Link tracking not working on mobile: where iOS 17, Safari and in-app browsers lose the click

Link tracking not working on mobile usually traces to one of 5 causes: an in-app browser such as Instagram or Facebook, a Safari cookie capped at 7 days, a parameter that iOS 17 Link Tracking Protection removed, an app that sent no referrer, or an Android App Link or iOS universal link that opened your app instead of your page.

Each leaves the same trace: mobile clicks climb while signups stay flat or arrive as Direct.

Why link tracking is not working on mobile

In-app browsers keep their own storage

I would not trust a published list of which apps keep cookies, since each app can change its browser in any release, so run the test below.

The open-source Matomo Device Detector lists the User-Agent patterns apps use, and this regex applies them at the redirect.

1// Tokens from Matomo Device Detector. Apps change them between releases, so confirm with a click from your own phone.2// Facebook: FBAN/, FBAV or MetaIAB | Instagram: Instagram + version | LinkedIn: LinkedIn, LinkedInApp3// TikTok: TikTok, musical_ly_, com.zhiliaoapp.musically | Snapchat: Snapchat/ + version4const IN_APP = /FBAN|FBAV|MetaIAB|Instagram|LinkedIn|TikTok|musical_ly|Snapchat/i;5 6app.get("/:code", async (req, res) => {7  const inApp = IN_APP.test(req.get("user-agent") || "");8  // store inApp on the click row so reports can split in-app traffic from Safari and Chrome9  // ...then log the click and redirect as usual10});

Safari deletes cookies that JavaScript writes

A signup on October 13 traces back only if an ID in the URL, an email captured earlier or a visitor ID on the payment connects it to the click row.

A script that rewrites its cookie on each page view restarts the 7 days.

ITP is a WebKit feature, so Google Chrome on Android applies none of it, and Google's update of April 22, 2025 kept third-party cookies a choice in Chrome's settings.

iOS 17 removes some parameters before your server sees them

Apple announced Link Tracking Protection on June 5, 2023 for links in Messages, Mail and Safari Private Browsing, and shipped it in Safari 17.0 on September 18, 2023. Apple names no parameters.

Stape's update of August 6, 2025 says gclid and fbclid may be stripped in Private Browsing, Mail and Messages, while Private Browsing keeps utm_ tags.

The click still arrives, and a source in the path of a link you own, such as go.example.com/spring-launch, reaches your server whatever happens to the query string. The iOS 17 Link Tracking Protection post tests each place a link opens.

Blank referrers, app links and preview fetches

Google Analytics 4 files a visit under (direct) / (none) when a redirect or URL shortener strips its source, Google's help page says.

Many app browsers send no Referer either, so TrackRev's Smart Links, which infer a channel from it, record such clicks as Direct.

A link per channel with utm_source and utm_medium set at the redirect avoids that, and the post on GA4 not showing revenue by channel covers the reporting.

A link whose domain is tied to your app can skip the browser. Apple universal links launch the app, Android App Links open it without a disambiguation dialog, and no pixel loads.

The Google Play Install Referrer API returns an installed package's referrer URL. The deep linking guide covers the app side.

Link previews inflate clicks, so TrackRev flags bots and still redirects them. The bot filtering guide has the signals.

Test your own links on real phones

1<pre id="out"></pre>2<script>3  var seen = document.cookie.match(/mt=(\d+)/);4  if (!seen) document.cookie = "mt=" + Date.now() + "; Max-Age=2592000; Path=/; Secure; SameSite=Lax";5  document.getElementById("out").textContent = [6    "UA: " + navigator.userAgent,7    "Referrer: " + (document.referrer || "(empty)"),8    "Query: " + (location.search || "(none)"),9    "Test cookie: " + (seen ? "kept, first set " + new Date(+seen[1]).toISOString() : "new this visit")10  ].join("\n");11</script>

Size the gap before you rebuild anything

Android is a fair control because none of Apple's rules apply to it. Post 1 link in 1 campaign, then compare conversion rates by platform.

Write the visitor ID onto the payment

An ID stored on the payment cannot expire with a cookie: Stripe Payment Links take client_reference_id as a URL parameter, and Stripe Checkout Sessions take both fields below.

A "How did you hear about us?" signup field backs it up, as in self-reported versus tracked attribution.

What TrackRev does about this

TrackRev is SaaS affiliate software with link tracking built in, and a TrackRev link redirects with a 302 and logs the click on the server before your page loads: time, country, city, device, browser, operating system and referrer.

The redirect adds the saved UTM tags and a _vid parameter to the destination. The pixel reads _vid on the first page view and writes a vid cookie with JavaScript, so Safari's 7-day limit applies to that copy.

The first-party tracking page lists what a link records.

A Stripe charge joins to its click through metadata.vid, then Stripe Checkout's client_reference_id, then the customer's email.

The browser breakdown has no in-app bucket, and an in-app visitor who returns in Safari without _vid joins a payment to the click only through an email identified earlier or a visitor ID already on the payment.

A link can also send iOS, Android and desktop visitors to different destinations, such as an App Store listing for iPhone taps. If you only want sessions by source, tagged links and Google Analytics 4 are free.