Safari 27 and Clinic Ad Tracking: What Still Works

Safari 27 blocks one kind of tracking outright: Apple's 27 releases block network access to identity resolution infrastructure (WebKit), and since Safari 26 known fingerprinting scripts cannot read a page's query parameters or referrer, which is where ad click IDs travel (WebKit), so Curve Compliance sends clinic conversions from its servers instead. Conversions sent from a server do not need a browser pixel to reach Meta or Google Ads, and Curve sends them under a BAA on every plan, with attribution that holds when a patient books days later.

Book a call. Seeing fewer iPhone conversions this quarter? Curve's team will review what your website sends to Meta, Google and TikTok with you and set up server-side conversions under a BAA on every plan. Book a call with Curve.

The Safari changes that touch ads

WebKit's policy names the target plainly. Navigational tracking "includes URL parameter-based tracking or link decoration, which is tracking via information added to URLs, and HTTP header data that can be set up to include tracking information, such as the referrer" (WebKit Tracking Prevention Policy). Ad click IDs are URL parameters, so the first four changes below bear most directly on ad measurement. Dates are the WebKit posts' own.

Change	Release and post date	What WebKit says	What it touches
Link Tracking Protection	Safari 17.0 Private Browsing; post July 16, 2024 (WebKit)	"Safari removes a subset of query parameters that have been identified as being used for pervasive cross-site tracking granular to users or clicks."	Click-level URL parameters in Private Browsing, and in all browsing when the user turns the setting on.
Known tracker blocking	Safari 17.0 Private Browsing; post July 16, 2024 (WebKit)	"Blocking network loads of known trackers, including CNAME-cloaked known trackers"	Requests to domains that both DuckDuckGo and EasyPrivacy flag as trackers; WebKit says most ads still load.
Fingerprinting scripts and URLs	Safari 26.0; post September 15, 2025 (WebKit)	"Safari prevents known fingerprinting scripts from reading state that could be used for navigational tracking, such as query parameters and document.referrer."	Scripts Safari classes as known fingerprinting scripts; the post lists none by name.
Identity resolution	iOS, iPadOS, macOS and visionOS 27; post October 19, 2026 (WebKit)	"Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking."	Third parties that turn an email typed at login or sign-up into a tracking ID.
GPC for apps	Safari 27.0; post September 17, 2026 (WebKit)	Lets "a native app enable or disable sending the Global Privacy Control (GPC) Sec-GPC HTTP header on outgoing requests for a given page load"	Apps that show web pages, such as a clinic or pharmacy app.
CNAME cookie fix	Safari 27.2; post October 26, 2026 (WebKit)	"Fixed cookies set by a top-level navigation's own response being capped to a seven-day lifetime when the site's hostname is CNAMEd to a different registrable domain."	Sites whose own hostname points to a hosting platform's domain.

For what the GPC signal means for opt-outs on a health site, see Global Privacy Control on healthcare websites.

Does Safari strip gclid or fbclid?

WebKit does not name those parameters in these posts, so any list you see elsewhere does not come from these posts. What WebKit says about Link Tracking Protection is this: Safari removes the tracking subset "prior to navigation, such that these values are never propagated over the network," while a parameter "that's only used for campaign attribution" is different: "Safari allows such parameters to pass through." After a cross-site navigation, "all third-party scripts that attempt to read the full URL (e.g. using location.search, location.href, or document.URL) will get a version of the URL that has no query parameters or fragment" (WebKit).

These protections start in Private Browsing, and WebKit says "All of the new privacy protections in Private Browsing are also available in regular browsing" when the user turns on the advanced tracking and fingerprinting setting (WebKit). Add the Safari 26 rule on known fingerprinting scripts (WebKit), and whether a click ID survives depends on the browsing mode, the user's settings and which script is reading it. Campaign parameters are the kind WebKit says it lets through, which is one more reason to keep them clean; see are UTM parameters PHI.

Identity resolution: what Apple blocked and why health sites should care

WebKit describes the scheme this way: third parties "invisibly collect your email address when you log in or sign up for a newsletter. They send the email address to their servers, create an opaque tracking ID permanently linked to your email address, and send that tracking ID back to the webpage." Safari's answer: "The blocking is done on the domain level, meaning they can't just change the structure of the network request to work around the protection." WebKit also draws a line: "First party personalization is not tracking, and is not what our technologies seek to prevent." The post names no companies and lists no domains (WebKit).

On a health site those scripts sat where HHS is strictest. HHS lists "home or email address" and "any unique identifying code" among what trackers may receive, and says that if trackers "on a regulated entity's patient portal login page or registration page collect an individual's login information or registration information, that information is a disclosure of PHI and is subject to the HIPAA Rules" (HHS). A login or sign-up form is exactly where identity resolution worked.

• List what fires on your forms. Note every tag that loads on login, sign-up, newsletter and intake pages, and every request it sends after an email is typed.
• Scan the pages. The free Curve Compliance website scan lists the tracking scripts on each page; see also how to check which trackers your website loads.
• Read the contracts. Look for visitor identification, identity graph or audience matching in vendor terms, and ask whether the vendor signs a BAA.
• Match on your own side. For first-party matching that stays inside your systems, see patient identity resolution without PHI. Meta's own login-based setting is covered in Meta on-device conversion measurement.

What this means for pixels on a health site

WebKit's rules are written for third-party scripts and known trackers. In Private Browsing, "all third-party scripts that attempt to read the full URL" get it without query parameters, while the known-tracker blocker "intentionally allows most ads to continue loading" (WebKit); these posts name no ad tag. The direction is stated, though: WebKit says "We will continue to prevent covert and cross-site tracking by default" (WebKit). A browser pixel reads the URL, the referrer and its own cookies, and the changes above limit each of those in some cases. On a health site there is a second reason to move away from browser pixels: what they can collect on booking, intake and portal pages (HHS). See what a tracking pixel is and how to remove the Meta Pixel. For cookies more broadly, see cookieless tracking for healthcare.

What keeps working

• Server-side conversions. Meta says its Conversions API "is designed to create a connection between an advertiser's marketing data" and Meta "from an advertiser's server, website platform, mobile app, or CRM" (Meta). The conversion leaves from a server, not from a script in Safari, though the ad click still has to be recorded when the visitor lands. Check what Meta's new Parameter Builder fills in before you adopt it.
• Campaign parameters. WebKit says campaign-only parameters pass through Link Tracking Protection (WebKit). Neutral campaign codes still tell you which campaign sent a visit.
• Offline conversions from your CRM or EHR. Google says "By importing offline conversions, you can measure what happens in the offline world after your ad results in a click or call to your business" (Google Ads Help). A consult that happens days later can still be reported.
• Attribution kept on your side. Record the source of a visit when it lands and carry it through to the booking, so a booking made in a scheduler days later can still be credited to the ad.
• Apple's own route. WebKit offers Web AdAttributionKit "as a replacement for tracking parameters in URL" (WebKit).

How privacy and health laws apply to your tracking depends on your facts, so talk to your counsel. If you want help sorting out which of your iPhone conversions are missing and why, book a call with Curve.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta's Conversions API, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Curve keeps ad attribution when a visitor leaves to book in tools such as IntakeQ, Calendly, Acuity, Jane App, OptiMantra, Boulevard and ZocDoc, and bookings made days later still match the original ad click. It also takes offline conversion uploads from a CRM or EHR and credits each one to the original ad click. See booked appointment attribution.

Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names, form answers and emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted. Curve collects this data under the BAA it signs on every plan (BAA Directory entry), Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: WebKit, blocking identity resolution infrastructure; WebKit, features in Safari 26.0; WebKit, Private Browsing 2.0; WebKit, features for Safari 27.0; WebKit, features for Safari 27.2; WebKit Tracking Prevention Policy; Meta, Conversions API; Google Ads, about offline conversion imports; HHS, online tracking technologies bulletin.

Frequently Asked Questions

Does Safari 27 block conversion tracking?

It blocks identity resolution infrastructure in Apple's 27 releases (WebKit), and since Safari 26 known fingerprinting scripts cannot read query parameters or the referrer (WebKit). Conversions sent from a server do not depend on a browser pixel, though the ad click still has to be recorded when the visitor lands.

Does Safari remove gclid and fbclid from URLs?

WebKit does not name them. It says Safari "removes a subset of query parameters that have been identified as being used for pervasive cross-site tracking granular to users or clicks" in Private Browsing, and in regular browsing when the user turns on the advanced protection setting (WebKit).

What is Link Tracking Protection?

It is a Safari protection against tracking data in the address of the page you land on. WebKit says "The specific parts of the URL covered are query parameters and the fragment," and campaign-only parameters pass through (WebKit).

What is identity resolution, and why did Safari block it?

It is a third party collecting the email you type at login or sign-up and turning it into a lasting tracking ID. WebKit says Safari blocks it "to prevent cross-site tracking," on the domain level (WebKit).

Does Safari 27 block the Meta Pixel or Google tag?

WebKit's identity resolution post names no company and lists no domains (WebKit). Private Browsing blocks network loads of "known trackers," using a list WebKit says is built from DuckDuckGo and EasyPrivacy data, and WebKit adds that "Safari intentionally allows most ads to continue loading even in Private Browsing" (WebKit).

Is first-party email capture still allowed in Safari?

Yes. WebKit says "First party personalization is not tracking, and is not what our technologies seek to prevent" (WebKit). On a regulated entity's patient portal login or registration page, HHS says login or registration details a tracker collects are a disclosure of PHI (HHS).

Do server-side conversions work on iPhone?

The conversion is sent from a server to Meta's Conversions API or Google Ads, not from Safari (Meta). The ad click still has to be recorded when the visitor lands, and campaign-only parameters are the kind WebKit says pass through (WebKit).

Will Safari's changes affect my booked-appointment tracking?

If bookings are credited by a browser pixel on the scheduler's page, Safari's limits on third-party scripts apply there too. Curve Compliance credits bookings in tools like IntakeQ, Calendly, Acuity and Jane App to the original ad click and sends them server-side.

Talk to Curve Compliance

Book a call. Curve Compliance sends conversions server-side from its own servers, keeps attribution through booking tools, and checks every event for PHI-like patterns, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.