Biggest pain in web tracking - iOS 17 and Safari

Once upon a time, web tracking was straightforward.

With the release of iOS 17 and the latest versions of Safari, Apple made it much worse. Several privacy features now significantly impact web tracking. This affects how events are delivered to tools like GTM, GA4, Google, and Meta Ads. We noticed that majority of mismatching frontend events are coming from Safari and iOS. So it only makes sense to dive into that and go through all the known features.

What do iOS 17 and Safari Do?

1. Intelligent Tracking Prevention (ITP):

   Safari's ITP limits the ability of websites to track users across different websites. Third-party cookies are blocked by default, and first-party cookies are restricted, reducing the efficacy of cross-site tracking.

2. Private Relay:

   A feature in iOS 17 that hides users' IP addresses from websites. It prevents websites from accurately tracking user locations and demographics.

3. App Tracking Transparency (ATT):

   Requires apps to get user permission before tracking their data across apps or websites owned by other companies. Many users opt out of tracking, leading to a significant drop in available tracking data.

4. Enhanced Privacy Features:

   New features such as Mail Privacy Protection prevent email senders from knowing when and where an email was opened. Reduces the ability to track user engagement through email.

These are not only something that users can turn on. Tracking possibilities are limited by default:

Third-party cookies are completely blocked, preventing advertisers from tracking users across different sites. First-party cookies are limited to a seven-day expiry period, hindering long-term tracking.

Private Relay: user IP addresses are masked, making it difficult to track users by location and create accurate user profiles.

User Opt-In Requirement. Users must explicitly opt-in to allow tracking across all apps. Many users decline, drastically reducing the amount of trackable data.

Limited Script Execution. Safari's enhanced content-blocking features limit the execution of tracking scripts from third-party domains. In other words, custom events may not be tracked.

This leads to different effects on websites. The accuracy of reports suffers, as well as the ability for effective ad targeting. User experience can be affected by limited options to personalize content.

Strategies to mitigate impact

Server-Side Tracking. Implement server-side tagging to bypass some client-side restrictions and regain some tracking capabilities.

Use tools like Google’s Enhanced Conversions to get more accurate data from user interactions. This means collecting more data that the user provides. Then it can allow more precise matching with other touchpoints.

First-Party Data. This is easy, is the user logins to the website, we know everything. Focus on collecting first-party data through direct interactions with users. Such as through subscriptions and loyalty programs.

Understanding these limitations and adopting strategies to mitigate their impact is crucial. The web environment will only get more complex, so the only way is to evolve.