Ask five marketers what happened to ad tracking and you will hear five versions: "cookies are dead," "iOS killed Facebook ads," "Google cancelled the cookie ban, so nothing changed." Each contains a piece of the truth, and each leads to bad decisions when taken as the whole story.
Here is a sourced, plain-English account of what actually changed for ad tracking across iPhones, browsers and ad blockers, what did not change, and what it means for how you measure and buy ads today.
The short version
- Apple made cross-app tracking opt-in on iPhone in April 2021.
- Safari and Firefox block third-party cookies by default and limit script storage.
- Chrome did not remove third-party cookies, and Google has retired most of its Privacy Sandbox replacement technologies.
- Ad blockers still stop many tracking scripts from loading at all.
- The net effect is not that tracking ended. It is that browser-only tracking became incomplete, and the gaps are uneven across your audience.
iOS 14.5 and App Tracking Transparency
Apple released iOS 14.5 on April 26, 2021 (CNBC). With it came App Tracking Transparency, which requires apps to get a person's permission before tracking them across apps and websites owned by other companies, or sharing their data with data brokers (Apple developer documentation).
For advertisers, the practical effect was that ad apps such as Facebook and Instagram could no longer freely connect an ad seen in the app with a purchase made later on a website, for people who declined. Reported conversions dropped, attribution windows were shortened, and the platforms leaned harder on modeling and on conversion data sent directly by advertisers.
What ATT did not do
It did not stop you from measuring your own website. It did not block a business from recording its own sales. And it did not stop ad platforms from receiving conversion data that an advertiser collected first-hand and sent through official channels, within the platform's policies and the advertiser's own privacy commitments.
Safari and Firefox: cookie limits by default
Safari's Intelligent Tracking Prevention blocks third-party cookies and places limits on script-writable storage, including first-party cookies set by scripts, as documented on WebKit's tracking prevention page. Practically, an ad click id saved by a script can disappear sooner than a marketer expects, especially for someone who does not return to the site for a while.
Firefox turned on Total Cookie Protection for desktop users worldwide in June 2022, giving every website its own separate cookie jar so cookies cannot follow people from site to site (9to5Mac).
Chrome: the cookie deprecation that did not happen
Chrome spent years preparing to phase out third-party cookies. Then the plan changed:
- July 22, 2024: Google said that instead of deprecating third-party cookies, it would introduce a new user-choice experience in Chrome (A new path for Privacy Sandbox on the web).
- April 22, 2025: Google said it would keep its current approach to third-party cookie choice and would not roll out a new standalone prompt (Next steps for Privacy Sandbox).
- October 17, 2025: Google announced it would retire most Privacy Sandbox technologies, citing low adoption, while keeping a few such as CHIPS and FedCM (Update on plans for Privacy Sandbox technologies).
So third-party cookies still work in Chrome for people who have not turned them off. That matters, but it is not a reprieve for browser-only measurement. Your buyers on Safari, on iPhones, on Firefox and behind blockers are still partly invisible to a pixel.
Ad blockers and privacy extensions
Ad blockers and privacy extensions commonly block well-known tracking scripts, including ad pixels and analytics tags. Usage varies widely by audience, device and country, so the share of your own visitors affected is best measured rather than assumed. The key point is mechanical: when the script never loads, no browser event is sent, no matter how well the tag is configured.
The quiet gap nobody mentions: off-site checkouts
Separate from any privacy change, many sales complete on pages the advertiser does not control: hosted payment pages, course platform checkouts and booking tools. If your pixel does not run there, the sale is invisible to your ad account even for a buyer with no blockers on a browser with every cookie allowed. For many small businesses this is the largest single source of missing conversions.
What this means for how you measure ads
Expect platform numbers and your numbers to differ
Ad platforms now combine observed conversions with modeled ones and count view-through conversions. Your own records count sales. Both have a place, and the gap between them is useful information.
Record conversions where they happen
Your payment processor and CRM know about every sale. Recording conversions from those systems, not only from a browser event, gives you a complete base to work from.
Send real conversions back server-side
Meta's Conversions API, Google's enhanced conversions and offline uploads, GA4's Measurement Protocol and TikTok's Events API let you report those sales directly, with identifiers hashed. Our guide to server-side conversion tracking covers how each works.
Do not answer privacy changes with workarounds
Fingerprinting and other attempts to identify people who opted out undermine trust and can violate platform rules and privacy law. The durable path is consented, first-party data with real opt-outs.
A five-minute self-check
- Where do your sales actually complete, and does your pixel run on that page?
- Do you record every sale in your own systems, independent of any browser event?
- Are you sending purchases to each ad platform server-side, with a shared event id?
- Do your privacy policy and opt-out process cover that server-side sharing?
- When did you last compare a platform's reported purchases with your real sales?
If two or more of those answers are uncertain, your ad platforms are probably learning from an incomplete picture.
What a modern setup looks like
A sound measurement setup today has four parts: a first-party record of visits and sales, server-side delivery of real conversions to each ad platform, deduplication against the browser pixel, and a view that compares what the platform reports with what you recorded.
DocFluence, the AI-native marketing platform built by Z Media, packages those four parts together. Its first-party analytics, Site Pulse, records sales from the systems that process them, keeps the ad click identifiers it sees on the brand's own site, and forwards first purchases to Meta's Conversions API, to Google through GA4 and direct Google Ads uploads, and to TikTok's Events API once a brand's TikTok pixel is connected, with hashed emails, one send per sale and opt-outs checked first. Its Ads Manager then shows what Facebook reports beside what DocFluence measured. Read why ad platforms show fewer sales than you made for a walkthrough.
Frequently asked questions
Did iOS 14.5 stop Facebook ads from working?
No. It made cross-app tracking opt-in, which reduced the signals Meta could observe. Ads still run and still convert, but measurement and optimization now depend much more on conversion data advertisers send directly.
Are third-party cookies gone in Chrome?
No. Google decided not to deprecate them and kept its existing cookie choice settings. Safari and Firefox still block them by default.
Is Privacy Sandbox still happening?
Google announced in October 2025 that it would retire most Privacy Sandbox technologies due to low adoption, keeping a few such as CHIPS and FedCM.
What is the best response to tracking loss?
Record conversions in your own systems, send them to ad platforms through their server-side APIs with a shared event id, and compare platform numbers with your own.
Stay current with Z Media
Privacy and ad platform rules keep shifting. Follow AI News on Z Media for the changes that matter to marketers, read our first-party data strategy guide, and when you want measurement that holds up, see DocFluence.
