iOS 26 Link Tracking Protection: Which URL Parameters Survive?
Safari now strips click identifiers like gclid and fbclid from your campaign links. UTMs still pass. Here is what that means for app install measurement, and how to keep attribution working with first-party links.
Your campaign link is not arriving the way you sent it
Link Tracking Protection started in iOS 17 as a Private Browsing, Mail, and Messages feature. With iOS 26, shipped in September 2025, Apple turned it into default behavior: Safari removes known ad-click identifiers from URLs as users tap them, alongside stronger fingerprinting protection. Analyses by Singular and WITHIN both landed on the same summary — the click IDs ad platforms rely on are gone from a growing share of iOS traffic.
If your install campaigns route through links carrying gclid or fbclid, part of your iOS traffic now shows up as untracked direct visits. The clicks did not stop. Your visibility did.
What Safari keeps, what it removes
The parameters that get removed
The protection targets parameters that identify an individual click and, indirectly, an individual person. The exact list evolves with Safari releases, but the pattern is consistent: platform click IDs are the target.
gclidGoogle AdsfbclidMetamsclkidMicrosoft AdstwclidX Adsmc_eidMailchimpThe parameters that survive
UTM parameters describe a campaign, not a person, and Apple has left them alone: utm_source, utm_medium, utm_campaign, utm_term, and utm_content all pass through. So do your own first-party parameters, such as a coupon code or a content ID, as long as they do not look like per-user identifiers.
That distinction is the whole playbook. Measurement built on campaign-level, first-party parameters keeps working. Measurement built on per-click identifiers owned by an ad platform keeps degrading, one privacy release at a time.
This is a pattern, not an event
Zoom out and the direction is unambiguous. Every third-party identification mechanism the mobile industry leaned on is shrinking or gone, and each one took a slice of attribution accuracy with it.
global ATT opt-in rate in 2026 — the App Tracking Transparency prompt is a dead end for most iOS measurement
Moburst, 2026
Google cancelled Privacy Sandbox for Android, including the Attribution Reporting API, after four years of development
RocketShip HQ
of US Google searches end without any click, so the clicks you do get carry more weight than ever
Search Engine Land, 2026
The first-party measurement playbook
Move measurement to the redirect layer
A smart link records the click server-side before any browser policy applies. OS, device, country, and referrer are captured at redirect time, whether or not the destination URL keeps its parameters.
Standardize on UTMs and your own parameters
Tag campaigns with UTM values and first-party keys you control. They survive Safari, they are readable by your own analytics, and no platform can deprecate them.
Forward parameters through the redirect
Parameter forwarding copies incoming campaign values onto whichever destination the visitor is routed to — store page, deep link, or web fallback — so context arrives even when the journey crosses an app boundary.
Compare link-level and platform-level numbers
Expect ad platform dashboards to undercount iOS. Server-side click counts from your links give you the denominator the platforms no longer see.
Set it up in Appy
- 1Create a smart link per campaign, with UTM parameters in the destination or appended to the link.
- 2Enable parameter forwarding on Business links so campaign values follow the visitor to the store, deep link, or web fallback.
- 3Use the analytics dashboard for click counts by OS and country, and export CSV or JSON when you need to join link data with install data.
- 4Audit any saved links still carrying platform click IDs, and treat those values as unreliable on iOS traffic.
Frequently asked questions
Does Link Tracking Protection break my links entirely?
No. The link resolves and the visitor arrives. Only the listed tracking parameters are removed from the URL. Routing, and any parameters that are not on the stripped list, work normally.
Are UTM parameters at risk next?
Nobody outside Apple knows. UTMs are campaign-level rather than person-level, which is the line Apple has drawn so far. Building on first-party, campaign-level parameters is the most durable option available today.
Does this affect Android or in-app browsers?
Link Tracking Protection is a Safari and Apple-apps behavior. Chrome on Android does not strip these parameters today, but in-app browsers apply their own rules, which is another reason to measure clicks at the redirect layer rather than the landing page.
Can Appy restore a stripped gclid?
No one can — the parameter is removed on the device before the request leaves it. What a smart link restores is visibility: the click itself, its device context, and every parameter you control are recorded server-side.
Continue exploring
Parameter Forwarding for Deep Links, Universal Links, App Stores, and Web
Learn how to preserve campaign and context parameters across app opens, app-store redirects, Universal Links, and web fallbacks without overwriting destination values.
How to Track QR Code App Installs Without Guessing
A practical measurement setup for QR code app install campaigns, including redirects, UTMs, first-open events, and reporting.
One Link for the App Store, Google Play, and Huawei AppGallery
A Google Play link is a dead end on a Huawei phone. Learn how one smart link routes every Android visitor to a store that actually exists on their device.
Looking for something else? Browse all topics on the blog.
Measure clicks where policies cannot reach them
Route every campaign through a link that records clicks server-side and forwards the parameters you own to app, store, and web destinations.
Create a free smart link