How iOS Privacy Changes Made Server-Side Tracking Essential

Apple's Privacy Timeline

Apple has made a sustained, systematic effort to limit cross-site and cross-app tracking. Understanding the cumulative impact of these changes explains why server-side tracking has moved from "advanced feature" to "essential infrastructure" for many advertisers.

Safari Intelligent Tracking Prevention (ITP)

Starting in 2017 and progressively strengthened through 2022, Safari's ITP has:

• Blocked third-party cookies by default
• Limited JavaScript-set first-party cookies to 7 days (down from 2 years)
• Capped storage for sites identified as cross-site trackers
• Stripped click ID parameters (including gclid and fbclid) from URLs when navigating between sites

The practical effect: a returning Safari visitor who comes back to your site after 8 days appears as a completely new user. A campaign that drives users to your site and converts them two weeks later gets no conversion attribution in Safari.

Server-side tracking addresses ITP by setting the _ga identification cookie via HTTP Set-Cookie header from your own server — bypassing ITP's 7-day JavaScript cookie restriction entirely. Server-set first-party cookies last the full configured expiration (2 years).

App Tracking Transparency (ATT) — iOS 14.5, 2021

ATT required apps to request explicit permission before tracking users across apps and websites. Before ATT, Meta could track iOS users who clicked a Facebook ad, visited your website in Safari, and later converted — all linked through the Advertiser ID (IDFA). After ATT, most users opt out, severing this link.

Impact on Meta advertising: dramatic increase in "unattributed" conversions. Meta campaigns appeared to have far fewer conversions than actually occurred, causing Smart bidding to underspend on high-performing audiences.

Meta's Conversions API (implemented via sGTM) addresses ATT by sending conversion events server-to-server with hashed email addresses — allowing Meta to match conversions to users through their email identity rather than the now-blocked IDFA.

Link Decoration Filtering

Safari strips query parameters including fbclid and gclid from URLs when a user clicks a link that crosses domains. If a user clicks a Google Ad, gets redirected, and a redirect strips the gclid parameter, Google Ads loses attribution for that click.

Server-side tracking can mitigate this in two ways:

1. Capture the GCLID on the server before any redirects occur and store it in a server-side session
2. Use server-to-server conversion uploads that do not rely on the client-side GCLID cookie

Private Relay (iOS 15)

iCloud Private Relay routes Safari traffic through two separate internet relays, masking the user's IP address and location from both websites and network providers. This affects server-side tracking by making IP-based geolocation less reliable for Safari users using iCloud+.

The Cumulative Effect

No single Apple privacy change broke tracking. The cumulative effect across 6+ years of progressive restrictions has created a tracking environment where iOS Safari users — a substantial portion of mobile traffic in many markets — are significantly less trackable using client-side methods.

Server-side tracking addresses the majority of these restrictions:

• ITP cookie restriction → fixed by server-set cookies
• ATT Meta attribution loss → addressed by CAPI with hashed email
• GCLID stripping → mitigated by server-side GCLID capture and offline conversion uploads

Summary

Apple's privacy changes have made iOS Safari users substantially less trackable through client-side methods. Server-side tracking is the technical response — restoring data quality for this important segment through server-set cookies, server-to-server API connections, and alternative user identification methods.

See our Server-Side Tracking service for iOS-resilient tracking setup.

Worried about your iOS tracking gaps? Contact Adslytics.