Cookieless link tracking in 2026: what Safari, Chrome and Brave allow

Link tracking without cookies means logging each click on your own server at the redirect, then carrying a random visitor ID through the URL, your database and the Stripe payment.

The request already says which link was hit, from where, by which browser and when, so counting needs no cookie.

Cookies matter only for recognizing the visitor later and tying them to a charge 14 days on, a week past the 7-day limit Safari has put on script cookies since Intelligent Tracking Prevention 2.1 in February 2019.

What browsers restrict

Chrome still allows third-party cookies. On April 22, 2025 Google kept its current approach, where users choose, and dropped the standalone prompt, and on October 17, 2025 it retired the Attribution Reporting API and Topics.

Redirect through your own subdomain: a shared short domain sending traffic to hundreds of sites looks like the 10-destination bounce pattern, and a subdomain that redirects to your own pages looks less like it, though I have measured neither.

WebKit offers no list of classified domains, so check the cookie's expiry in Safari Web Inspector after a click. A click that a blocker stops never reaches your database.

Take a 14-day trial with a click on day 0 and a payment on day 14. A page that rewrites the cookie moves these dates, as the Safari ITP guide shows.

Link tracking without cookies, from click to charge

Follow someone who taps a tracked link in Apple Mail on an iPhone, starts the trial and pays on day 14 from a laptop. The ID can sit in 5 places, and 2 of them belong to the browser.

The redirect writes a row with the timestamp, link, referrer, user agent, IP address and visitor ID, then answers with an HTTP 302 before any JavaScript runs.

Its Set-Cookie header makes a server-set cookie, which WebKit exempts from the 7-day deletion unless the response comes through third-party CNAME or IP address cloaking.

Max-Age=31536000 is 365 days, inside the 400-day ceiling Chrome has applied since M104 in August 2022.

$ curl -sI https://go.example.com/spring-launch
HTTP/2 302
location: https://www.example.com/pricing?utm_source=newsletter&utm_medium=email&_vid=3f0c9b1e-5d2a-4c7e-9a41-0b6e8d1f2c34
set-cookie: vid=3f0c9b1e-5d2a-4c7e-9a41-0b6e8d1f2c34; Max-Age=31536000; Path=/; SameSite=Lax; Secure

The redirect adds the ID to the destination URL, and the landing page saves it on the first page view.

Apple publishes no parameter list, so put what you cannot lose in the link path, as the iOS 17 guide explains.

At signup, save the ID on the user record in the same request as the email, before the 7-day ITP 2.1 cookie dies.

At checkout, copy the ID from the user record into the 3 Stripe Checkout fields below. The Stripe metadata attribution setup post maps them.

Ways to carry an ID

Plausible's data policy counts visitors with a daily hash of salt, domain, IP address and user agent, and deletes the salt every 24 hours. That suits traffic counts and cannot join a click to a later payment.

Consent after the cookie is gone

The EDPB's Guidelines 2/2023 (Version 2.0, adopted 7 October 2024) put tracking links under Article 5(3) of the ePrivacy Directive.

An identifier appended to a web address is collected when the URL is visited, which the Board treats as gaining access to the visitor's device, and its example is a store giving partners tracked links to pay commissions.

Section 3.1 says that holds even when the storage is brief, paragraph 56 leaves consent or an exemption to a case-by-case assessment, and paragraphs 54 and 55 say IP-only tracking can fall under the same article.

I'm not a lawyer, so check your own case with counsel; the affiliate compliance guide covers partner programs.

What a cookieless setup misses

A buyer who signs up with one email and pays with another breaks an email join, so the ID goes onto the payment. A phone click and a laptop payment with no login look like 2 visitors.

A podcast mention never reaches your server, so ask "How did you hear about us?" at signup.

A missing ID shows up in the report: a $1,500 newsletter placement brings 12 customers at $49 a month, and 5 of them arrive in Safari with no source and land in Direct.

The placement now looks 71% more expensive per customer ($214.29 against $125.00), and a team with a return threshold may cut a channel that works.

What TrackRev does at each step

TrackRev is SaaS affiliate software with link tracking built in. Its redirect sets a 365-day vid cookie, adds a _vid parameter and ties the click to revenue from Stripe, Paddle Billing, Polar, Lemon Squeezy, Creem or Dodo Payments.

The Free plan covers 50 links and 1,000 tracked events a month for link tracking, with revenue figures hidden. Revenue by channel needs a paid plan, from Indie at $29 a month (pricing).

A daily-hash analytics tool is simpler if you only want traffic counts, and a link that ends on an App Store listing logs the click but has no pixel or checkout of yours to carry the ID onward.

The first-party tracking page shows the product.