Short version - Apple has spent the last few years quietly stripping the tracking parameters that marketers rely on to know which ads work. It started with iOS 17 in 2023 and iOS 26 escalated it. If your tracking depends on click IDs, a growing share of your Safari and Apple traffic is now going dark but UTMs survive and there are concrete ways to keep your attribution accurate. Here's the real state of play and what to do about it.
Back in 2023, Apple introduced Link Tracking Protection (LTP) in iOS 17. At first it only stripped tracking parameters — Google's gclid, Meta's fbclid and similar click IDs — from links opened in Mail, Messages and Safari Private Browsing. When it launched the open question was whether Apple would eventually turn it on for *all* browsing. We suspected it would.
It did. With iOS 26 and Safari 26 (rolled out in September 2025), Apple expanded LTP toward all Safari browsing, stripping gclid, fbclid, msclkid, dclid and similar click identifiers before your page even loads. There's some nuance worth being honest about. Testing across the stable release and Safari Technology Preview has shown mixed behavior — some tests show click IDs stripped in regular browsing, others show them still passing through in standard (non-private) mode as of early 2026 but the direction is unmistakable, Apple's preview builds strip them and given Safari is roughly a quarter of global browser traffic the practical impact on click-ID-based attribution is already significant and growing.
The single most important fact through all of it is that **UTM parameters survive.** utm_source, utm_medium, and utm_campaign are treated as aggregate campaign metadata, not individual user tracking, so Apple leaves them intact across every scenario tested — private browsing, Mail, Messages and standard browsing alike. Click IDs are the casualty - UTMs are the lifeline.
Click IDs are how ad platforms tie a specific click to a specific user and conversion. Strip them and three things break - your conversion reporting drops, Smart Bidding trains on incomplete data and your remarketing pools shrink. The brands hit hardest are the ones with no independent tracking — they see reported ROAS fall, panic and cut spend.
If this feels familiar, it should. This is iOS 14 all over again. When ATT launched, around 90% of users opted out of tracking and the cycle went something like this - denial ("my account's fine"), then panic ("Facebook is dead"), then snake-oil ("we fixed Facebook!" from the same crowd that was day-trading crypto a year earlier). When the dust settled, platform accuracy really had degraded and the lasting lesson was that you need an independent source of marketing truth. That's when multi-touch measurement went from nice-to-have to essential. LTP is the same song, second verse.
Here's the contrarian take. When click IDs get stripped and reported ROAS craters, most advertisers — especially brands spending $10k–$250k/month without a dedicated tracking specialist — will cut spend on what looks like underperformance. But if you can still see true performance on the traffic that *does* track (Android, Windows, non-Safari), you'll spot the winning audiences your competitors just abandoned. Less competition for those audiences can mean lower costs and higher ROAS for you. Bad measurement is a threat to brands that can't see through it, and an edge for brands that can.
The tactical landscape has consolidated since 2023. The workarounds that matter now :
This is no longer optional — it's the primary fix. Because LTP strips parameters in the browser before your page loads, client-side tracking increasingly misses them. Server-side tagging (server-side GTM), plus platform conversion feeds like Google Enhanced Conversions and Meta's Conversions API, route conversion data through your own infrastructure and preserve signal that browser-side tracking now loses.
They still work. Since UTMs survive LTP, they remain a reliable backbone for first- and last-touch attribution. Keep tagging every link diligently, and make sure your servers accept all relevant parameters so nothing gets truncated. Run manual UTMs alongside platform auto-tagging as a safety net.
On Meta and on Google Display/Video, you can isolate Apple-device traffic into dedicated campaigns, keeping your non-Apple data clean and optimizable. Google Search can't be segmented by device this way, and email/SMS segmentation depends on your provider — so this is partial, not total. Clean non-Apple data can also serve as a proxy to estimate the performance of the traffic you can't directly see.
When click-level attribution is degraded, blended measures become more important. Manage to marketing efficiency ratio (MER) and layer in cohort analysis and conversion-time data to understand delayed and future value. Raise spend when MER is healthy *and* cohort data signals future LTV *and* conversion-time analysis says more conversions are still coming. This is how you make confident decisions without perfect click data.
Brands with clean email and phone collection and identity resolution tied to real customers, weather every one of these privacy waves better than brands dependent on click IDs and third-party cookies. This is the durable answer, not a workaround.
Every workaround above points at the same conclusion. When each platform's own tracking is being degraded by Apple and each platform is grading its own homework to begin with, you can't run a business on any single platform's reported number. You need one independent source that reconciles ad-platform data, UTMs, server-side signals and your first-party CRM and order data into a people-based view of what actually drove revenue.
That's what Wicked Reports is built for and it's why LTP was survivable for our users. We heard about Apple's "link decoration" work through our Google and Meta partnerships back in early 2022 and built for it before it shipped — combining server-side methods, UTM resilience, first-party data and conversion-time and cohort modeling so attribution stays accurate even as click IDs disappear.
Apple will keep tightening the screws. The brands that thrive won't be the ones chasing each new workaround — they'll be the ones who stopped depending on any single platform's self-reported tracking in the first place. See how it works in the platform overview, or book a demo to see it on your own data.
No. UTM parameters (utm_source, utm_medium, utm_campaign) survive Link Tracking Protection across all tested scenarios, because Apple treats them as aggregate campaign metadata rather than individual user tracking. The parameters that get stripped are platform click IDs like Google's gclid, Meta's fbclid, and Microsoft's msclkid. That's why UTMs remain a reliable attribution backbone in 2026.
iOS 17 originally limited LTP to Mail, Messages, and Safari Private Browsing. iOS 26 and Safari 26 (from September 2025) expanded it toward all Safari browsing, stripping click IDs before the page loads. Testing has shown mixed behavior between stable and preview builds, but the direction is clear and the impact on click-ID-based attribution is already significant given Safari's share of traffic.
Move to server-side tracking (server-side GTM, Google Enhanced Conversions, Meta CAPI), keep using UTMs since they survive, segment Apple traffic where your platforms allow, and lean on blended measures like MER, cohort analysis, and first-party data. Most importantly, use an independent measurement source that reconciles all of these against real order data rather than trusting any single platform's degraded reporting.
Both are Apple privacy changes that broke click-level tracking marketers relied on, triggered industry panic, and ultimately proved that brands need an independent source of marketing truth rather than platform self-reporting. iOS 14's ATT made multi-touch measurement essential; Link Tracking Protection reinforces the same lesson as click IDs continue to disappear.