When Safari breaks The Internet

In a case of this-is-not-really-news, attribution is hard. No, that's not a shock, and nor is the reality that attribution is only going to get harder unless you change your game.

Fundamentally, accurate and scaled 1-to-1 marketing and attribution is not possible in a privacy first manner. Regulation and technology are both growing challenges that prevent reliable id resolution for mass volume individualised marketing. Even with AI!

Even today, opening up everyone's favourite echo chamber/business 'social' media site, I saw a post that sounded like the final bell ringing for online marketing measurement:

"Advanced Tracking and Fingerprinting Protection (ATFP), which was introduced to Safari Private Browsing mode in 2023, will be enabled by default in all browsing modes."

ATFP offers a lot of great protection for the user from device fingerprinting - an insidious tracking technique that circumvents consent in order to literally chase you around the web for advertising gains.

So, known fingerprinting scripts aren't allowed to access device characteristics such as screen dimensions, that can be used in shifty tracking schemes but there's more"....

"And lastly, Safari prevents known fingerprinting scripts from reading state that could be used for navigational tracking, such as query parameters and document.referrer."

That's the bit that's possibly alarming - Safari wants to strip gclid, and utm parameters from your campaigns!

Or does it? And should it matter? Apple engineering is reported to be building a list of fingerprinting scripts and boy, do you not want to be on Apples 'naughty list'.

There's no confirmation that advertising query string payloads will be subject to stripping by ATFP.

If you used the ad URL query string to track an individual user without their consent then you'd be on thin ice already so don't expect sympathy when Safari stomps on your sketchy games.

But if your ad measuring query string payload is aggregated across a larger number of users and clicks, then accidental individual id resolution is much less likely and statistically provable to be privacy safe. Even with aggregated data, with sufficient volume, you can still confidently and usefully measure campaign effectiveness.

For a practical example, see Aggregate Identifiers from Google - designed for privacy safe advertising measurement when users decline ad_user_data consent.

How do you feel about the "measure the campaign,. not the user" standpoint? After all, you invest in the campaign, not the human. You design the campaign to perform for the users so measure how well the campaign delivers, not how well a random human (or AI agent?!?!) performs what you expected/believed/hoped they'd do.

The takeaway here is see regulation and tech changes as guidance on how online marketing is changing, and how techniques evolve. See privacy-first as a competitive advantage rather than another barrier to work around.

Don't panic, Safari isn't torching the gclid or utm this time.