iOS 26 Is Quietly Deleting Your gclid and fbclid Before the Page Loads

What Apple Changed in iOS 26#

Link Tracking Protection moved from an opt-in Private Browsing feature to a default that runs across Mail, Messages, and is heading toward all sessions.

At WWDC 2025, Apple announced two privacy updates shipping with iOS 26 and Safari 26: expanded Link Tracking Protection and Advanced Fingerprinting Protection. Both became defaults on September 15, 2025.

Link Tracking Protection was introduced in iOS 17 in September 2023 as an opt-in feature in Private Browsing. It identified known tracking parameters — gclid, fbclid, msclkid, dclid — and silently removed them from URLs before the destination page loaded. The page still loaded. The visitor still arrived. The ad platform just had no idea they came from an ad.

iOS 26 expanded that stripping to all Safari Private Browsing sessions, Mail links, and Messages links by default. No user action required. Safari Technology Preview builds have shown the same stripping behaviour across all standard browsing sessions — not just Private Browsing. Apple has not officially confirmed all-session stripping in the public release, but the direction is consistent with every ITP update since 2017: start narrow, expand to default.

Based on historical patterns, 60-70% of iPhone users upgrade within three months of a new iOS release. That means the majority of your iOS traffic is already running iOS 26 or will be shortly.

iOS 26 expanded Safari’s Link Tracking Protection to strip gclid, fbclid, msclkid, and dclid from ad URLs in Private Browsing, Mail, and Messages — with Safari Technology Preview builds stripping across all sessions.

You may be interested in: Your First-Party Cookies Still Die in 7 Days — Only a True Server Survives

What Gets Stripped and What Survives#

Apple targets user-identifiable click IDs but leaves aggregate campaign-level UTM parameters untouched.

The distinction Apple draws is between user-level tracking and campaign-level tracking. Click identifiers like gclid link a specific user’s browser session to a specific ad click. Apple classifies these as privacy-invasive. UTM parameters like utm_source, utm_medium, and utm_campaign track campaigns at an aggregate level without identifying individual users. Apple does not classify them as privacy-invasive.

Parameter	Platform	iOS 26 Status
gclid	Google Ads	Stripped
gbraid, wbraid	Google Ads (app)	Stripped
fbclid	Meta	Stripped
msclkid	Microsoft Ads	Stripped
dclid	Display & Video 360	Stripped
twclkid	X / Twitter	Stripped
utm_source, utm_medium, utm_campaign	All platforms	Survives

The survival of UTM parameters is the critical detail. It means campaign-level attribution in GA4 — “this session came from a Google Ads campaign” — continues to work. What breaks is the click-level attribution that ties a specific conversion to a specific ad click. That is the attribution layer that Smart Bidding, ROAS optimisation, and remarketing audiences depend on.

This is not a blunt instrument. Apple’s WebKit team has confirmed that campaign-style parameters are not on the stripping list. The targeting is surgical: user-identifiable tracking parameters are removed while aggregate analytics parameters pass through. Stores that rely solely on UTM tracking for reporting can continue as normal. Stores that depend on click IDs for conversion optimisation cannot.

UTM parameters survive iOS 26 Link Tracking Protection because Apple does not classify campaign-level aggregate parameters as privacy-invasive — only user-identifiable click IDs are stripped.

Three Things That Break Without a Click ID#

Conversion reporting drops, Smart Bidding trains blind, and remarketing pools shrink.

When Safari strips gclid from a Google Ads click, three specific systems fail — and each costs money in a different way.

First, conversion reporting drops. Google Ads cannot attribute a purchase to a specific ad click if the gclid that links them no longer exists. The WooCommerce sale happens. The revenue arrives. Google Ads never learns about it. Your reported ROAS looks lower than reality, which triggers budget cuts to campaigns that are actually performing.

Second, Smart Bidding trains on incomplete data. Strategies like Target ROAS and Maximize Conversions use click-level conversion signals to decide which auctions to enter and how much to bid. When Safari conversions are invisible, the algorithm sees a biased sample — only the conversions from Chrome and non-Safari browsers. It optimises toward that biased sample, potentially suppressing well-performing campaigns and misallocating budget toward audiences that happen to preserve their click identifiers.

Third, remarketing audience pools shrink. Safari visitors without a gclid cannot be added to Google Ads remarketing lists that use click-based audience definitions. Your retargeting campaigns reach a progressively smaller pool that excludes one in four visitors — often the higher-income demographic that Apple devices over-represent.

The same pattern applies to Meta’s fbclid and Microsoft’s msclkid. Each platform loses its click-level attribution for Safari traffic. Each platform’s bidding algorithm trains on a biased sample. The problem is not platform-specific — it is architectural. 73% of marketers already report attribution gaps between ad platform data and actual conversions, and iOS 26 is widening that gap for everyone.

The Scale of the Impact#

Safari is not a niche browser — and the affected traffic skews toward higher-value customers.

Safari holds approximately 24% of global browser traffic. In the United States, it is the dominant mobile browser with over 50% market share. One in four WooCommerce visitors globally, and more than one in two on US mobile, arrive on a browser that is actively stripping their ad click identifiers.

An estimated 20% of Safari sessions already experience gclid stripping under current defaults, according to tracking specialist Luc Nugteren’s analysis published in April 2026. That figure covers Private Browsing, Mail, and Messages links. If Apple extends stripping to all standard browsing sessions — as Safari Technology Preview builds suggest — the affected share rises to 100% of Safari traffic.

Safari users are not a random cross-section of your audience. Apple device ownership correlates with higher household income, higher average order values, and higher lifetime customer value. The visitors losing their click identifiers are disproportionately the ones your ad platforms should be optimising hardest to acquire. Instead, they are becoming invisible to the very systems that allocate your advertising budget.

Field observations from tracking specialists show 10-30% of Safari client IDs rotating every week due to ITP cookie caps. Combined with click ID stripping, the measurement infrastructure that was designed around browser-based identifiers is systematically failing for the most valuable segment of your traffic.

An estimated 20% of Safari sessions already experience gclid stripping under current defaults, according to tracking specialist Luc Nugteren’s analysis published in April 2026.

You may be interested in: The Cumulative Tracking Loss Stack Hides Up to 50% of Your WooCommerce Customers

Server-Side Capture: The Fix#

Read the click ID from the HTTP request before Safari’s client-side protection can strip it.

Link Tracking Protection operates at the client side — it modifies the URL in the browser before the page JavaScript runs. But the HTTP request that arrives at your server contains the full, unmodified URL. A first-party server reads the gclid, fbclid, or msclkid from the incoming request at the server level, before any client-side processing occurs.

The server stores the click ID in two places. First, in the WooCommerce session — tied to a first-party cookie set via an HTTP Set-Cookie header from your own domain, which ITP does not cap. Second, in the order metadata when the user begins checkout, ensuring the click ID persists even if the session expires before purchase.

At conversion, the server sends the stored click ID to the appropriate platform via its server-side API. For Google, that is Enhanced Conversions — which sees up to 35% higher conversion accuracy than click ID-only setups according to Segment data. For Meta, it is CAPI. For Microsoft, it is the UET offline import. The click ID that Safari deleted from the browser still reaches the ad platform through a path the browser cannot interfere with.

For WooCommerce stores running the Transmute Engine™, this capture happens automatically at landing for every click identifier — gclid, fbclid, msclkid, dclid, and the newer oppref from ChatGPT Ads. The click ID is stored server-side, bridged to the order, and routed to every platform that needs it. When Apple expands stripping to all sessions, the pipeline does not change. The same server-level capture that works today works tomorrow.

You may be interested in: ChatGPT Is a New Conversions API to Own, Not a New Pixel to Bolt On

Key Takeaways#

• iOS 26 strips gclid, fbclid, msclkid, and dclid from ad URLs: Currently in Private Browsing, Mail, and Messages by default. Safari Technology Preview shows all-session stripping is the likely next step.
• UTM parameters survive: Apple targets user-identifiable click IDs, not aggregate campaign-level parameters. Campaign attribution in GA4 continues to work; click-level attribution for bidding optimisation does not.
• Three systems fail without click IDs: Conversion reporting drops, Smart Bidding trains on biased data, and remarketing audiences shrink — all disproportionately affecting the higher-value Safari audience.
• 20% of Safari sessions already lose gclid: With Safari at 24% of global traffic and over 50% of US mobile, the scale is not theoretical.
• Server-side capture is the only durable fix: Read the click ID from the HTTP request at landing before Safari can strip it, store it in the WooCommerce session, and send it via Enhanced Conversions or CAPI at purchase.

References#

• Apple WWDC 2025 / WITHIN — iOS 26 Link Tracking Protection expanded to Private Browsing, Mail, Messages by default (September 15, 2025)
• Luc Nugteren via PPC Land — Estimated 20% of Safari sessions experience gclid stripping under current defaults (April 2026)
• Backlinko — Safari holds approximately 24% of global browser traffic; number one US mobile browser with over 50% share (April 2026)
• Opensend — 60-70% of iPhone users upgrade within 3 months of new iOS release (historical pattern, 2026)
• Apple WebKit / WITHIN — UTM parameters survive Link Tracking Protection; only user-identifiable click IDs stripped (2025)
• Stape — Safari Technology Preview builds show click ID stripping across all standard browsing sessions (October 2025)
• Segment via Seresa — Enhanced Conversions with first-party data sees up to 35% higher conversion accuracy than click ID-only setups (2025)
• LinkUTM — Field observation: 10-30% of Safari client IDs rotate every week due to ITP cookie caps (2026)
• Octanist — Click IDs stripped in Private Browsing confirmed; standard browsing under observation (September 2025)

If your WooCommerce store runs Google Ads or Meta Ads and a quarter of your traffic comes from Safari, the click IDs your attribution depends on are already disappearing. See how Seresa’s server-side pipeline captures every click ID before Safari can strip it.