"Safari now strips every gclid." "Chrome is getting rid of third-party cookies." "From iOS 26, conversion tracking is dead." If you read marketing newsletters in 2025 and 2026, you know these lines. Some of them were never true, others are out of date by now, and a few real changes almost get lost in the noise.
This article sorts through the tracking myths of 2026 as of mid-October 2026: what has really happened in Chrome and Safari, what is still unconfirmed and what it means for your conversion tracking.
Myth 1: "Chrome is getting rid of third-party cookies"
Status: false. In October 2025 Google officially announced that Chrome will keep its current approach and continue to give users a choice about third-party cookies. An automatic switch-off is not coming.
At the same time Google retired most of the Privacy Sandbox, citing low adoption. Among the technologies retired are the Topics API, Protected Audience, the Attribution Reporting API, IP Protection, Related Website Sets and Shared Storage. Individual building blocks such as CHIPS, FedCM and Private State Tokens continue, and Google is also working on a W3C standard for attribution.
What it means: The big "cookie apocalypse" did not happen in Chrome. If you still read 2026 articles saying IP Protection launches "this year", they are out of date. For your tracking, though, it does not mean everything stays the same: third-party cookies barely matter for conversion tracking anyway. The data that matters is click IDs, first-party cookies and server-side signals.
Myth 2: "Safari 26 strips every gclid and fbclid"
Status: false for normal browsing. With Safari 26 (September 2025) Apple switched on Advanced Fingerprinting Protection in all browsing modes, not only in private browsing. Known fingerprinting scripts now get restricted access to things like URL parameters, the referrer and long-lived storage.
Link Tracking Protection, which removes parameters such as gclid, fbclid or msclkid from URLs, did not become the default for normal browsing. It still applies:
- in Safari Private Browsing,
- to links opened from Mail and Messages,
- and to all links only if users switch the feature on themselves.
Several tests of the final release show that click IDs arrive normally in standard mode. The many headlines saying iOS 26 "kills" the gclid are therefore wrong for the normal case.
What it means: Some of your Safari visitors arrive without a click ID, mainly from email, messages and private browsing. That has been the case since Safari 17, and it is one reason not to rely on the URL alone. What matters is that you save click IDs and UTM parameters on the first page view, while they are still there.
Fact: Safari 27 blocks ad tech domains
Status: confirmed by reporting, details open. The genuinely new development of the year is Safari 27, which rolled out with iOS 27 in mid-September 2026. According to AdExchanger (late September and early October 2026), Safari 27 on iPhone and iPad blocks domains of ad tech and identity providers at the registrable domain level. Names reported include The Trade Desk (adsrvr.org), UID2, ID5, LiveRamp, Audigent and Permutive. According to the reports, the code was merged into WebKit in February 2026, and the list can reportedly be updated remotely and covers hundreds of companies.
Apple has not confirmed the list publicly, and the release notes do not mention the topic.
Still unconfirmed are further points that vendors derive from the WebKit code:
- additional parameters for Link Tracking Protection, such as twclid (X), xmt (Threads) and si (YouTube),
- that tools such as Tealium, Segment or the LinkedIn Insight Tag could be classified as "fingerprinting",
- that IP-based blocking could make first-party subdomains less effective.
Keep an eye on these points, but do not treat them as fact. We will update this article as soon as there is reliable information, especially on the LinkedIn Insight Tag, which we integrate ourselves.
What it means: So far Safari 27 mainly hits programmatic advertising and identity providers, in other words companies that want to recognise users across many websites. The Meta, Google and TikTok pixels do not appear in the examples reported so far, but Apple has not published the full list. The direction is still clear: browsers are growing more suspicious of third-party scripts.
And ad blockers?
Things have moved here too in 2025 and 2026. Full uBlock Origin no longer runs in Chrome since the switch to Manifest V3. The uBlock Origin Lite variant works with static rules and a cap on how many it can use. Firefox and Brave still block fully. We did not find reliable figures on ad blocker usage in 2026, so we are not giving percentages here.
What matters for you: an ad blocker typically blocks the Meta Pixel, the TikTok Pixel and other well-known tags in the browser. What your server sends to an ad platform is invisible to the ad blocker.
Where your signal loss really comes from
If Chrome keeps cookies and Safari lets click IDs through in the normal case, why are conversions still missing? Because in 2026 signal loss comes mainly from three sources:
- Consent. Anyone who declines in the cookie banner must not be tracked for advertising. That is not a technical problem but the law, and no tool changes it. What you can influence: a fair, understandable banner that really loads pixels only after consent, and a consent rate you keep an eye on.
- Safari and the Apple ecosystem. Intelligent Tracking Prevention limits the lifetime of cookies set via JavaScript, Link Tracking Protection removes click IDs in certain contexts, and Safari 27 blocks entire domains. On top of that comes App Tracking Transparency in apps.
- Ad blockers and browser extensions. They stop pixels from loading at all.
None of these sources is going away. What you can do is send the data you are allowed to collect with consent as completely and robustly as possible.
What actually helps
Save click IDs and UTMs on the first page view
A click ID is only in the URL of the landing page. As soon as the user clicks on, it is gone unless you store it. On page view, LeadSignal captures the common click IDs, including gclid, gbraid, wbraid, fbclid and the _fbp cookie, ttclid, li_fat_id and msclkid, and stores UTM parameters per session. If the conversion happens hours later on another page, the click ID is still there.
Server-side tracking for the platforms that offer it
If a visitor has consented but their ad blocker blocks the pixel, the conversion is lost in the browser. Through a server-side interface it still arrives. LeadSignal sends events in parallel through the Meta Conversions API, the TikTok Events API and the LinkedIn Conversions API. On Meta, the pixel and the server event share the same event ID so Meta does not count anything twice. In LeadSignal, Google Ads runs in the browser through the Google Ads tag with Enhanced Conversions.
Important: server-side tracking is not a way around consent. It makes the transfer more robust; it does not make the legal basis unnecessary. Our article on why server-side tracking matters explains more.
More matching data instead of more cookies
The less reliable cookies and click IDs become, the more important first-party data becomes: data users provide themselves, such as the email address in a contact form. LeadSignal detects email, phone and name in forms automatically and hashes them with SHA-256 on our server before sending them to the conversion APIs. For Google Ads they are sent as Enhanced Conversions. That lets the platforms match conversions even when a click ID is missing.
Check instead of guessing
The fastest way to see whether your server events arrive is with test events. In LeadSignal there is a button for Meta, TikTok and LinkedIn that sends a test event to the platform in question.
What about the Google Tag Gateway?
With the Google Tag Gateway, Google now offers its own way to serve Google tags through your own domain, via cloud providers such as Google Cloud, Akamai, Fastly or Amazon CloudFront. That can help when tags served from Google domains are blocked. But just like server-side tracking, it is not a way around consent, and it only covers Google tags.
Conclusion: less panic, more fundamentals
The big headlines of recent months often do not survive a fact check. Chrome keeps third-party cookies, and Safari 26 lets click IDs through in the normal case. The real news, Safari 27, so far mainly hits ad tech and identity providers.
In 2026 your conversion tracking is not broken by a single browser switch but by the sum of consent, Safari restrictions and ad blockers. The answer is unspectacular: collect consent properly, save click IDs and UTMs, also send conversions server-side, and improve matching with hashed first-party data. Our guide to simple conversion tracking shows how to set that up without a developer.