iOS and Android Privacy Changes Are Quietly Breaking Click Attribution — Here's What Still Works

A Timeline of What Changed

Apple's App Tracking Transparency (ATT), introduced in iOS 14.5, requires apps to explicitly ask permission before tracking a user across other apps and websites — most users decline. Safari's Intelligent Tracking Prevention (ITP) restricts third-party cookies and caps the lifetime of client-side tracking scripts. Chrome has phased in its own third-party cookie restrictions through the Privacy Sandbox initiative. Each of these changes independently removed a piece of the click-tracking stack that marketing tools relied on for a decade.

Why Pixel-Based Tracking Is the Most Affected

Tracking pixels and third-party cookies work by having a user's browser make a request to a tracking domain that isn't the site they're visiting, then reading or writing an identifier tied to that domain. Every privacy change listed above targets exactly this pattern: cross-site identifiers set by a party other than the site the user is actually on. As these are restricted, attribution methods that depend on them degrade — sometimes silently, with dashboards continuing to show numbers that are quietly less accurate than they used to be.

Why Server-Side Redirect Logging Isn't Affected

A short link redirect works differently. When someone visits pocolink.com/your-slug, the click is recorded at the moment the server looks up the destination and issues the redirect — first-party, no cookie required, no cross-site identifier involved. The click either happened or it didn't; there's no permission dialog to decline because no cross-site tracking identifier is being set in the first place. This is the same reason server logs have always been a reliable baseline metric, even before privacy regulation targeted client-side tracking.

What You Lose With This Approach

Being clear about the trade-off matters. Server-side redirect logging tells you a click happened, from what approximate device, browser, and location, and via what short link — but it doesn't build a cross-session profile of the same person's behavior across unrelated sites, because it was never designed to. If your attribution needs specifically require stitching together a single user's behavior across multiple, unrelated properties over time, this approach won't do that — and increasingly, neither will most other methods without running into the same privacy restrictions.

Click IDs and Link Tracking Protection

Some platforms have also started removing known tracking parameters from URLs in certain contexts. Apple's Link Tracking Protection, for example, strips identifiers such as advertising click IDs from links in Mail, Messages, and Safari Private Browsing. The practical lesson is not to rely on a single parameter surviving the journey. Ordinary campaign tags such as utm_source are generally not the target of these protections, but you should verify how any parameter you depend on behaves on real devices rather than assuming it.

A Privacy-Resilient Measurement Checklist

• Give each channel its own short link so attribution doesn't depend on any cookie or identifier.
• Keep campaign tags on the destination URL for your on-site analytics, but treat them as helpful rather than guaranteed.
• Compare trends over time instead of trusting individual conversions, since some conversions will always be unattributed.
• Collect first-party information voluntarily — for example, a "how did you hear about us?" field on sign-up forms — which often fills the gaps that tracking can't.
• Document what you do and don't track, and say so in your privacy policy.

Why Asking People Still Works

One of the oldest attribution methods is also one of the most durable: ask. A short optional question at sign-up or checkout ("Where did you first hear about us?") captures the influence of private shares, podcasts, and word of mouth that no tracking system can see. It is self-reported and imperfect, but it complements click data well, and it doesn't depend on any identifier that a privacy setting can remove.

The Practical Takeaway

For campaign-level and channel-level attribution — which link drove how many clicks, from where, on what device — first-party server-side logging via distinct short links per channel has become more reliable relative to pixel-based methods, not less, precisely because it was never dependent on the mechanisms privacy updates are removing. As pixel-based attribution keeps eroding, this is one of the few measurement approaches that doesn't need a workaround.