11 SEPTEMBER 2025
iOS & Safari 26: What’s Changing for E-commerce Tracking and Campaign Attribution
With the release of the new iOS 26 operating system, Apple is introducing stricter measures to protect user privacy. These updates include new tracking restrictions that will likely have a significant impact on the e-commerce world and the accurate attribution of digital marketing campaigns.
The two main changes are:
- The removal of automatic campaign tracking parameters from URLs, which already affects Google and Meta parameters (e.g., gclid, fbclid). In the future, this could be extended to other parameters commonly used in digital marketing and especially in Google Analytics to precisely track cross-platform activities (e.g., utm_source, utm_medium, utm_campaign).
- Advanced Fingerprinting Protection, which reduces the reliability of “invisible” and sometimes ethically questionable methods of identifying users.
Removal of URL Tracking Parameters
Starting with iOS and macOS 26, Safari will automatically remove certain tracking parameters considered particularly invasive, such as those generated by Google Ads (gclid) or Meta (fbclid). At the moment, traditional UTM parameters remain untouched, but this could change in future updates.
The removal happens before the page even loads, meaning analytics systems might not correctly and accurately attribute the source of the session. This puts campaign attribution models at risk, especially if they rely solely on UTM parameters. To continue collecting reliable information, it will be fundamental to adopt new strategies, such as:
- Capturing parameters immediately upon page load and saving them in cookies or sessionStorage
- Moving part of your tracking logic to the server side;
- Using parameters in the URL’s hash, which are not removed by Safari.
Advanced Fingerprinting Protection
Also starting with iOS and macOS 26, Safari will enable Advanced Fingerprinting Protection (AFP) by default. Safari will make the technical signals used to identify a user — such as screen size, installed fonts, or CPU power — less reliable. Essentially, the browser will provide “disturbed” or inaccurate information, making it impossible to create a unique user profile through what is known as device fingerprinting.
For marketers, this means invisible tracking systems will no longer be able to generate consistent identifiers. The necessary direction, therefore, becomes adopting first-party identifiers, which are collected transparently and with user consent, such as logins, customer IDs, and hashed emails.
How to Prepare for the Change
Relying solely on fingerprinting and URL parameters is no longer sustainable in the mid-term. To avoid losing critical user and performance data, recommended actions include:
- Checking if your current systems rely on methods that are already penalized or at risk;
- Continuing to use UTM tagging until it is explicitly removed;
- Adopting first-party identifiers collected with explicit consent;
- Strengthening server-side mechanisms to make data more resilient;
- Optimizing your tracking systems;
- Planning comprehensive tests in Safari 26 before the official release.
Conclusion
Apple continues to prioritize user privacy. For those working in e-commerce, this means quickly adapting to a new environment where “invisible” tracking systems or those based only on URLs are becoming increasingly unreliable.
Investing today in a first-party data-driven strategy and server-side tracking infrastructure will not only prevent you from losing valuable data but also ensure continuity in performance measurement and transparency with your customers.
If you want to understand how these changes might impact your business or if you need support in adapting your analytics strategy, our team is ready to guide you through this transition.
ECOMMERCE TIPS
How much does internal search impact an ecommerce’s buying process?
Data, benefits, and strategies to increase conversions
INSIGHT REPORTS
The Checkout Revolution: online and in-store payment habits
Global trends and strategies to optimize checkout