I keep a running file of numbers I quote on client calls, because "your tracking is leaking" lands differently when you can name the mechanism, the source, and the date. This is that file, cleaned up and published.
Ground rules for this page: every statistic below comes from a source I can name in the sentence — Apple's WebKit engineering blog, Meta's own documentation, Google Ads Help, StatCounter, AppsFlyer, the California Privacy Protection Agency. Where a number gets quoted around the industry but I couldn't trace it to a primary source, I left it out rather than pass it along.
What actually causes conversion tracking loss in 2026?
Four independent mechanisms, and they stack. A browser cookie cap, a device-level opt-out, a legal opt-out signal, and a consent choice each remove a different slice of the same purchase. Most people conflate them, then argue about one number that could never exist.
| Choke point | What it removes | Who it hits | Source |
|---|---|---|---|
| WebKit ITP cookie caps | Identifier lifetime (7 days / 24 hours) | Safari users, all devices | Apple's WebKit blog |
| App Tracking Transparency | Device-level cross-app attribution (IDFA) | iOS app traffic | Apple, measured by AppsFlyer |
| US opt-out preference signals | Sale/sharing of data for ad targeting | Residents of states with UOOM rules | California AG, CPPA |
| EEA consent declines | Cookies and ad-data signals at the source | European traffic | Google Consent Mode v2 docs |
Notice what isn't on that list: a single "you lose X% of conversions" figure. Anyone selling you one is averaging across businesses whose Safari share, purchase cycle, and geography have nothing to do with yours.
- Ad click — Landing URL carries fbclid or gclid
- Safari sees decoration — Navigation from an ITP-classified domain
- Pixel writes _fbp — Created through document.cookie in the page
- Expiry capped at 24h — ITP 2.3 rule, down from the 7-day cap
- Server-set cookie — HTTP response header, not document.cookie
How much of your traffic sits behind Safari's cookie limits?
In the United States, more than you'd guess from looking at a desktop analytics dashboard. StatCounter's July 2026 figures put Safari at 29.74% of all US browser traffic against Chrome's 51.42%, with Edge at 7.23% and Firefox at 6.89%. On mobile specifically — where most impulse purchases happen — StatCounter has Safari ahead of Chrome in the US: 52.13% to 41.74%.
So for a typical American ecommerce store, roughly half of mobile sessions are running under WebKit's rules. Those rules are published, dated, and unambiguous.
What exactly does Safari's ITP do to tracking cookies?
It caps how long identifiers survive. Apple's WebKit team wrote in the ITP 2.1 announcement (February 2019) that "all persistent client-side cookies, i.e. persistent cookies created through document.cookie, are capped to a seven day expiry." That covers _fbp, _ga, _gcl_au, TikTok's _ttp — every cookie a pixel script writes from the page.
It gets tighter from there:
- 24 hours with link decoration. ITP 2.3 (September 2019) states that "when a webpage is navigated to from a domain classified by ITP and the landing URL has a query string or fragment, the expiry of persistent client-side cookies created on that page is 24 hours." A
fbclidorgclidin the URL is exactly that decoration. - 7 days for script storage. Same release: "After seven days of Safari use without the user interacting with a webpage on website.example, all of website.example's non-cookie website data is deleted." localStorage, IndexedDB, the lot.
- CNAME cloaking is closed. WebKit's November 2020 CNAME Cloaking and Bounce Tracking Defense "caps the expiry of cookies set in so-called third-party CNAME-cloaked HTTP responses to 7 days." Pointing a subdomain CNAME at a tracking vendor does not buy you a longer cookie.
Did Chrome ever remove third-party cookies?
No, and that's official. On April 22, 2025, Anthony Chavez, VP of Privacy Sandbox, wrote that Google had "made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies."
A lot of marketers read that headline as "signal loss is canceled." It isn't. Chrome's reprieve changes nothing about WebKit's caps, nothing about ATT, and nothing about US opt-out law. It bought time for third-party retargeting audiences, not for attribution on Apple devices.
What are the real ATT opt-in rates in 2026?
Higher than the doom numbers from 2021, and still low enough to matter. AppsFlyer's April 24, 2025 analysis reported that "globally, 50% of users now consent to tracking, a significant 10% increase since ATT's initial rollout," with France just under 51% and Germany at 47%.
Treat that as one measurement house's read, not a physical constant. Opt-in rates published by different measurement vendors disagree by wide margins because they define the denominator differently — some measure consent among every user, others only among users who were actually shown Apple's prompt. Same underlying behavior, very different headline percentage. When someone quotes you an ATT rate, ask which denominator.
The financial scale of ATT is easier to pin down. On Meta's February 2, 2022 earnings call, then-CFO David Wehner told investors the impact of Apple's iOS changes would be "on the order of $10 billion" in 2022 revenue. That single quote did more to normalize server-side tracking than every agency blog post combined.
What does server-side tracking actually recover?
Two published numbers are worth knowing, and both come from the platforms themselves — read them as vendor claims, because that's what they are.
| Claim | Figure | Source |
|---|---|---|
| Lower cost per result with Conversions API for web events, vs. no CAPI | 17.8% on average | Meta's Conversions API product page |
| Ad-click-to-conversion journeys recovered by Consent Mode modeling | More than 70% | Google Marketing Platform blog, April 2021 |
The Meta figure is the one to quote if you only quote one, because it's stated on Meta's own commercial page and it's phrased in the metric buyers care about: cost per result, not "events recovered."
My practitioner caveat, and it's a big one: that 17.8% is an average across advertisers who set CAPI up, not a guarantee of what a bad CAPI setup does. Conversions API with weak match keys — client IP and user agent only — recovers close to nothing, because Meta can't tie those events to a real account. CAPI carrying hashed email, hashed phone, _fbp, _fbc, and external_id on every Purchase changes what the delivery system can optimize against. The gap between those two builds is the entire game, and both of them show up in Events Manager as "Conversions API: Active."
| IP and user agent only | Real match keys attached |
|---|---|
| Meta can't tie events to an account | Hashed email and hashed phone |
| Recovers close to nothing | _fbp, _fbc and external_id |
| Shows Conversions API: Active | Attached server-side from checkout |
| EMQ stuck in the low single digits | What the 17.8% average is built on |
What is first-party server-side tracking, and why does it fix this?
Plain version first, because most people reading a statistics page have never had this explained. Right now your website loads a piece of JavaScript from Meta, Google, or TikTok, and that script tries to write a cookie and send the conversion from your visitor's browser. Every number above describes something that stands between that script and the ad platform: a browser cookie cap, a content blocker, a device opt-out, a legal signal, a consent decline.
First-party server-side tracking moves the reporting job off the visitor's browser. You run a Google Tag Manager server container on a subdomain of your own domain — something like data.yourstore.com. The browser sends the event to your own server, and your server sends it on to Meta, Google Ads, GA4, TikTok, and Microsoft. Same conversion, different messenger.
Why that specifically answers the numbers on this page:
- It sidesteps the 7-day cap you just read about. WebKit's caps target cookies written by JavaScript in the page. Cookies set by your own server in an HTTP response header aren't subject to that document.cookie rule, so identifiers on a first-party subdomain survive the Safari traffic that makes up half of US mobile sessions.
- It's how you feed the match keys that make CAPI work. The 17.8% cost-per-result figure only shows up for setups sending real customer parameters. A server container is where you attach hashed email, hashed phone, and
external_idreliably, from checkout data instead of whatever survived in the browser. - It gives you one source of truth. Every platform gets its conversion from the same server event with the same
event_id, so Meta, Google, and GA4 stop disagreeing by 30% and your deduplication actually works. - It makes consent a switch you control. When a visitor sends a Global Privacy Control signal or declines in the EEA, the server decides exactly what gets suppressed and what still flows, per platform. That's compliance without going dark on everything.
How does Meta's Event Match Quality score work?
EMQ is Meta's grade for how identifiable your server events are. Meta's Conversions API documentation defines it as "a score (out of 10) that indicates how effective the customer information sent from your server may be at matching event instances to a Meta account," and Meta's Business Help Center labels the result Poor, OK, Good, or Great, recommending you aim for Good or Great.
Four things about EMQ that matter more than the number itself:
- It's scored per event name. Your Purchase can sit at 8 while your Lead sits at 3, because checkout collects an email and your lead form fires before anyone types one.
- Hashed email and phone do the heavy lifting. IP and user agent alone barely move it. If your EMQ is stuck low, you're almost always missing customer parameters, not sending the wrong event.
- It reacts within days. A parameter that breaks in a theme update shows up as a visible drop. It's a free monitoring alarm, if anyone on your side is looking at it monthly.
- It's separate from deduplication. Meta's developer docs specify a 48-hour deduplication window: if the same
event_idandevent_namearrive from the browser and the server within 48 hours, the later one is discarded. Miss theevent_idand you don't get a low EMQ — you get double-counted purchases and inflated ROAS.
What do US privacy laws actually cost you in tracking terms?
More than most American businesses have priced in, and the enforcement is no longer theoretical. The IAPP reported at the start of 2026 that there are now 19 enacted comprehensive state privacy laws, with Indiana, Kentucky, and Rhode Island taking effect on January 1, 2026, and Oregon's updated law requiring covered businesses to recognize universal opt-out mechanism signals.
The mechanism that touches your pixels directly is Global Privacy Control. The California Attorney General's office describes GPC as a browser-level setting or extension that signals a consumer's request to stop the sale or sharing of their personal information, and businesses collecting personal information online must treat it as a valid opt-out. Firefox, Brave, and DuckDuckGo ship it.
The 2025–2026 enforcement record, all from the regulators' own announcements:
| Action | Penalty | Date | What triggered it |
|---|---|---|---|
| CPPA v. Tractor Supply | $1,350,000 | Sept 30, 2025 | No effective opt-out mechanism, including through opt-out preference signals such as GPC; sharing data without required contract terms |
| California AG v. Healthline Media | $1,550,000 | July 2025 | Trackers and pixels sharing reader data, including data suggesting a serious health condition, with no working opt-out of targeted advertising |
| California AG v. Sling TV | $530,000 | 2025 | First action out of the DOJ's streaming-services sweep |
The Tractor Supply order is the one to read if you run tracking. Beyond the fine — the largest in CPPA history — the company agreed to audit its digital properties to inventory the tracking technologies running on them. That is a regulator telling an American retailer, in writing, to go find out what its own tags are doing. On September 9, 2025, the CPPA announced a joint investigative sweep with Colorado and Connecticut targeting businesses that fail to process GPC opt-outs.
Europe is the secondary case for most US businesses, but it's not optional if you have EEA traffic. Since March 2024, Google has required Consent Mode v2 — with the added ad_user_data and ad_personalization signals — for advertisers using audience and measurement features with EEA users. Google's own guidance notes that "consented users are typically 2-5x more likely to convert than unconsented users," and that its conversion modeling needs a threshold of 700 ad clicks over a 7-day period, per country and domain grouping, before it kicks in. Below that volume, you get the loss without the modeling.
How do you measure your own conversion tracking accuracy?
Every number on this page is a starting point, not your answer. The only figure that should drive a decision in your business is the ratio between conversions your platform actually recorded and conversions that genuinely happened — and you can calculate that this week without hiring anyone.
The short version: take a clean, complete record of real conversions from a system that cannot lie to you — Shopify orders, your Stripe dashboard, your CRM's closed deals — for a fixed date range. Then pull the same date range from GA4, Meta Events Manager, and Google Ads. Compare counts and revenue. The gap is your signal loss, in your business, on your traffic mix.
Two rules that stop this from producing garbage:
- Compare on the same date basis. Ad platforms report conversions against the date of the ad click, not the date of the sale. Compare Meta's click-date reporting to your order dates and you'll invent a discrepancy that doesn't exist. GA4 and your backend both report on sale date, so start there.
- Count events, then count revenue. Matching counts but not revenue usually means broken value or currency parameters, which is a different repair job than missing events.
We wrote up the full method — the exact date ranges, which reports to pull, how to handle refunds and subscriptions, and what each size of gap tells you — here: how to measure your conversion tracking accuracy. Do that first. An industry benchmark tells you a problem class exists; your own ratio tells you whether you have it.
- Pull a system that can't lie — Shopify orders, the Stripe dashboard or closed CRM deals for a fixed date range
- Pull the same range downstream — GA4, Meta Events Manager and Google Ads over the identical dates
- Compare on the same date basis — Ad platforms report against the click date; GA4 and your backend use the sale date
- Count events, then count revenue — Matching counts but not revenue points at broken value or currency parameters
- Your ratio, not an average — Recorded conversions over conversions that happened, on your own traffic mix
Which of these numbers should change what you do?
Four, honestly.
The Safari caps, because 7 days and 24 hours are hard limits and roughly half of US mobile traffic runs under them — if your buying cycle is longer than a week, browser-only tracking is undercounting you by design. Meta's 17.8% cost-per-result figure, because it puts a business number on a technical project and makes CAPI a budget conversation instead of a developer chore. The CPPA's $1,350,000 Tractor Supply order, because "audit your own tracking technologies" is now something a US regulator writes into a settlement. And your own accuracy ratio, which outranks every other number here.
Frequently asked questions
How much conversion data is lost without server-side tracking?
There is no honest universal percentage, because loss depends on your Safari and iOS share, how long your buying cycle is, and how much EEA traffic you get. The mechanisms are fixed and documented: WebKit's 7-day and 24-hour cookie caps, ATT opt-outs, and consent or opt-out signals. Measure your own gap against your Shopify or Stripe records rather than trusting an average.
Does Safari still limit cookies to 7 days in 2026?
Yes. Apple's ITP 2.1 announcement capped all persistent cookies created through document.cookie at a seven-day expiry, and ITP 2.3 cut that to 24 hours when the landing URL carries a query string or fragment after navigation from an ITP-classified domain. Cookies set by your own server in an HTTP response header aren't governed by that document.cookie rule, which is the core reason server-side setups use a first-party subdomain.
What percentage of users opt in to App Tracking Transparency?
AppsFlyer reported in April 2025 that 50% of users globally now consent to tracking, up about 10 points since ATT launched, with Germany at 47% and France just under 51%. Rates published by different measurement vendors vary widely because they use different denominators, so always ask whether a quoted rate covers all users or only users shown the prompt.
Did Google cancel the third-party cookie phase-out?
Effectively yes. In April 2025 Google's VP of Privacy Sandbox announced it would maintain its current approach to third-party cookie choice in Chrome and would not roll out a standalone prompt. Safari and Firefox restrictions were never affected by that decision, so signal loss on Apple devices continues unchanged.
How much does the Meta Conversions API improve performance?
Meta's own Conversions API page states advertisers saw a 17.8% lower cost per result on average with a Conversions API setup for web events compared to those without it. Treat that as a vendor average, not a promise: a CAPI build sending only IP and user agent recovers very little, while one sending hashed email, phone, _fbp, _fbc, and external_id is what those averages are built on.
What is a good Event Match Quality score?
Meta scores EMQ out of 10 and labels it Poor, OK, Good, or Great in Events Manager, recommending you land in Good or Great. In practice, a Purchase event carrying hashed email, hashed phone, _fbp, and _fbc gets there comfortably, while an event stuck low is almost always missing customer parameters rather than firing incorrectly.
Do US businesses need a cookie banner?
Usually not the EU-style banner. The IAPP counted 19 enacted comprehensive state privacy laws entering 2026, and what those mostly require is a working opt-out of sale and sharing plus recognition of universal opt-out signals like Global Privacy Control, not blanket prior consent. Consent Mode v2 and GDPR-style banners apply to your EEA and UK traffic.
What happens if you ignore Global Privacy Control?
Regulators are actively enforcing it. The CPPA fined Tractor Supply $1,350,000 in September 2025, its largest penalty to date, partly for failing to provide an effective opt-out mechanism including through signals such as GPC, and in September 2025 California, Colorado, and Connecticut announced a joint investigative sweep of businesses not processing GPC opt-outs.
Which conversion tracking statistic matters most for my business?
Your own accuracy ratio: recorded conversions divided by conversions that actually happened, measured over the same date range from your backend and your ad platforms. Industry statistics tell you which failure modes exist; only your ratio tells you which ones you have and how much they're costing you.
