iOS 17 Link Tracking Protection: what it strips and what survives

iOS 17 Link Tracking Protection removes known tracking parameters from links in Messages, Mail and Safari Private Browsing, and Apple publishes no list of which ones.

According to Stape, gclid and fbclid are removed while utm_ tags still arrive in Private Browsing.

What survives lives outside the query string: a short code in the URL path, a click logged on your server, a cookie your server sets in a response, and a visitor ID stored with the payment.

What iOS 17 Link Tracking Protection does

Apple announced the feature on June 5, 2023, under the heading Link Tracking Protection in Messages, Mail, and Safari Private Browsing.

The extra information some websites add to URLs to follow people across other sites is removed from links shared in Messages and Mail, and from links in Private Browsing, and the links keep working.

The WebKit post for Safari 17.0, which reached iOS 17 on September 18, 2023, lists blocking known tracking query parameters in links among the Private Browsing changes. Neither page names a parameter.

Every list of stripped parameters therefore comes from outside Apple. Stape, a server-side tagging vendor, reports gclid and fbclid stripped in all 3 places, and the standard UTM tags kept in Private Browsing.

I found no Apple commitment to leave them alone.

Which parameters it removes

Mozilla's query stripping documentation names 8 parameters for Firefox 102 (June 28, 2022) in Strict mode and says no standard yet defines navigational tracking protection.

The W3C Privacy Community Group's March 2025 draft adds that Brave keeps a list of its own.

Where it applies

Stape's article, updated August 6, 2025, says Safari might extend the protection beyond those places in iOS 26 and that Apple had confirmed only the original three. I found no Apple statement that it did.

What Safari 26.0 added, according to WebKit's September 15, 2025 post, is a separate limit: known fingerprinting scripts can no longer read query parameters or document.referrer, and cannot set long-lived cookies or LocalStorage.

The post doesn't say which scripts count as known.

Apple privacy changes that cause similar symptoms

Litmus's July 2026 data puts Apple clients at 62.26% of email opens, ahead of Gmail at 27.03% and Outlook at 5.83%, and says Mail Privacy Protection affects roughly 55-60% of all opens, so open rates say little and clicks are the signal worth keeping.

Clicks inside Apple Mail are the ones Link Tracking Protection can touch. Our Safari ITP post covers the cookie rows from the revenue side.

What breaks in a SaaS funnel

Exposure follows the channel. Paid search mostly sits outside the 3 listed places: Google Ads adds gclid through auto-tagging, and a Google Search click that opens in an ordinary tab is not on Apple's list.

Newsletters are the exposed case, since a tap in Apple Mail is on it, and a source ID from Mailchimp or HubSpot, such as mc_eid or _hsenc, is the kind of parameter Firefox 102 already strips.

The cost shows up as misfiled revenue. Take 40 signups a month from one newsletter on a $39 plan, where every signup who arrives through Apple Mail loses its source ID.

What survives and why

A redirect that reads the path

A server log cannot recover a parameter that Safari removed before the request, so the click's identity goes in the path of a link you own, such as go.example.com/spring-launch.

The redirect logs the click, sets the visitor cookie and sends a 302 built from saved UTM tags.

1const crypto = require("crypto");2 3// go.example.com/spring-launch: the click's identity is the path, not a query parameter4app.get("/:code", async (req, res) => {5  const link = await db.links.findByCode(req.params.code);6  if (!link) return res.redirect(302, "https://www.example.com");7 8  let vid = req.cookies.vid;9  if (!vid) {10    vid = crypto.randomUUID();11    res.cookie("vid", vid, {12      maxAge: 365 * 24 * 60 * 60 * 1000, // one year, in milliseconds13      domain: ".example.com",            // readable by www, app and checkout14      secure: true,15      sameSite: "lax",16    });17  }18 19  await db.clicks.insert({20    linkId: link.id,21    vid,22    userAgent: req.get("user-agent"),23    referer: req.get("referer"),24  });25 26  const destination = new URL(link.destination);27  destination.searchParams.set("utm_source", link.utmSource);28  destination.searchParams.set("utm_medium", link.utmMedium);29  destination.searchParams.set("utm_campaign", link.utmCampaign);30  res.redirect(302, destination.toString());31});

Setting Domain=.example.com lets www.example.com, app.example.com and checkout.example.com read one cookie, which a shared shortener cannot offer.

Something must then carry the ID across the hop, usually a destination parameter, and the Privacy Community Group draft says Safari caps JavaScript cookies at 24 hours when that navigation comes from a domain it classifies as a tracker.

Apple publishes no classifier, so test your own hop on a phone.

WebKit's tracking prevention page exempts cookies set in an HTTP response from the 7-day cap unless it detects CNAME or IP-address cloaking on a first-party subresource.

A short link is a page navigation, so I read that rule as aimed at pixels on CNAME subdomains.

Store the visitor ID on the payment

A visitor who clicks on a Monday and subscribes 9 days later has lost a JavaScript cookie, while an ID stored on the payment cannot expire.

Write the visitor ID into the Stripe fields below when you create the Checkout Session. Stripe does not copy the session's metadata to the subscription, so set subscription_data.metadata too and each renewal invoice carries a snapshot of the source.

The Stripe metadata attribution setup post has the field mapping.

Test your own links on an iPhone

Open one URL that carries 6 parameters in each of these places and check which reach your server.

https://www.example.com/pricing?gclid=test1&fbclid=test2&utm_source=iostest&utm_medium=manual&utm_campaign=ltp&ref=test3

A parameter in the log after the Messages tap was not removed before the request. One missing from it was dropped on the device or in a hop, and the 5-step hop test finds which.

How TrackRev handles the click

TrackRev is SaaS affiliate software with link tracking built in, and a TrackRev link keeps its channel and UTM tags on the saved link, so the shared URL holds only a short code.

The redirect logs the click on the server, adds the saved tags and a _vid visitor parameter to the destination, and answers with a 302. A custom tracking domain takes one CNAME record pointed at cname.trackrev.io.

The pixel reads _vid on the first pageview and writes its own vid cookie with JavaScript, so Safari's 7-day cap applies and a visitor who returns later is new to the pixel.

When someone identifies, TrackRev binds the visitor ID to their email, and the hourly sync of the Stripe integration matches charges to clicks through it.

The pixel also adds the visitor ID as client_reference_id to Payment Links and Buy Buttons, and renewals keep crediting the original click.

The redirect forwards only the saved tags and _vid, so a gclid added to a short link at send time never reaches your page.

The Free plan covers 50 links and 1,000 tracked events a month for link tracking, with revenue figures hidden. Seeing revenue by channel needs a paid plan, from Indie at $29 a month (pricing).

If you only need sessions by source in Google Analytics 4, UTM tags that arrive and the naming rules in the UTM parameters guide go most of the way without another tool.