Safari ITP breaking click ID tracking: how to keep GCLID and fbclid attribution

Picture this. Someone taps your Meta ad on an iPhone on Monday night. They look around, add nothing to the cart, and close the tab.

On Wednesday they come back by typing your URL, and they buy.

Meta sent that customer. Your report says they came from nowhere. What happened in between isn't a bug. It's Safari, and it's been getting stricter for years, which is exactly why understanding the timeline matters.

Here's the story in order. In 2019, Safari started capping cookies written by JavaScript at 7 days. Then, in the same year, it dropped that to 24 hours when the visitor arrived through a link from a known tracker. Marketers moved to server-set cookies on a subdomain. In 2020, Safari began treating cookies set through a subdomain that points at a tracker like any other tracker cookie, with the same 7-day cap. Marketers moved the server behind their own domain. In 2023, Safari added a rule that compares the server's IP address with your site's, and caps cookies from servers on a different network. And with iOS 17, Link Tracking Protection strips click IDs like gclid and fbclid from links in Private Browsing, Mail and Messages. Sometimes the ID never arrives at all.

Read the dates in order and the pattern is obvious. Every workaround gets closed, one at a time. Each one was a response to the last workaround the industry built.

What does it do to your numbers? Multiply that Wednesday buyer by every iPhone buyer who thinks about it for more than a day. Meta ends up optimising toward the impulsive buyers it can see, and the considered ones, often the best ones, vanish from its training data. You don't see an error. You see a campaign that quietly favours fast, cheap decisions.

So what helps, in order of how well it holds up? Save the click ID on the lead record at the moment the form is submitted, not in a cookie, because a record can't expire. Send a hashed email and phone with the sale, so the platform can find the person even without the click ID. And check how much of your traffic is Safari. If it's a big share, this is probably your biggest attribution gap, and worth fixing before you buy anything else.

The durable fix is the last one. Every cookie workaround you'll read about has an expiry date, because Apple closes each one eventually. Matching the person instead of the browser doesn't depend on what Safari does next.

A quick way to size your exposure. In your analytics, look at the share of sessions from Safari on iOS. Then look at how many of your conversions carry a click ID. If Safari is 40 percent of your traffic but only 20 percent of your click-ID conversions, roughly half of your Safari sales arrive with no click attached. Those are the ones Meta and Google never learn from.

A second, uglier point: Link Tracking Protection means some clicks arrive with the ID already stripped, before your site even loads. You can't capture what never arrived. For those visitors, the only way back to the ad is matching by person, through the email or phone they give you later. That's why sending a hashed email and phone with each stage isn't a nice-to-have anymore. It's the only thing that survives the strip.

How are you handling returning iPhone buyers today?