Safari Link Tracking Protection

Google Tag Gateway serves Google tags from your domain, so Safari ITP treats their cookies as first-party with extended durability — but Meta Pixel, TikTok, and other non-Google cookies remain third-party and capped at 7 days (Louder, 2025). With Safari holding 51.8% of US mobile traffic (Seresa, 2026), that gap means more than half your mobile visitors lose multi-visit attribution for every channel except Google. Server-side GTM or a managed first-party tracking plugin can extend cookie life for all channels — Tag Gateway alone cannot.

Safari accounts for 51.8% of US mobile web traffic (StatCounter, 2026), and version 27’s beta introduces IP-range validation that may demote or block tracking requests from server-side proxies whose IP addresses don’t match the website’s own range. For WooCommerce stores relying on a third-party proxy subdomain, this means cookies set by that proxy could be reclassified as third-party — subject to ITP’s 7-day cap or outright rejection. The fix is architectural: run your tracking endpoint on infrastructure that shares your store’s IP range.

Mobile AI apps strip the HTTP referrer header when opening external links because in-app browsers handle cross-app navigation differently than desktop browsers. ChatGPT’s iOS app uses WKWebView and Android uses WebView, both of which drop the Referer header. With 68 million combined monthly downloads and ChatGPT crossing 1 billion MAU in June 2026, mobile is now the primary AI access method. Every mobile click reaches your site with no referrer, making mobile AI the single largest contributor to GA4’s Direct traffic inflation.

iOS 26 Advanced Fingerprinting Protection injects random noise into Canvas, WebGL, and WebAudio API readbacks on every Safari session by default, generating a different device fingerprint per tab and per visit (WebKit, 2025). While Link Tracking Protection’s click-ID stripping dominated the headlines, AFP is the second layer that degrades the fingerprinting fallback trackers rely on when cookies and click IDs fail. Together they create a double hit: LTP strips the deterministic identifier and AFP breaks the probabilistic one. Server-side capture is immune to both because it reads attribution at the HTTP request layer, not via browser APIs.

Safari’s Link Tracking Protection strips gclid and fbclid from ad URLs before the page loads, removing Safari visitors from Google Ads and Meta remarketing audiences. With Safari at 51.2% of US mobile browser share, remarketing pools lose more than half their mobile audience. The missing segment skews toward higher household income and higher average order values. ITP’s 7-day cookie cap compounds the loss: cookied Safari visitors drop out within a week. Server-side click ID capture and Enhanced Conversions keep Safari visitors in remarketing pools.

OpenAI’s ChatGPT Ads pixel stores the click identifier in a first-party __oppref cookie with a 30-day lifetime. But Safari’s Intelligent Tracking Prevention caps any cookie set by JavaScript at 7 days, and drops it to 24 hours when tracking parameters are present in the URL. For the 26% of mobile shoppers on Safari, the oppref click ID silently expires before most WooCommerce purchases complete, breaking attribution for the fastest-growing ad channel. Server-side capture at landing preserves the click ID in your own infrastructure, beyond ITP’s reach.