iOS 17 did not end ad tracking, and it did not bring a second shock like iOS 14.5. It tightened the screws in three places: it strips some click identifiers from certain links, it enforces tracking choices at the network level, and it makes app developers declare what they collect. For an Australian ecommerce brand, the practical result is patchier attribution, not a collapse in what your ads can do. This guide explains what changed, what it touches in your reporting, and what to do about it.
TL;DR
- iOS 17 added Link Tracking Protection, which removes click identifiers such as gclid and fbclid from links in Mail, Messages and Safari Private Browsing. UTM parameters are left alone.
- It builds on App Tracking Transparency from iOS 14.5, so the bigger hit to targeting and retargeting came earlier. iOS 17 adds enforcement and developer disclosure.
- Expect gaps in last-click reporting from some traffic, not a wholesale loss of data.
- The fix is a first-party data and measurement setup: consistent UTMs, server-side signals, consent handled properly and a sceptical read of platform dashboards.
- Australian privacy rules (APP 7) apply to how you use customer data for marketing, so tracking decisions are also compliance decisions.
Table of Contents
- What iOS 17 actually changed for tracking
- iOS 17 versus iOS 14.5: how they differ
- Link Tracking Protection: what is and is not affected
- How iOS 17 can affect ecommerce ads in practice
- Check whether iOS 17 is affecting your data
- How to adapt your tracking and measurement
- Australian privacy: tracking is also a compliance question
- What we think about iOS 17 and the privacy shift
- Get a measurement setup you can trust
- FAQ
- Sources
What iOS 17 actually changed for tracking
It helps to separate three things that often get lumped together as “iOS tracking changes”.
App Tracking Transparency (ATT), from iOS 14.5. This is the pop-up that asks people whether an app may track them. Apple’s support page explains that apps need permission to track your activity across other companies’ apps and websites. Without it, the app does not get access to the device’s advertising identifier (the IDFA). This is the change that hurt Meta and other app-based targeting and measurement most.
Enforcement and privacy manifests, from iOS 17. One analysis of the iOS 17 ATT updates describes iOS 17 as adding technical enforcement of existing privacy policies, plus privacy manifests that let apps and SDKs declare their data practices. According to Nielsen’s engineering documentation, if a user selects “Ask App Not to Track”, the app is blocked from sending web traffic to domains it has declared as tracking domains in its privacy manifest. That stops typical measurement pings from going out.
Link Tracking Protection (LTP), from iOS 17. Apple’s announcement says it removes tracking parameters, the extra information added to URLs, from links shared in Messages and Mail and from links in Safari Private Browsing. This is the piece most relevant to day-to-day ad reporting, so it gets its own section below.
In short: ATT changed who could be tracked across apps, and iOS 17 made those choices harder to bypass and trimmed the identifiers that ride along on links.
iOS 17 versus iOS 14.5: how they differ
| iOS 14.5 (ATT) | iOS 17 | |
|---|---|---|
| Core mechanism | Permission prompt for cross-app tracking and IDFA access | Link Tracking Protection, tracking-domain blocking and privacy manifests |
| Who it hits most | App-based targeting, retargeting audiences, in-app conversion reporting | Click-ID based attribution from private or shared links, SDK data collection |
| What it leaves intact | Contextual and first-party targeting | UTM parameters, first-party analytics, consented data |
| Typical symptom | Under-reported conversions in ad platforms, smaller retargeting pools | Some visits arrive without gclid or fbclid and look like direct or unattributed |
If your ad performance shifted sharply in 2021, that was ATT. If you see smaller, harder-to-explain gaps in attribution on traffic from email, messages or private browsing, iOS 17 is a likely contributor.
Link Tracking Protection: what is and is not affected
The detail matters here, because many articles overstate it.
Affected: per AppsFlyer’s bulletin, LTP removes gclid (Google Ads) and fbclid (Meta) from links shared in Mail and Messages, and from links in Safari Private Browsing.
Not affected: the same bulletin notes that UTM parameters are untouched, and testing by SegMetrics suggests LTP does not strip UTMs either. UTMs are how most brands tag campaigns in their analytics.
What that means in practice:
- A shopper who taps your ad in a normal Safari or in-app browser session is largely unaffected.
- A shopper who copies your product link, sends it to a partner in iMessage and has them buy loses the click ID on the way. The sale may show up as direct traffic instead of your ad.
- Email campaign links that carry click IDs may lose them when forwarded or opened in affected contexts. UTM-tagged links keep their campaign data in your analytics.
The volume depends on your audience. A brand selling considered, higher-ticket purchases where shoppers share links with partners will see more of it than a brand selling impulse items straight from a social feed.
How iOS 17 can affect ecommerce ads in practice
Targeting and retargeting
The Shopify guidance on iOS marketing notes that iOS updates can make monitoring users’ activity harder and weaken retargeting. Smaller retargeting pools mean higher costs to reach people who have already visited your store, so prospecting creative and offers have to carry more of the load.
Attribution and conversion reporting
Platform dashboards report only what they can observe. When a click ID is stripped or a tracking domain is blocked, the platform may miss a conversion that really happened. You see a lower return on ad spend in Google Ads or Meta than your bank account suggests. The reverse can also occur: platforms model conversions to fill gaps, so reported numbers can drift from your store data in either direction.
Campaign optimisation
Ad algorithms learn from conversion signals. Fewer, delayed or incomplete signals mean slower learning, more volatile results on small budgets and weaker optimisation toward your best customers. That is why the quality of data you send back to the platform has become a performance lever, not just a reporting concern. We cover that in more depth in our guide to post-iOS attribution for Australian ecommerce.
What you can still measure
Measurement has not disappeared. IAB Australia’s update on in-app measurement and attribution describes Apple’s AdAttributionKit, which uses “crowd anonymity”: campaigns with more installs receive more detailed data. For ecommerce web stores, your first-party analytics, order data and consented customer data remain the strongest foundation.
Check whether iOS 17 is affecting your data
You do not need a new tool to find out. Work through this in an afternoon.
- Find out what your reporting relies on. Attributer’s analysis points out that ad reporting may rely on UTM parameters or on gclid and fbclid, and the latter can be removed from visits in Safari Private Browsing. List which of your reports use which.
- Audit your UTMs. Every paid, email and SMS link should carry consistent source, medium and campaign values. Inconsistent tagging is a bigger leak than anything Apple did.
- Compare platform to store. Line up orders in your store admin against conversions in Google Ads and Meta over the last 30 to 90 days, by device type if you can. Note the ratio and track it over time. A sudden shift is more informative than the absolute gap.
- Look at your direct and unassigned traffic. A rising share of direct sessions on iPhone, especially after email or SMS sends, suggests lost attribution.
- Check your consent setup. If your pixels fire before consent or never fire after it, you have a data problem and a legal one. See our Australia cookie consent audit.
- Review the account itself. Our 60 to 90 minute ad account audit walks through signal quality first, because that is where most accounts leak.
How to adapt your tracking and measurement
Build on first-party data
Bluecore’s take on link tracking is that link tracking still works but the lesson is to focus on opt-in, first-party data. Shopify’s guidance says the same thing from the retailer’s side: build customer relationships, use first-party data and invest in retention. Practically, that means email and SMS lists, account creation, post-purchase surveys and loyalty data you collect with permission.
Send better signals back to the platforms
Server-side event sending and properly configured consent signals help ad platforms recover conversions that browser-based pixels miss. Our guides on how pixel tracking works and Consent Mode V2 for ecommerce cover the setup. Improving match rates is often the quickest win; see data-driven ecommerce marketing in 90 days.
Use more than one lens for measurement
AdMonsters reports industry guidance towards aggregated data and approaches such as media mix modelling or incrementality testing. For most emerging brands, a sensible version is:
- Platform reporting for day-to-day optimisation.
- Store or analytics revenue as the source of truth.
- Periodic holdout or geo tests to check whether a channel adds sales you would not have had anyway.
- Multichannel attribution to see how channels contribute together, as Shopify suggests.
Keep your tagging disciplined
Since UTMs survive Link Tracking Protection, make them your backbone. One naming convention, documented, enforced on every link and every team member or contractor.
Australian privacy: tracking is also a compliance question
Adapting your tracking should not push you into riskier territory. The Office of the Australian Information Commissioner’s guide to data analytics and the Australian Privacy Principles explains that under APP 7, organisations must give people a simple way to opt out of direct marketing. They also cannot use or disclose personal information for direct marketing without consent, unless the person would reasonably expect it or getting consent is impractical.
The same guide recommends a privacy-by-design approach for marketing analytics: use de-identified data where possible and run Privacy Impact Assessments to build trust and avoid practices customers find creepy.
For your store, that means:
- Make sure your consent banner actually controls your pixels.
- Do not push hashed customer data to ad platforms without a clear basis and a privacy policy that says so.
- Keep email and SMS lists clean and compliant. Our guides on the Spam Act for email senders and an SMS compliance checklist cover the rules.
This is general information, not legal advice. If you are unsure whether a data practice is lawful, speak to a privacy lawyer.
What we think about iOS 17 and the privacy shift
We see iOS 17 less as a new problem and more as confirmation of a direction. Apple says that privacy is a fundamental human right and each release gives that stance more teeth. Brands that treated pixel data as free, complete and permanent are now hitting the limits of that assumption.
The brands we work with do not get stuck here, because they stop asking “how do we get the old data back?” and start asking “which decisions do we need data for, and what is the most reliable way to get it?” Our approach is designed around that second question. A senior strategist looks at your account, your store and your customer data together, then builds measurement and creative strategy that does not depend on any single identifier.
In our experience the real wins come from the unglamorous parts: clean tagging, a conversion event setup that matches how your customers actually buy, strong first-party lists, and creative that works without hyper-granular targeting. We have also written about the wider Apple versus Facebook privacy debate if you want the context.
The point we keep coming back to is that privacy changes reward brands with a clear offer and a strong relationship with customers. That is a brand and strategy problem as much as a tracking problem, and it is solvable.
— Liza
Get a measurement setup you can trust
If your platform numbers and store revenue no longer agree, and you are not sure which to believe, that is the moment to get a second opinion. Our 12 Week DOUBLE Your Revenue Challenge is a hands-on programme built around our frameworks for growing ecommerce revenue, with senior strategist involvement. If you want a shorter starting point, our eCommerce Strategy Workshops are a way to map your tracking, offers and channels before you spend more on ads.
If you are mainly struggling to turn traffic into orders, look at our Convert More Customers service. For paid media, see our Facebook advertising and Google Performance Max services.
FAQ
What does iOS 17 do to advertising?
It adds Link Tracking Protection, which strips tracking parameters like gclid and fbclid from links in Mail, Messages and Safari Private Browsing. It also enforces ATT choices more strictly and requires developers to declare data practices in privacy manifests. Together these make some conversions harder to attribute, though UTM-tagged traffic is largely unaffected.
Does iOS 17 break UTM tracking?
No. AppsFlyer’s bulletin lists UTM parameters as untouched, and testing by SegMetrics found the same. The identifiers at risk are click IDs such as gclid and fbclid in the affected contexts. Consistent UTM tagging is your most dependable fallback.
Is iOS 17 worse for advertisers than iOS 14.5?
Not in scale. iOS 14.5 introduced the permission prompt that cut cross-app tracking and shrank retargeting audiences. iOS 17 is an incremental tightening that mostly affects click-ID attribution and SDK data collection. Brands that adapted after 2021 will find iOS 17 manageable.
How do I stop ads in apps on my iPhone?
You can limit tracking rather than remove ads. In Settings, under Privacy and Security, Tracking lets you stop apps asking to track you, and Apple’s support page explains what happens when you decline. You will still see ads, but they are less personalised across apps and websites.
What should an Australian ecommerce brand do first?
Audit your UTMs and consent setup, then compare platform conversions against store orders. That shows how big your gap is and where it comes from. From there, prioritise first-party data and better signals sent back to your ad platforms.
Sources
- If an app asks to track your activity, Apple Support
- Apple announces powerful new privacy and security features, Apple Newsroom
- App Tracking Transparency Updates in iOS 17, TelemetryDeck
- DCR and DTVR with iOS17 or tvOS17, Nielsen Engineering
- Link tracking privacy is coming with iOS 17, AppsFlyer
- Link Tracking Protection in iOS 17 and macOS Sonoma, SegMetrics
- iOS Marketing: Updates and Best Practices, Shopify
- Update on in-app measurement and attribution within Apple iOS, IAB Australia
- How iOS 17 impacts your reporting, Attributer
- Link Tracking Still Works, But Highlights The Need to Focus on First-Party Data, Bluecore
- Everything You Need To Know About the iOS 17 Update, AdMonsters
- Guide to data analytics and the Australian Privacy Principles, OAIC
