How do Safari and iPhones affect Shopify ad tracking?

By the HonestTag team · Published October 24, 2026

A shopper taps your ad on their iPhone and buys days later. The trail back to your ad may already be gone.

The four Apple changes, in plain words

• Intelligent Tracking Prevention (ITP). WebKit says Safari "deletes all cookies created in JavaScript and all other script-writeable storage after 7 days of no user interaction with the website," caps "the expiry of cookies created in JavaScript on the landing webpage to 24 hours" when it detects click IDs added to the link, and "blocks all third-party cookies" (WebKit).
• Link tracking protection. Safari 17 added "Blocking for known tracking query parameters in links" in Private Browsing (WebKit), and Apple says links shared in Messages lose "the extra information that some websites add to their URLs" (Apple).
• App Tracking Transparency. Since iOS 14.5, Apple says all apps "must use the AppTrackingTransparency framework to request the user's permission to track them" (Apple Developer).
• iCloud Private Relay. For iCloud+ subscribers browsing in Safari, Apple says no single party "can see both who you are and what sites you're visiting" (Apple Support).

What that does to a Shopify store's tracking

• Slow buyers fall out. A shopper who clicks an ad and buys after more than 7 days without interacting with the store again has lost any script-set cookie that held the click. Where ITP detects link decoration, a cookie created in JavaScript on the landing page is capped at 24 hours.
• Some link parameters never arrive. Where Safari removes a parameter from its tracking subset, that parameter never reaches the store. Parameters used only for campaign attribution are allowed through.
• The order is still there. Shopify says ITP "reduces attribution accuracy even though the pixel still runs," and that "your Shopify reports and order records aren't affected" (Shopify Help Center).

So the platform's attribution gets less accurate while your Shopify orders stay as they were. That gap is what merchants notice first.

What Apple does not say

• Apple does not list which parameters it strips. WebKit describes "a subset of query parameters that have been identified as being used for pervasive cross-site tracking granular to users or clicks" (WebKit). None of the Apple pages we read names gclid or fbclid.
• Campaign-only parameters pass. WebKit says a parameter "only used for campaign attribution, as opposed to click or user-level tracking" is allowed through (same page).
• Everyday browsing. As of WebKit's 2024 post, the new Private Browsing protections reach regular browsing on iOS, iPadOS and visionOS when the user turns on "All Browsing" in Safari's settings. Apple's iOS 26 announcement extends advanced fingerprinting protection "to all browsing by default" (Apple Newsroom).

What a merchant can do

• Count from orders, not from the browser. Judge ad spend against your Shopify orders, which these changes do not touch.
• Send purchases from the order. A server that sends each order can include the buyer's email, hashed, where the platform matches on it. For website conversions, Google says it uses hashed data "to match your customers to Google accounts, which were signed-in to when they engaged with one of your ads" (Google Ads Help). Server-side tracking covers the trade-offs.
• Tag your links with campaign parameters. WebKit says a parameter used only for campaign attribution, as opposed to click or user-level tracking, is allowed through in Private Browsing.
• Be wary of workarounds. WebKit says ITP also caps cookies set through "third-party CNAME cloaking and third-party IP address cloaking" at 7 days (WebKit). A tool that promises those cloaked cookies will last longer than 7 days is contradicting that rule.

What HonestTag does

• Every order arrives from Shopify, server to server, so a Safari limit never hides a sale from your HonestTag numbers.
• New or returning comes from your order history, not from a cookie.
• HonestTag's visitor cookie is set by a script, so Safari's 7-day rule applies to it like any other, and the 24-hour cap applies where it is created on a landing page after ITP detects link decoration. A click whose cookie has expired is not tied to the order.
• On a paid plan, delivered purchases carry the buyer's email and phone, hashed, to destinations that match on hashes, where the order has them and the consent rules allow. A phone is left out when it fails that destination's country or digit rules. On higher plans, Klaviyo gets the order's email unhashed the first time a visitor orders, and again only after the stored profile ID expires, so it can find the existing profile or create one. An optional tracking domain on your own subdomain helps against blocklists, and does not get around Safari or consent.

Frequently asked questions