iPhone & iOS Tracking: What's Lost, What Still Works

The Privacy Timeline: What Apple Changed

Apple's privacy changes didn't happen overnight. Understanding the timeline helps you see where we are and where we're heading:

Each change removed another piece of the tracking puzzle. The trend is clear: Apple is systematically eliminating cross-site and cross-app tracking.

What You've Lost: The Detailed Breakdown

1. IDFA (Identifier for Advertisers)

Before ATT: Every iOS device had a unique IDFA that advertisers could use to track users across apps. Install an app from a Facebook ad? Facebook knew. Make a purchase in that app? Facebook knew.

After ATT: IDFA is only available if users explicitly opt in. With 75%+ opting out, IDFA is effectively dead for most users.

2. View-Through Attribution

Before: User sees your Instagram ad, doesn't click, later opens your app and purchases. Meta credits the ad.

After: Without IDFA, there's no way to connect "saw ad" to "made purchase" for users who didn't click.

3. Safari Cookie Lifespan

Safari's Intelligent Tracking Prevention (ITP) progressively shortened cookie lifespans:

"Link decoration" means URLs carrying tracking parameters like ?gclid=… (Google Ads), ?fbclid=… (Facebook), ?ttclid=… (TikTok), and sometimes ?utm_source=…. If Safari sees these, the cookie window collapses to 24 hours.

What this means: A user clicks your Google Ad on Safari. Google sets a cookie. If they don't convert within 24 hours, the cookie is gone. Your 30-day attribution window? It's actually 24 hours on Safari.

4. Link Tracking Protection (iOS 17+)

Starting with iOS 17, Apple automatically strips tracking parameters from links in certain contexts:

Impact: If a friend shares your link via iMessage, tracking parameters may be removed before the recipient clicks.

What Still Works

1. First-Party Data

Apple's restrictions target cross-site/cross-app tracking. Your own first-party data is unaffected:

The shift: Instead of relying on ad platforms to track users, you need to build your own customer identity system.

2. Server-Side Tracking

Server-side tracking bypasses some browser restrictions because cookies are set by your server, not JavaScript:

Important: Server-side tracking extends cookie life but doesn't restore cross-site tracking. You still can't track users across domains you don't own.

3. SKAdNetwork (For Apps)

Apple's privacy-preserving alternative to IDFA-based attribution:

What you actually get back: app install attributed to an ad network, a single conversion value (0–63), limited campaign differentiation, aggregated rather than user-level.

SKAdNetwork tells you "this campaign drove approximately X installs" but not "User ABC installed from Campaign XYZ and made a $50 purchase."

4. Probabilistic/Modeled Attribution

Without deterministic identifiers, platforms increasingly use probabilistic matching:

• IP address + User agent + Timing → Probabilistic match
• Email matching (hashed) → Deterministic where available
• Modeled conversions → ML estimates based on patterns

Platform-Specific Impacts

Meta (Facebook/Instagram)

Meta was hit hardest by ATT because their attribution relied heavily on cross-app tracking:

Meta's adaptations:
- Aggregated Event Measurement (AEM) — limited to 8 events per domain
- Conversions API (CAPI) — server-side event tracking
- Modeled conversions — ML-estimated missing data

Google Ads

Google was less impacted because they own Chrome (no ITP) and have first-party data from Search:

Google's adaptations:
- Enhanced Conversions — first-party data matching
- Consent Mode — modeling for users who decline tracking
- Privacy Sandbox — Chrome's eventual third-party cookie replacement

TikTok, Snap, Pinterest

All affected similarly to Meta:
- Heavy reliance on view-through attribution (now broken)
- Mobile-first audiences (higher iOS exposure)
- Adapting with Conversions APIs and modeled data

How to Adapt Your Attribution Strategy

1. Invest in First-Party Data Collection

Build direct relationships that don't depend on third-party tracking:

2. Implement Server-Side Tracking

Move tracking from client (browser/app) to server:

3. Use Triangulation

Don't rely on any single measurement method. Combine approaches:

(See MTA, MMM & Lift Studies: The Triangulation Approach for detailed methodology.)

4. Adjust Attribution Windows

With Safari's 24-hour cookie limit for ad traffic, long attribution windows are fiction for a significant portion of users:

Recommendation: use 7-day windows in platforms (captures Chrome/Android), understand ~30% of users have a 24-hour effective window, supplement with server-side tracking where possible, and use MMM to capture longer-term effects that fall outside any window.

5. Accept Measurement Uncertainty

The era of precise, user-level, cross-platform attribution is over. Adapt your mindset:

Old approach: "Campaign X drove exactly 847 conversions at $12.34 CPA"

New approach: "Campaign X drove approximately 700-900 conversions at $11-14 CPA, validated by incrementality testing"

What's Coming Next

Apple continues tightening privacy controls:

The direction is clear: Build for a world with less tracking, not more.

Summary

Apple's privacy changes have fundamentally altered mobile and web attribution:

The path forward:

1. Build first-party data — email, accounts, surveys
2. Implement server-side tracking — Conversions APIs, enhanced conversions
3. Use triangulation — MTA + MMM + incrementality
4. Accept uncertainty — ranges and confidence intervals, not false precision
5. Test incrementally — holdout tests reveal true impact

The companies adapting fastest are those treating this as a strategic shift, not a technical problem to hack around.

Further Reading

On Privacy-Safe Measurement:
- Server-Side vs Client-Side Tracking — Implementation approaches
- The Dark Funnel — Measuring the unmeasurable

On Measurement Triangulation:
- MTA, MMM & Lift Studies: The Triangulation Approach — Combining methods
- Why Platform Reports Don't Match — Cross-platform reconciliation

Holly Henderson

Co-Founder, mbuzz

Holly Henderson is Co-Founder of mbuzz. With 10+ years in marketing including roles at Westpac, Avon, and Forebrite, she's obsessed with making measurement actually useful.

Harvard Extension School Forebrite Westpac Avon