iOS 17 Link Tracking Protection and what happens to click IDs
iOS 17 shipped on September 18 with a feature that strips tracking parameters from some links. Here is where it applies, what reportedly survives, and how to make web-to-app tracking more resilient.
iOS 17 went out to iPhone users on September 18, and with it came a Safari feature that removes identifying parameters from URLs. Apple's name for the setting is Advanced Tracking and Fingerprinting Protection, but most marketing coverage calls it Link Tracking Protection. If your campaigns send people to web pages with click IDs or other parameters attached, it is worth understanding before you read anything into a change in your numbers.
Where it applies
As MacRumors described it in June, when iOS 17 was in beta, the feature automatically removes tracking parameters from URLs in Safari's Private Browsing mode and from links shared in Messages and Mail. Links keep working, but they stop carrying the identifiers advertisers could use to follow activity across sites. In regular Safari browsing the protection is off by default, and users can turn it on under Settings, Safari, Advanced, Advanced Tracking and Fingerprinting Protection, by choosing All Browsing.
That default matters. Most paid clicks on mobile land in standard browsing or inside an in-app browser, so the immediate effect should be limited. The risk is that some share of users will opt in, and that private sessions and links passed through Mail and Messages will lose their parameters.
What gets stripped and what does not
Apple has not, as far as we could find, published a full list of the parameters it removes, and MacRumors gives only a single example. Marketing vendors that tested the beta have reported that identifiers used for cross-site tracking are removed, which in practice means ad click IDs of the kind Google and Meta append to landing page URLs. They have also reported that standard campaign parameters, such as the UTM tags used to name a source, medium and campaign, remain intact. Treat these as third-party observations, and test your own links.
The test is simple: open an ad's landing page in Safari with the setting set to All Browsing, and in a private tab, and see which parameters survive in the address bar and in your analytics.
Why click IDs matter
A click ID is how an ad platform ties a site visit to the ad that produced it. When it is removed, the platform can still see the click happened on its side, but your site cannot send the ID back with a conversion. The result is conversions that cannot be matched to ads, so reported results undercount rather than being wrong in an obvious way.
The effect depends on the share of your traffic using the affected paths. If you have not measured that share, do so before changing anything. Check what portion of your mobile Safari sessions arrive with and without click IDs, and whether that proportion moves in the weeks after the release.
Practical steps
- Keep UTMs on every link. They survive the protection according to vendor tests, so they let you keep channel-level reporting even when a click ID disappears.
- Use the platforms' own matching. Send conversions from your server using Meta's Conversions API and Google's enhanced conversions, which can match on customer data you collect with consent, not on a URL parameter.
- Capture identifiers early. If your site stores a click ID in a first-party cookie on arrival, a later page that loses the parameter does not lose the ID. Check that your tags do this on the landing page.
- Review web-to-app handoffs. If a web page passes parameters into an app install link or deep link, confirm that your measurement partner can still attribute without them.
- Compare against a stable baseline. Total orders or installs in your own backend are unaffected by URL stripping, so use them to judge whether performance moved or only reporting did.
What not to conclude
Do not read a dip in platform-reported conversions in late September as a drop in demand without checking backend totals. Similarly, do not assume the effect will stay small. Apple controls the default, and the scope of the feature could change in later releases. Building tracking that depends less on URL parameters is the durable fix.
The takeaway is to spend an hour testing your own links on iOS 17, then fix the setup so that a lost click ID does not mean a lost conversion.