iOS 14 to iOS 17: A Timeline of What Broke in Ecommerce Tracking

Ask a marketer what happened to tracking and you will usually hear "iOS 14." That single release has become shorthand for a process that started earlier, continued for years afterwards, and involved at least six distinct technical changes with different mechanisms and different fixes. Treating it as one event leads teams to apply one fix and assume the problem is handled. This timeline sets out what each change actually did, in what order, and which of the remedies are still doing useful work today.

Before iOS 14: The Foundations

2017, Intelligent Tracking Prevention arrives in Safari. ITP introduced machine learning driven classification of tracking domains and began restricting third party cookie access. At the time it looked like a Safari specific inconvenience. In retrospect it established the direction everything since has followed.

2018 and 2019, ITP tightens repeatedly. Successive versions reduced third party cookie lifetimes to zero and, critically, began capping first party cookies set through client side script. The seven day cap on script written storage was the change that mattered most for ecommerce, because it meant any purchase journey longer than a week fragmented into separate visitors as far as analytics was concerned.

2020, ITP caps script written storage at 24 hours in some contexts. Where a visitor arrived via a link decorated with tracking parameters from a classified domain, storage lifetime dropped to a single day. Long consideration journeys became effectively unmeasurable through client side tracking alone.

By the time iOS 14 arrived, the browser side of the problem was already substantial. Most brands had not noticed, because Safari specific data loss looked like normal variance.

iOS 14.5, April 2021: App Tracking Transparency

This is the change everyone remembers, and it was genuinely significant, but it is frequently misunderstood.

App Tracking Transparency required apps to request explicit permission before accessing the device advertising identifier or tracking users across apps and websites owned by other companies. Opt in rates settled well below half in most markets.

What it actually affected:

• In app ad measurement. Facebook, Instagram, and TikTok apps could no longer reliably connect an in app ad exposure to a later action outside the app for users who declined.
• Audience targeting. Retargeting pools built from cross app behaviour shrank substantially.
• Attribution windows. Meta reduced its default from 28 day click to 7 day click, which mechanically reduced reported conversions independently of any tracking loss.
• Delayed and aggregated reporting. Apple's SKAdNetwork provided campaign level, privacy preserving conversion data with significant delay and severe granularity limits.

What it did not affect: web tracking on your own domain. A visitor arriving from an Instagram ad into Safari and browsing your shop was governed by ITP, not by ATT. Many brands conflated the two and implemented app oriented fixes for a web problem.

The lasting consequence was less about the specific mechanism and more about the reporting shift. Meta's numbers dropped, modelled conversions became a larger share of platform reporting, and the gap between platform reported and independently observed conversions widened permanently.

iOS 15, September 2021: Mail Privacy Protection and Private Relay

Mail Privacy Protection pre loaded email images through Apple's proxy, which meant open tracking pixels fired whether or not the recipient opened the message. Email open rates became largely meaningless overnight for the Apple Mail share of a list, which in consumer ecommerce is often the largest single client.

The practical consequence was that any automation triggered by opens, and any subject line test judged on open rate, became unreliable. Teams that moved to click based metrics adapted. Teams that kept optimising on opens spent two years optimising against noise.

iCloud Private Relay masked IP addresses and browsing behaviour for subscribers who enabled it. IP based geolocation degraded for that population, which affected geographic reporting and any measurement approach relying on IP for identity resolution.

iOS 16, September 2022: Incremental Tightening

iOS 16 brought no single headline change of the same magnitude, but continued the trajectory. Link tracking protection began stripping known tracking parameters from URLs in Mail, Messages, and Safari private browsing. Click identifiers appended by ad platforms could be removed before the page loaded, which meant the arriving session carried no way to connect back to the click.

This is the change that most directly attacks parameter based attribution, and it received far less attention than ATT because it arrived quietly and affects a subset of contexts rather than everything.

iOS 17, September 2023: Link Tracking Protection Expands

iOS 17 extended link tracking parameter removal more broadly across Mail, Messages, and Safari private browsing, with a maintained list of known tracking parameters. Platform specific click identifiers are prominent on that list.

The practical effect for ecommerce is that a share of traffic arriving from links shared in messages, or clicked in Mail, or browsed privately, arrives stripped. Standard campaign parameters have generally fared better than platform click identifiers, which is one argument for not relying on click identifiers as the sole attribution mechanism.

What Each Change Broke and What Fixes It

The single most durable fix across the whole timeline is server set first party identification. An identifier set by your own server, in your own first party context, is not subject to the script storage caps that fragment client side tracking, and it survives the browser changes that removed cross site mechanisms. It does not bypass consent and does not need to, since it operates on visitors who have already agreed.

The second most durable fix is server side event collection. Sending conversion events from your server to ad platforms, with proper event deduplication against the browser pixel, restores signal quality for platform optimisation without depending on browser script surviving.

The third is a measurement approach that does not depend on tracking individuals at all. Marketing efficiency ratio at the business level, incrementality tests through geo holdouts, and post purchase surveys asking customers how they heard about you are all unaffected by every change on this timeline. Their value has risen steadily as the tracking based alternatives have degraded.

What to Take From the Timeline

• This was not one event. Applying a single 2021 fix and considering it handled leaves five other mechanisms unaddressed.
• Web and app are different problems. ATT governs app tracking, ITP governs Safari. Fixes do not transfer.
• Windows changed independently of tracking. Part of the reported conversion drop was Meta changing its default attribution setting, not data loss.
• Parameter stripping is the current frontier. Click identifiers are more exposed than standard campaign parameters.
• Non tracking measurement gained value. MER, holdout tests, and survey data have not degraded at all.

The last point is the strategic conclusion. Every change on this timeline degraded a measurement method that depends on following an individual across contexts. None of them degraded methods that work at the aggregate level or that ask the customer directly. A measurement stack built entirely on the first category has been losing capability every year since 2017 and will continue to. A stack that combines strong first party tracking for the observable portion with aggregate and self reported methods for the rest has been getting relatively more robust over the same period.

Summary

The tracking changes attributed to iOS 14 were actually a sequence running from 2017 to the present, spanning Safari cookie restrictions, script storage caps, app tracking permission, email open proxying, IP masking, and link parameter stripping. Each has a different mechanism and a different remedy, and the fix that addresses one leaves the others untouched.

The remedies that hold up are server set first party identification, server side event collection with correct deduplication, campaign parameters rather than platform click identifiers as the primary tagging mechanism, and measurement methods that do not depend on tracking individuals at all. Audit your setup against the table above rather than against the memory of a single 2021 disruption, because the changes since then have been quieter and are still accumulating.

FAQ

Did iOS 14 break web tracking?
Not directly. App Tracking Transparency governs tracking across apps and websites owned by other companies. Tracking on your own domain in Safari was already being restricted by Intelligent Tracking Prevention from 2017 onwards, which is a separate mechanism with separate fixes.

Why did my Meta conversions drop in 2021 even though my traffic did not?
Two reasons combined. Signal loss from ATT reduced what Meta could observe, and Meta simultaneously changed its default attribution window from 28 day click to 7 day click, which mechanically reduced reported conversions regardless of tracking quality.

Are email open rates completely useless now?
For the Apple Mail portion of your list, which is often the largest, opens are inflated by proxy pre loading and cannot be trusted for individual level automation or subject line testing. Click based metrics remain reliable, and relative comparisons across the non Apple portion still carry information.

Does server side tracking get around these restrictions?
It solves specific problems: ad blocker losses, script execution failures, and the storage lifetime caps that fragment long journeys. It does not bypass consent requirements and does not restore cross site tracking. It makes the data you are permitted to collect more complete.

What should I prioritise if I can only fix one thing?
Server set first party identification, because it addresses the storage caps that fragment long purchase journeys, which is the most damaging and least visible of the changes on this timeline. Consent rate optimisation runs a close second, since it determines how much data the identification layer has to work with.