iOS 14 Tracking: How to Recover Your Conversion Data in 2026

Answer: iOS 14 gave conversion loss its name, but in 2026 most of the damage on Apple devices happens in Safari, not apps. App Tracking Transparency only governs apps. Safari’s ITP caps cookies at seven days and iOS 26 strips gclid and fbclid from every Safari session. Recovery means server-set first-party cookies, server-side delivery, and enhanced matching.

People still search “iOS 14 tracking” five years after iOS 14.5 shipped, and the pages that rank still answer the 2021 question: what is App Tracking Transparency, why did Meta’s attribution windows shrink, how do you set up the Conversions API. All of that happened. Almost none of it is why you are losing conversion data on Apple devices today.

iOS 14 was the moment tracking loss got a name. What actually breaks your measurement in 2026 is three separate Apple systems, shipped years apart, that break three different things. The fix depends entirely on which one you are losing to, and the ranking content on this keyword blurs them into one problem with one answer (“set up CAPI”). That answer is half right, and the half it gets wrong is the half that costs you money.

The three systems people call “iOS 14 tracking”

That table is the whole diagnosis, and it is worth being direct about what it means. If you run web campaigns and no app, ATT was never your problem. Your problem in 2021 was ITP eating your cookies. Your problem in 2026 is that plus LTP eating the click IDs those cookies were supposed to store. The searcher typing “iOS 14 tracking” into Google today almost always has a Safari problem wearing an app problem’s name.

ATT: the part that ended

App Tracking Transparency is a consent prompt for apps that want to read the device’s advertising identifier. Users who decline become invisible to cross-app attribution, which is why app marketers moved to SKAdNetwork and its successor AdAttributionKit. If you attribute app installs, that is a real discipline with its own tooling, and it is not what the rest of this post is about.

For web advertisers, ATT changed one thing that mattered: Meta could no longer match as many iOS users between its apps and your website, so reported conversions dropped and attribution windows shrank from 28 days to 7-day click and 1-day view. The industry read that drop as “iOS 14 broke tracking” and reached for the fix Meta offered, the Meta CAPI setup guide approach of sending events server to server. Good fix. Wrong diagnosis for the losses that kept growing after.

ITP: the part that never stopped

Safari’s Intelligent Tracking Prevention predates iOS 14 and has tightened almost every year since 2017. The constraint that matters for conversion tracking: a first-party cookie written by JavaScript lives at most 7 days, and in some cross-site navigation cases 24 hours. Your ad click lands, your tag writes the click ID into a cookie, and if the buyer takes eight days to decide, Safari has already deleted the evidence. The conversion fires, nothing connects it to the click, and the platform reports nothing.

The distinction that decides everything here is who set the cookie. Server-set first-party cookies, written in an HTTP response header from your own domain, are not subject to the 7-day JavaScript cap. That single implementation detail is most of the difference between the 60 to 70 percent capture rates of a pixel-only setup and the near-complete capture that a properly built server side conversion tracking setup reaches, with about a 98 percent match rate on the conversions it captures. This is the same mechanism that decides the broader client side vs server side tracking question, so if that framing is new, start there.

LTP: the part the “iOS 14” content has not caught up with

Link Tracking Protection is the active front, and it is remarkable how little of the ranking content mentions it. Since iOS 17 in 2023, Safari has stripped known tracking parameters from URLs in Private Browsing and in links opened from Mail and Messages. With iOS 26, announced at WWDC 2025 and rolling out since September 15, 2025, that stripping extends to all Safari sessions by default.

Concretely, as of the iOS 26 rollout: gclid and fbclid are removed from URLs at Safari scale. The aggregate Google identifiers gbraid and wbraid survive, because they attribute at campaign level rather than user level, which is precisely why Google built them. UTM parameters survive, because Apple treats generic campaign labels as acceptable. So an iOS 26 Safari user who clicks your Google ad arrives with campaign context and no per-click identity, and no amount of server-side plumbing after the landing page can recover a parameter that was never delivered to it.

That last sentence is the argument the SERP is missing, so here it is as plainly as we can put it.

CAPI is delivery, not recovery

Every page ranking for this keyword ends at the same instruction: implement the Conversions API. Server-side delivery is necessary. It gets your conversion event past ad blockers and browser restrictions and into the platform reliably. But delivery is the last step of the pipeline, and the iOS losses happen at the first step, capture. A server-side event with no click ID and no matchable identity arrives promptly and attributes to nothing.

Recovery on Apple devices is a capture-time discipline with a strict order of operations:

The capture logic itself is not complicated. This is the shape of it:

// First-touch capture, ES module. Runs on landing; the server sets the cookie.
const CLICK_IDS = ['gclid', 'gbraid', 'wbraid', 'fbclid', 'msclkid', 'ttclid', 'oppref'];

export function captureClickData(url = new URL(location.href)) {
  const found = CLICK_IDS
    .filter((key) => url.searchParams.has(key))
    .map((key) => ({ key, value: url.searchParams.get(key) }));

  const utm = Object.fromEntries(
    [...url.searchParams].filter(([k]) => k.startsWith('utm_'))
  );

  // LTP case: no per-click ID survived, but campaign context did.
  // Persist UTMs anyway; they are the attribution floor, not a failure state.
  return fetch('/api/track/first-touch', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ clickIds: found, utm, landing: url.pathname }),
    // The response sets the first-party cookie server-side,
    // which is what exempts it from ITP's 7-day JavaScript cap.
  });
}

Note what the comment in the middle concedes: on iOS 26 Safari, the gclid case increasingly returns empty, and the honest design treats UTMs plus aggregate IDs as the working floor rather than an error path. This is also why the cookieless tracking playbook and the iOS playbook have converged. Apple simply got to the destination first.

This capture-then-deliver pipeline is exactly what Convultra runs as a product: one line of JavaScript, click IDs including gclid, gbraid, wbraid, fbclid, msclkid, ttclid, and oppref captured into server-set first-party cookies with 90-day retention, and conversions delivered server-side to Google Ads and OpenAI Ads today (Meta and Microsoft Ads coming soon) through their conversion APIs, with per-conversion delivery status you can read off a dashboard rather than infer from a platform’s reporting lag.

What recovery does not fix

Being precise about the ceiling is what separates a measurement plan from a sales pitch. Nothing recovers a click ID that was stripped before your page loaded; for that traffic, campaign-level attribution through gbraid, wbraid, and UTMs is the true maximum, and any vendor claiming per-click recovery there is describing fingerprinting, which Apple is actively hunting and which you do not want your brand attached to. Nothing recovers users who decline a lawful consent prompt. Nothing here fixes app install attribution; if your spend is in app campaigns, you need an MMP, and Convultra is the wrong tool for that job. And recovered data is a record of demand, not a source of it. What recovery does change is the training data your bidding algorithms learn from, and on iOS traffic that difference compounds: a bidder that cannot see Safari conversions quietly learns to stop buying Safari users.

FAQ

Does iOS 14 still affect ad tracking in 2026?

ATT itself is old news and app-specific. But the search term survives because Apple kept shipping: ITP still caps JavaScript cookies at 7 days, and iOS 26 extended click ID stripping to all Safari sessions. The losses people attribute to iOS 14 today mostly come from those two newer systems.

What is the difference between ATT and Link Tracking Protection?

ATT is a consent prompt governing the advertising identifier inside apps. Link Tracking Protection rewrites URLs in Safari, removing per-click parameters like gclid and fbclid. ATT affects app attribution, LTP affects web attribution, and they share nothing but a vendor.

Does the Meta Conversions API fix iOS tracking?

It fixes delivery: events reach Meta reliably, past ad blockers and browser restrictions. It does not fix capture. If no click ID or matchable identity was collected on the landing page, the CAPI event arrives anonymous. Pair it with server-set first-party data collection and advanced matching.

Are UTM parameters stripped by iOS 26?

No. Apple treats generic campaign parameters as acceptable, so utm_source, utm_campaign, and the rest pass through Link Tracking Protection intact. They attribute at campaign level, not click level, which makes them the floor of iOS attribution rather than the whole answer.

How do I recover conversions lost to Safari’s ITP?

Move cookie writing to the server. A first-party cookie set in an HTTP response from your own domain is not subject to the 7-day cap that applies to JavaScript-set cookies, so click IDs survive long consideration windows and connect delayed conversions back to their clicks.

Do gbraid and wbraid replace gclid on iOS?

For stripped Safari traffic, yes, they are what remains: aggregate, campaign-level identifiers Apple permits because they do not identify individuals. Capture and store them exactly as you would a gclid, and let your delivery layer send whichever identifier each conversion actually has.

Get your iOS conversions back on the record

Every conversion your tracking misses on an iPhone is a conversion your bidding never learns from, and Apple is not going to make this easier next year. Start a free Convultra trial and see how much of your iOS traffic you can actually measure, with the delivery receipts to prove it.