Does Safari strip click IDs from links

There were multiple changes to Safari tracking prevention in the last two years. Some announcements about Safari tracking prevention and click ID stripping did not agree with the released software. In this post we summarize Apple announcements and WebKit and Safari documentation to describe how and when Safari removes click IDs to prevent tracking.

Different tracking prevention modules

Safari has two different tracking prevention modules.

Intelligent Tracking Prevention (ITP) operates on cookies. ITP does not operate on URLs. Safari examines the domain that sends the click. If Safari classifies the domain as a tracker, ITP decreases the life of the first-party cookies. In some conditions, the cookie life is 24 hours. The click ID stays in the URL. Your server receives the click ID. But the cookies do not stay for a long time. This is the cause of a known problem: analytics tools count one Safari visitor as two or more different users.

Link Tracking Protection (LTP) removes parameters from URLs. LTP removes the click ID parameters (gclid, fbclid etc) before navigation to the target URL. Thus, click IDs can’t be tracked. Even in latest IOS versions, LTP is turned off by default.

Applicable conditions for LTP

When LTP was announced in June 2023, Apple outlined the limited scope of the link tracking protection in its announcement title: “Link Tracking Protection in Messages, Mail, and Safari Private Browsing.” (Source: Apple Newsroom, June 2023)

The WebKit team shares more specifics in the post Private Browsing 2.0. The post identifies LTP as a function of Private Browsing in Safari 17.0 (and later versions). While some of the tracking prevention functions apply to all the browsing modes, LTP is not in that list. However, a user can set LTP to ‘on’ for all the browsing modes manually. To do this, the user sets “Advanced Tracking and Fingerprinting Protection” to “All Browsing” in the Safari advanced settings. However, the initial value of this setting is “Private Browsing”: LTP is not enabled for non-private browsing by default.

Furthermore, even when LTP is on it does not remove all the parameters. Safari removes only the parameters that identify one user or one click. For example, a known click ID parameter like gclid would be removed but anonymized click IDs like wbraid or gbraid and UTM parameters will be kept.

Safari 26: the announcement and the released software

Apple made announcements about Safari 26 in June 2025. The released software of September 2025 is different from the announcements, which caused a lot of confusion in press coverage. This is the sequence of the events:

1. June 2025. Apple announces iOS 26. The announcement includes this text: “advanced fingerprinting protection extending to all browsing by default.” This text refers to Advanced Fingerprinting Protection (AFP). AFP is a defense against fingerprint scripts. AFP is not LTP. But Safari also has a setting with the name “Advanced Tracking and Fingerprinting Protection” (ATFP). The ATFP setting includes LTP. The two names are almost the same. Because of this, many persons thought that the announcement referred to ATFP and LTP.

2. The beta release notes. The Safari 26 beta release notes included this item: “Added support for filtering tracking parameters in links in regular browsing mode” (item 134226694). This item said that LTP will operate in the standard browsing mode. Tests of the Safari Technology Preview software showed this operation: the software removed gclid in the standard browsing mode.

3. September 15, 2025. Apple released Safari 26.0. Item 134226694 is not in the final release notes. Tests of the released Safari 26 demostrated that the server still receives all the usual parameters in the standard browsing mode. Jeff Johnson examined the ATFP setting in the released software. The initial setting for LTP remained “Private Browsing.” An Apple engineer told Johnson that this value did not change. Apple did not give the reason for the change of plan.

While Safari 26 applied AFP to on for all browsing modes, it didn’t enable LTP for the standard browsing mode by default. A number of incorrect reports based on the Safari 26 beta were published, but the planned change was retracted from the release and isn’t a part of Safari presently.

Conclusions

1. The click IDs still function in the standard Safari browsing mode today. If your Safari attribution data decreased, it’s likely caused by ITP cookie duration limit, rejected tracking consent or incorrect tracking setup. Able CDP server-side tracking solves this by recording click identifier as early as possible, storing it together with user personal details, so that when an eventual conversion occurs after the ITP cookie duration limit it’s attributed to the click ID without relying on cookies.

2. LTP removes the click IDs conditionally. LTP operates on all the links from Apple Mail and Messages, and in Private Browsing. This can have a significant impact on tracking of email campaigns, but doesn’t affect most online ad clicks.

3. Ad platforms adapted to the change. Google Ads introduced Apple-friendly click IDs that are shared between several users and thus are excluded from LTP scope. They allow to identify ad and campaign but not the user. Meta uses a similar approach where it can identify a click from its IOS app rather precisely even when a click ID is not available, provided the correct data provided to the Conversions API.

An attribution system can be safe against ITP and LTP. To make a safe system, obey these rules:

• Do not rely on cookies to store the identity data.
• Connect the identity to permanent keys, for example the email address from a form or a checkout.
• Attribute conversion to the originally stored click ID when it occurrs based on server-side data.

This is the approach used by Able CDP’s server-side tracking.