iOS and Safari tracking changes, version by version

Link Tracking Protection removes known click-tracking parameters, such as ad click ids, from links opened in Mail, Messages and Safari Private Browsing; UTM campaign tags are not its target and pass through. Separately, Safari limits how long scripts can keep cookies, and since Safari 26 it stops known fingerprinting scripts from reading the page's query parameters and referrer. Apple has not removed UTM tags from ordinary browsing.

Much of what is written about "iOS killing tracking" mixes these features up. This guide separates them, with Apple's and WebKit's own words, and lists what still works.

The changes, in order#

Sources for each row are in the sections below.

Intelligent Tracking Prevention: the storage limits#

Intelligent Tracking Prevention (ITP) is Safari's set of rules for cookies and storage. Today WebKit documents these (WebKit):

• Third-party cookies are blocked. Full blocking arrived in Safari 13.1 (WebKit).
• Script-written storage lasts 7 days without interaction. Cookies created in JavaScript, and localStorage and the rest, are deleted after 7 days of Safari use with no visit to the site.
• 24 hours after a decorated link. When ITP detects link decoration used for tracking, cookies created in JavaScript on the landing page are capped at 24 hours.
• Cloaked server cookies get 7 days. Cookies set by a server reached through a third-party CNAME or third-party IP address are capped at 7 days (WebKit).
• Referrers are cut to the origin. All third-party referrers are downgraded to their origin, so a referring page's path and query never arrive.

What it means: a visitor who clicks an ad today and returns from a bookmark in 10 days may look like a new, direct visitor. Attribution windows longer than a week undercount Safari users. See ITP.

App Tracking Transparency: apps, not websites#

From iOS 14.5, an app needs the user's permission through App Tracking Transparency to track them across other companies' apps and websites, or to read the advertising identifier; without it the identifier is all zeros (Apple).

This hit ad platforms' own apps, not your website analytics. It is why Meta and TikTok rely more on modeled conversions and on server events such as the Conversions API.

Link Tracking Protection#

Announced with iOS 17, Link Tracking Protection removes tracking information from links shared in Messages and Mail, and from links in Safari Private Browsing (Apple).

How it works, from WebKit (WebKit):

• Safari removes "a subset of query parameters that have been identified as being used for pervasive cross-site tracking" before the page loads, so they never reach the server.
• Parameters used only for campaign attribution pass through. WebKit's own example is a campaign parameter, which it allows because it is "only used for campaign attribution, as opposed to click or user-level tracking".
• Third-party scripts on a page reached cross-site see the URL without its query and fragment.
• The same protections can be turned on for all browsing, in Advanced Tracking and Fingerprinting Protection, set to All Browsing.

Apple does not publish the list of parameters it removes. Able CDP's tests report ad click ids such as gclid removed and UTM tags kept, which fits WebKit's description: a click id identifies one click, and so one person; a UTM tag describes a campaign (Able CDP).

The source of most iOS 26 alarm: a Safari 26 beta listed filtering tracking parameters in regular browsing, and a Technology Preview removed gclid in normal tabs. The item is not in the final Safari 26.0 release notes, and the same tests found the released Safari 26 passing every parameter in normal browsing (Able CDP). It could ship in a later version; watch the release notes.

So in practice:

Safari 26: fingerprinting scripts#

Safari 26 added protection against fingerprinting by known tracking scripts (Apple). WebKit says it stops known fingerprinting scripts from reliably reading device details such as screen size, and from "reading state that could be used for navigational tracking", namely "query parameters and document.referrer" (WebKit).

This targets scripts on WebKit's list of known fingerprinters. It does not remove parameters from the URL for your own analytics, and it does not touch UTM tags in ordinary browsing.

What still works#

Do not try to beat these rules with fingerprinting or by hiding click ids under other parameter names. Safari already blocks known fingerprinting scripts, and in the EU and UK such workarounds need consent anyway.

Where Sporetag fits#

From Sporetag's tracking code and help: Private mode stores nothing on the device, so Safari's storage caps do not change its counts. 90-day tracking keeps a first-party id in a cookie and localStorage on your domain, and its help says Safari may clear it after 7 days without a visit. Short links on go.sporetag.com or your own domain count each click on the server before forwarding, so a link tapped in Messages counts whatever Safari removes afterwards. UTM presets in the link builder keep campaign data in the parameters Apple leaves alone.

Common questions#

Does iOS 26 strip UTM parameters?

No. Link Tracking Protection targets parameters that identify a click or a person, such as ad click ids. WebKit says parameters used only for campaign attribution pass through. Safari 26's fingerprinting protection hides query parameters only from known fingerprinting scripts.

Does Link Tracking Protection remove gclid and fbclid?

In Mail, Messages and Safari Private Browsing, and in normal browsing when the user turns on Advanced Tracking and Fingerprinting Protection for all browsing, known tracking parameters are removed. Apple does not publish the list; marketers' tests report ad click ids among them.

Is Link Tracking Protection on in normal Safari browsing?

Not by default. It applies to Private Browsing, Mail and Messages, and to all browsing only when the user sets Advanced Tracking and Fingerprinting Protection to All Browsing.

How do I keep attribution on iPhone users?

Tag every link with UTM parameters, use short links for links in texts and emails, and send conversions to ad platforms from your server with hashed contact details, so a missing click id does not lose the sale.

Sources#

• Apple Newsroom: Apple announces powerful new privacy and security features (June 2023). Checked October 2026.
• Apple Developer: User privacy and data use, Safari 26.0 release notes. Checked October 2026.
• Able CDP: Does Safari strip click ids? (August 2026). Checked October 2026.
• WebKit: Tracking Prevention in WebKit, Full third-party cookie blocking and more, CNAME cloaking and bounce tracking defense, WebKit features in Safari 17.0, Private Browsing 2.0, WebKit features in Safari 26.0. Checked October 2026.