. The cost is budget moved away from a channel that was working.
  4. Copying a third-party list of stripped parameters into a plan as if Apple had published it. Apple does not publish the list, so treat any list as something to test in your own data.

Frequently asked questions

  • Does iOS 26 strip click IDs like gclid and fbclid from my ad links?
    Not in normal browsing by default, according to the sources checked. Apple documents removal of known tracking parameters for links shared in Messages and in Private Browsing, and tests of the released Safari 26 found click IDs still arriving in standard tabs.
  • What does Advanced Fingerprinting Protection do in Safari 26?
    WebKit says Safari 26.0 stops known fingerprinting scripts from reliably reading device characteristics, from setting long-lived script-written storage, and from reading state that could be used for navigational tracking, such as query parameters. It acts on those scripts and is not described as removing parameters from the URL.
  • How can I tell whether Safari is hurting my attribution data?
    Compare, by browser and by week, the share of landing-page visits and orders that carry a click ID, and compare total revenue with total ad spend. A platform's reported ROAS can move for reasons other than advertising performance, so check MER before moving budget.

Further reading

Your platforms guess.
We run the math.

Upload a GA4 export and see what each channel caused, next to last-click, in 1–2 minutes. The read is yours to keep.

Get your first finding free

The free finding runs in your browser. Your file never leaves it. The full read is €99, refundable within 30 days, no questions asked. Prices exclude VAT.