Is Safari 27 breaking my LinkedIn, Google or Meta conversion tracking?

TofuAnswer by the Tofu team · checked

Not in a new way for Google or Meta, and maybe for LinkedIn. The one new Safari 27 block WebKit has described cuts requests to "identity resolution" vendors, and the domain list posted in WebKit's bug tracker has no LinkedIn, Google or Meta domain. Older protections still apply: since Safari 26, known fingerprinting scripts can't read click IDs in the URL, and Private Browsing strips known tracking parameters. PPC Land and Littledata report that Safari 27 treats the LinkedIn Insight Tag as a fingerprinting script; Apple and LinkedIn haven't confirmed it. Server-side routes avoid most of this.

As of October 2026.

What did Safari 27 change for ad tracking?

Apple has confirmed one new block, aimed at identity resolution vendors. In an October 19, 2026 post, WebKit wrote that in iOS, iPadOS, macOS and visionOS 27, "Safari and WebKit block network access to identity resolution infrastructure." These are third parties that collect your email address when you log in or sign up and turn it into a tracking ID. The block works by domain. Apple's Safari 27 release notes and WebKit's Safari 27.0 feature post don't mention it or any other new tracking protection.

WebKit's post doesn't name the domains. In a WebKit bug report filed September 21, 2026, the reporter, citing a WebKit code change, listed these as blocked in Safari 27: uidapi.com, adsrvr.org, id5-sync.com, eu-1-id5-sync.com, rlcdn.com, pippio.com, permutive.com and ad.gt. The reporter argued that adsrvr.org, The Trade Desk's ad delivery domain, isn't an identity service. A WebKit engineer pointed to a new iOS 27.2 beta on October 5, and the bug was marked fixed on October 9 without saying what changed. AdExchanger reported on October 2, citing two unnamed sources, that the short list had been replaced by one of hundreds of CDPs, ad tech and martech companies, data sellers and ID graph operators that Apple can block. Digiday wrote on October 7 that it had seen results from a test of more than 70 ad tech domains that found only the original handful blocked. Apple hasn't published a list.

Is the LinkedIn Insight Tag blocked in Safari 27?

It isn't on the one public list of blocked domains, but it may be restricted. The Insight Tag's domains, snap.licdn.com and px.ads.linkedin.com, aren't in the WebKit bug report. PPC Land (July 18, 2026) covered a review of the Safari 27 beta source code by Mariusz Brucki, published on the blog of TAGGRS, which sells server-side tagging. The review found the Insight Tag on Safari's list of fingerprinting scripts, so the tag can't read URL query parameters (where LinkedIn's click ID sits) or the referrer. Littledata and Mintec report the same. Apple doesn't publish which scripts it classifies, and neither Apple nor LinkedIn has confirmed this. LinkedIn's own help already rates the Insight Tag's reliability as "Medium - Cookie-based, can be subject to browser limitations."

Do Safari's protections apply to all browsing or only Private Browsing?

It depends on the protection: fingerprinting protection is on in all browsing, while tracking-parameter removal is on only in Private Browsing unless the person changes a setting.

ProtectionWhat it doesWhen it's on
Advanced fingerprinting protection (Safari 26 and later)Known fingerprinting scripts can't reliably read device details, can't set long-lived cookies or local storage, and can't read query parameters or the referrerAll browsing, by default
"Use advanced tracking and fingerprinting protection" settingBlocks connections to data collection companies that use advanced fingerprinting, and removes known tracking parameters from all URLsPrivate Browsing by default; people can turn it on for all browsing
Identity resolution blocking (Safari 27)Blocks network requests to identity resolution vendors, by domainWebKit doesn't limit it to Private Browsing, and the bug report's screenshot was taken in normal browsing
Intelligent Tracking PreventionCaps cookies set by JavaScript at 24 hours when a visitor arrives through a link a tracker decorated with a click ID, and deletes script-written storage after 7 days without interactionAll browsing

Apple announced with iOS 26 in June 2025 that advanced fingerprinting protection was "extending to all browsing by default." On a Mac, the second setting is under Safari > Settings > Advanced, with a choice of Private Browsing or all browsing.

Does Safari strip gclid, fbclid and li_fat_id from ad clicks?

In Private Browsing, reportedly yes for gclid and fbclid; in normal browsing, no, unless the person has turned the setting on. Apple says the setting removes "known tracking parameters" from URLs but doesn't publish which ones. PPC Land reports that Google's gclid and Meta's fbclid were on the list before Safari 27, Littledata says the same of Meta and Google click IDs, and both say Safari 27 adds parameters from Threads, YouTube and X. Neither names LinkedIn's li_fat_id. Google's own help says its GBRAID and WBRAID parameters "recover lost attribution for iOS conversions or private browsing environments." Even when a click ID stays in the URL, a script Safari classifies as fingerprinting can't read it.

Is Meta or Google on Safari 27's block list?

No Apple or WebKit page names them, and the WebKit bug report lists no Meta or Google domain. Neither PPC Land nor Littledata reports a new Meta or Google restriction in Safari 27. AdExchanger said on October 2 that it was still trying to confirm whether Google's ad.doubleclick.net is on the larger, unpublished list. The older protections above still affect both: click IDs removed in Private Browsing, and capped cookies.

What should I do about LinkedIn?

Add LinkedIn's Conversions API, so your key conversions don't depend on the Insight Tag running in the browser. LinkedIn says the Conversions API "doesn't rely on cookie-based tracking," and it deduplicates events sent through both.

  1. Turn on enhanced conversion tracking for your Insight Tag. LinkedIn then adds its click ID, li_fat_id, to your landing page URLs.
  2. Capture li_fat_id from the landing page URL with your form or server, and store it with the lead.
  3. Send each conversion with as many identifiers as you have. LinkedIn's primary identifiers are email, LinkedIn click ID, IP address and third-party IDs. It added IP address in May 2026, and hashed IP and hashed first and last names in September 2026.
  4. If you keep the Insight Tag too, create a conversion rule for each source (browser and server).

You can build it directly (LinkedIn says two to four weeks on average), use a partner such as HubSpot, Segment, Tealium or Zapier, or connect Google Tag Manager with a server container. For that route, eligible advertisers can create one Stape-hosted server container per eligible ad account at no extra cost through Campaign Manager. Without the Insight Tag on your site, LinkedIn still counts click-through conversions from the Conversions API. It says view-through conversions then aren't available, though sending other IDs, such as a hashed email, can help enable them.

What should I do about Meta?

Run the Conversions API alongside the pixel, which Meta calls a "redundant setup" and recommends. Meta says Conversions API data "is less impacted than the Meta Pixel by browser loading errors, connectivity issues and ad blockers." If you have the pixel, you can set it up in one click from Events Manager, "with no code, configuration, or setup fees." Give each event the same event ID and event name in both, so Meta can deduplicate them within 48 hours. And whenever fbclid is in the landing page URL, Meta's docs say to read it on your server and send it as the fbc parameter. Meta also says the Conversions API "isn't designed to be a means to bypass" data-sharing policies or privacy rules, so send only what your consent setup allows.

What should I do about Google?

Use enhanced conversions, and for CRM imports, send GBRAID and session attributes when there's no GCLID. Enhanced conversions sends hashed first-party data, such as the email from your form, and matches it to signed-in Google accounts, so it doesn't rely only on the click ID. Google suggests GBRAID when "the Google Click ID is at risk of being dropped," and session attributes "in scenarios where GCLID is not available." Google tag gateway, which serves the Google tag from your own domain, is a separate option; see whether Google tag gateway is worth setting up for B2B lead gen. Google doesn't say it gets around Safari's protections.

How do I tell whether Safari caused my drop?

Compare conversions by browser, and against your CRM. If conversions from Safari fell after Safari 27 arrived in September 2026 while Chrome held steady, and leads in your CRM didn't fall, you have a measurement gap, not a demand problem. Then check each platform's own tracking status: see how to check that conversion tracking works on Google Ads, LinkedIn and Meta.

Do I need server-side tracking now?

For LinkedIn, it's the fix most likely to hold, because the reported restrictions hit the Insight Tag in the browser. For Google and Meta, nothing new in Safari 27 forces it, but both already recommend a server or hashed-data route: Meta's Conversions API alongside the pixel, and Google's enhanced conversions. A server can't read a click ID that Safari removed from the URL, so send a hashed email with every conversion too.

Sources (28)

Ask Tofu next

Pick a question and Tofu Ads Agent answers it in chat.

Related answers

More on