Digital Marketing

iOS privacy changes marketers must plan for in 2026

9 min readBy Sandeep Mahajan

A phone, a sealed envelope and a padlock on a dark wooden table

Since iOS 12, when this post was first written, Apple has added a series of privacy features that each remove a signal marketers used to rely on: App Tracking Transparency (ATT) asks permission before apps track people across other companies' apps and sites, Mail Privacy Protection makes email opens unreliable, iCloud Private Relay hides IP addresses in Safari, and Link Tracking Protection strips click identifiers from some links. None of them stops measurement; they stop measurement that depends on following individuals. Plan around first-party data you collect with consent, campaign-level UTM tags, conversions measured on your own site or in your own app, and Apple's own privacy-preserving attribution for app installs.

General information, not legal advice. Privacy law in your markets may require more than Apple's rules do.

Key takeaways

  • Under ATT (iOS 14.5 and later), an app must ask before tracking, and if the person does not allow it the advertising identifier returns all zeros. You cannot reward or require permission.
  • Mail Privacy Protection downloads remote email content in the background "regardless of whether you engage with the email," so opens no longer mean someone read the email. Measure clicks and conversions instead.
  • iCloud Private Relay, part of iCloud+, hides the user's IP address from websites they visit in Safari. IP-based location, fraud rules and B2B company lookups get less precise.
  • Link Tracking Protection removes user- or click-level tracking parameters from links shared in Messages and Mail and in Safari Private Browsing. WebKit says campaign-attribution parameters are allowed through.
  • Safari also blocks third-party cookies by default and limits known fingerprinting scripts. Server-side and first-party measurement, built with consent, is the durable answer.

What does App Tracking Transparency change?

It makes cross-company tracking from an app opt-in. Apple defines tracking as "the act of linking user or device data collected from your app with user or device data collected from other companies' apps, websites, or offline properties for targeted advertising or advertising measurement purposes," and also sharing data with data brokers. Since iOS 14.5 an app must get permission through the ATT prompt to track or to read the advertising identifier (IDFA). Without permission, Apple says, the identifier "will be all zeros."

Apple's examples of tracking include showing targeted ads based on data from other companies' apps and sites, sharing email lists or advertising IDs with an ad network that retargets people in other apps, and including a third-party SDK that combines your data with other developers' data for ads or measurement, "even if you don't use it for those purposes." That last point catches many marketing teams: an analytics or attribution SDK can make your app a tracker.

What is not tracking, per Apple: linking data only on the device without sending it off in an identifiable way, and sharing with data brokers solely for fraud prevention or security. You also may not offer incentives for permission or block features until people agree; Apple points to App Review Guidelines 5.1.2(i) and 5.1.1(iv).

What to do:

  1. Audit every SDK in your app for tracking behaviour, and read each SDK's privacy manifest (the PrivacyInfo.xcprivacy file in which an SDK records the data it collects and the required-reason APIs it uses; Apple requires one from the SDKs on its list and from any SDK that collects data or contacts tracking domains).
  2. Use AdAttributionKit (iOS 17.4 and later) or SKAdNetwork through your ad networks for app-install campaigns. Apple describes it as helping "advertisers measure the success of ad campaigns while helping maintain user privacy": you get aggregated postbacks, not user-level data.
  3. Show the ATT prompt at a sensible moment with an honest explanation, and plan for most measurement to work without it.

What does Mail Privacy Protection do to email metrics?

It breaks open rates for Apple Mail users. Apple says Protect Mail Activity "downloads remote content in the background by default," "regardless of whether you engage with the email," and routes it through two relays so senders cannot see the recipient's IP address. A tracking pixel therefore fires when Apple's systems fetch it, not when a person reads the message, and you cannot use the IP to tell location or link activity across emails.

What to do:

  • Stop using opens as a success metric or as a trigger. Re-engagement rules ("not opened in 90 days"), send-time optimisation and A/B tests of subject lines judged by opens all become unreliable.
  • Report clicks, replies and on-site conversions from email, tagged with UTMs (utm_medium=email).
  • Clean lists by engagement you can trust: clicks, purchases, logins.

What does iCloud Private Relay hide?

The user's IP address, in Safari. Apple's support page says Private Relay "helps protect your privacy when you browse the web in Safari": the first relay, run by Apple, sees the IP address; a second relay, run by a third-party content provider, assigns a temporary IP address and connects to the site. Apple designed it so no single party, "not even Apple," sees both who someone is and which sites they visit. It is part of an iCloud+ subscription and is not available in every country or region.

For marketers that means:

  • IP-based location is approximate, so regional reports and geo-targeted content are less exact for those visitors.
  • IP-based B2B visitor identification ("which company visited our pricing page") works less often.
  • Fraud and rate-limiting rules based on IP need care, because many people share relay addresses. Apple notes some sites may need extra steps to sign people in.

Which links does Link Tracking Protection change?

Links that carry user- or click-level identifiers. Apple announced in June 2023 that "some websites add extra information to their URLs in order to track users across other websites," and that this information "will be removed from the links users share in Messages and Mail," and from links in Safari Private Browsing, with the links still working. WebKit's 2024 explanation says Safari removes a subset of query parameters identified as being used for cross-site tracking "granular to users or clicks", while campaign-attribution parameters are allowed to pass through.

What to do:

  • Rely on UTM tags for campaign reporting. A link tagged with utm_source, utm_medium and utm_campaign keeps telling you which campaign worked; you lose only the per-click identifier. Our guide to measuring marketing ROI with UTMs and attribution sets out a tagging scheme.
  • Expect fewer matched ad clicks from links opened in Mail, Messages and Private Browsing, and treat platform conversion counts as modelled.
  • Do not try to work around it by disguising identifiers. The list of removed parameters can change, and it is a poor basis for a reporting system.

What has Safari done to cookies and scripts?

Blocked third-party cookies by default since 2020 and capped script-written storage. WebKit wrote in March 2020 that "cookies for cross-site resources are now blocked by default across the board," and that Safari deletes a site's script-writable storage (such as LocalStorage) "after seven days of Safari use without user interaction on the site." In September 2025, WebKit said Safari 26 "prevents known fingerprinting scripts from reading state that could be used for navigational tracking," with query parameters and document.referrer as examples.

The effect: returning-visitor counts are understated for Safari users who come back after a gap, third-party retargeting pixels see less, and some tag scripts lose access to the referrer or URL parameters. Two things help, both of which need proper consent where the law requires it:

  • First-party, server-side measurement: a tagging server on your own domain, and conversions sent from your server (for example, Google Ads offline or enhanced conversions, and the equivalent APIs from social platforms). Our write-up of GTM, Consent Mode v2 and click IDs on our own site shows one consent-aware setup.
  • Logged-in or known-customer data: when people sign in or buy, you can measure their journey on your own systems without tracking them across others.

What about notifications, the feature this post first covered?

Still useful, and still opt-in. iOS 12 introduced provisional authorisation, which Apple still documents: an app can send notifications "on a trial basis" that are delivered quietly to the Notification Center history, without sound or banner, with buttons to keep or turn them off. It is a respectful way to show value before asking for full permission. Push and in-app messages remain first-party channels, which is why they matter more as cross-site tracking shrinks; our app marketing guide covers them.

What should a marketing team change this quarter?

Area Change
Email Drop opens from KPIs and automations; report clicks and conversions
Web analytics Tag every link you control with UTMs; accept modelled data; see analytics when visitors decline cookies
Paid media Send conversions from your server or CRM with consent; read platform numbers as estimates
Apps Audit SDKs for tracking; adopt AdAttributionKit through ad networks; ask for ATT only if you truly track
Data Grow first-party data with clear value exchange: accounts, newsletters, loyalty
Reporting Compare channels on business outcomes (leads, sales), not identifiers

Our digital marketing and SEO team sets up this kind of consent-aware measurement as part of campaign work.

FAQ

Can I still run Facebook or Google ads to iPhone users?

Yes. Ads still run and still deliver results; what changes is how precisely each conversion can be tied to a person. Send conversions from your own site or server with consent, and expect platform figures to include more estimated conversions.

Are email open rates useless now?

For Apple Mail users with Mail Privacy Protection on, opens do not show whether anyone read the email, because Apple downloads the content in the background. Use clicks, replies and conversions.

Does Link Tracking Protection remove UTM parameters?

WebKit says Safari removes parameters used for user- or click-level tracking and lets campaign-attribution parameters pass. Keep using UTM tags, and do not put personal data in URLs.

Do I need the ATT prompt if my app only uses my own analytics?

Not if the data stays with you and is not linked with other companies' data for ads or measurement or shared with data brokers. Check every SDK, because a third-party SDK that combines data across apps counts as tracking even if you do not use that feature.

Is iCloud Private Relay a VPN?

Not in the usual sense. It covers Safari browsing for iCloud+ subscribers, uses two separate relays, and is not available in all countries or regions.

Sources (12 links)
Share this article