Advertisement tracking after the cookie panic: what works
Advertisement tracking now depends on server side collection and consent signals, not a browser cookie. Chrome kept third party cookies in April 2025, but Safari caps script written storage at seven days and about a fifth of global browsing blocks cross site cookies. Fix the Conversions API first.
Advertisement tracking is in a stranger position than the last five years of blog posts suggest. The thing everyone prepared for did not happen, the replacement was cancelled, and the actual damage came from somewhere else entirely.
If your setup was built on the assumption that third party cookies were about to vanish, it is aimed at the wrong problem. Here is what genuinely degraded, in order of how much money it costs you.
What actually broke in advertisement tracking?
Advertisement tracking broke in three places, and the browser cookie is the least important of them. Safari has capped script written storage at seven days since March 2020. iOS app tracking consent now sits near half of the users who see the prompt. And events from people who never consented still reach ad platforms in most accounts.
Safari, six years ago. WebKit shipped full third party cookie blocking in March 2020 and capped all script written storage at seven days. That means a cookie your tag manager sets in JavaScript is gone after a week of no return visit. Any conversion window longer than seven days on Safari has been guesswork since then.
iOS App Tracking Transparency, since 2021. Users who decline the prompt carry no usable advertising identifier, which affects in app inventory and app install measurement more than it affects a website. The often repeated figure of a four percent opt in rate came from the first weeks of the rollout in 2021 and has been wrong for years. AppsFlyer put global consent at around 50 percent of users shown the prompt in its April 2025 study. Assume a coin flip, not a catastrophe.
Consent, everywhere. In the EEA, and increasingly under GCC and North African data protection law, events from users who did not consent should not reach an ad platform at all. That is a bigger hole in most accounts than any browser setting.
Meanwhile Chrome did nothing. Google confirmed in April 2025 that it would keep third party cookies with no new prompt, then retired most of the Privacy Sandbox in October 2025, including the Attribution Reporting API that was supposed to replace conversion pixels. There is no standardised replacement coming.
How much does this vary by market?
It varies more than any global average suggests, which is why imported benchmarks are useless in MENA. The damage tracks iOS share, because Safari is the browser doing the capping. A setup that looks accurate on an Egyptian audience can under report badly on a Saudi one, using exactly the same tags.
The figures move faster than most media plans do. On StatCounter’s July 2026 mobile figures, iOS is about 50 percent of mobile in Saudi Arabia, 32 percent globally, 22 percent in the UAE and 11 percent in Egypt.
The practical result gets mistaken for a media problem. We have seen budget moved out of Saudi because the platform said the market was expensive, when Saudi was quietly the best performing market in the client’s own back end. The tags were wrong, not the country.
Check the gap between platform reported conversions and real orders per country before you move money. It takes an hour.
What should you fix first?
Five things, in this order: the Conversions API on Meta, enhanced conversions on Google, consent mode, server side tagging, then offline imports. The order matters more than the list, because most accounts build the server side container first and never get round to sending a hashed email. Start with the cheapest fix that recovers the most events.
| Priority | Fix | Effort | What it recovers |
|---|---|---|---|
| 1 | Conversions API on Meta, with event ID deduplication | Medium | Events lost to blockers, closed tabs, Safari |
| 2 | Enhanced conversions on Google, hashed first party data | Low | Matching of conversions to signed in accounts |
| 3 | Consent mode with ad_user_data and ad_personalization | Medium | Legal basis, plus Google’s modelling |
| 4 | Server side tagging on your own subdomain | High | Cookie lifetime, control, one enforcement point |
| 5 | Offline and CRM conversion imports | Medium | Everything that closes off site |
Number one is not optional on Meta any more, and the score to watch is event match quality. Meta rates each event from one to ten on how much identifying data it received. Sending only an IP address and a browser ID scores badly. Adding hashed email, phone, name and external ID lifts it, and lifting it changes delivery, not just reporting.
On Google, enhanced conversions do the same job with SHA256 hashed first party data collected from your own forms. It is a checkbox and a field mapping, and it is the highest return per hour of any advertisement tracking work available.
How does server side tracking change things?
Server side tracking moves event collection from the visitor’s browser to a container you control, usually on a subdomain of your own site, and forwards events from there to each platform. Cookies live longer, blockers see less, and consent gets enforced in one place instead of eleven. Somebody still has to run it.
Three things get better. Cookies set by your server can outlive the seven day cap, because the cap applies to script written storage. Ad blockers and browser lists cannot see a request to your own domain the way they see one to a known tracking host. And consent is enforced in one place instead of in eleven separate tags.
One thing gets worse: someone has to run it. A server side container is infrastructure. It has a cost, it has a failure mode, and when it breaks it breaks silently for everyone. Below roughly $10,000 a month in spend, the Conversions API sent directly from your ecommerce platform gives you most of the benefit for none of the maintenance, and we tell people that rather than selling the build.
Advertisement tracking and consent: the June 2026 change
Advertisement tracking inside Google’s stack changed on 15 June 2026, and almost nobody wrote about it. Consent mode now decides on its own whether Google Ads receives cookies and identifiers from Analytics. The Google Signals switch no longer does that job. If your banner sends the wrong signals, it is wrong in both directions.
Until then, whether Google Ads received cookies and identifiers from Analytics was governed by two separate controls: the Google Signals setting inside Analytics, and consent mode. From that date, Google moved that control to consent mode alone, and the Google Signals setting only governs whether your Analytics data is associated with signed in users. Google has also said that later in 2026, ad_personalization will exclusively control whether that data is used for personalisation in your Ads account.
If you had Google Signals switched off as a privacy measure and assumed that stopped data reaching Google Ads, that assumption expired. The control is now your consent banner’s signals, and if those are wired wrong, they are wrong in both directions.
Separately, Google’s data retention policy took effect on 1 June 2026: 37 months for daily and weekly data, 11 years for monthly and annual, and only three years for reach and frequency metrics. Export anything you rely on for year on year comparisons.
How wrong is your reporting, and by how much?
Every platform over counts, because every platform claims a conversion it touched. Meta, Google and TikTok together will claim more sales than you made, and by their own rules none of them is lying. Expect the sum of platform reported conversions to exceed the orders in your own system, often by a wide margin.
The fix is not better advertisement tracking. It is a second number that cannot be argued with. Take total revenue from your order system for the month, divide by total ad spend across every platform including fees, and track that one ratio over time. It will not tell you which ad worked. It will tell you whether the whole operation is profitable, which is the question you actually care about.
Then use platform data for what it is good at: deciding which creative to kill and which audience targeting signals to feed the model. Feed the bid algorithm the best events you can, and stop asking a pixel to settle a boardroom argument.
What we do about it
We set up advertisement tracking as part of onboarding, not as a paid extra, because we cannot buy media properly without it. Conversions API and enhanced conversions on day one, consent signals checked against the banner, and a monthly reconciliation against the client’s own order data.
Our pricing is published so you can see what that costs at your spend level before speaking to anyone, and the same discipline shows up in how we handle media buying and programmatic advertising. If your numbers and your bank statement disagree, fifteen minutes is usually enough to find where the advertisement tracking is lying to you.
Questions people actually ask
Did third party cookies actually go away?
No. Google confirmed in April 2025 that Chrome would keep third party cookies with no new choice prompt, then retired ten Privacy Sandbox technologies in October 2025 including the Attribution Reporting API. Safari and Firefox have blocked cross site cookies by default since 2020, so roughly a fifth of global browsing was never addressable. Nothing changed in Chrome.
What is the difference between the Meta Pixel and the Conversions API?
The Pixel fires from the visitor's browser, so it is blocked by ad blockers, restricted by browser privacy settings and lost when a tab closes early. The Conversions API sends the same event from your server, which is not subject to those limits. Run both, with a shared event ID on each event so Meta deduplicates them into one conversion.
Is server side tracking legal under GDPR?
Server side tracking is a collection method, not a consent workaround. The same lawful basis rules apply whether an event leaves a browser or a server. What server side gives you is a single place to enforce consent, so events from users who refused are dropped before they reach any ad platform rather than after. That is easier to defend, not easier to avoid.
How much of my conversions am I actually missing?
It depends almost entirely on your iOS share and your consent rate. A browser only setup on a market with 50 percent iOS traffic typically under reports meaningfully against back end sales, while the same setup in a 90 percent Android market looks close to correct. Compare platform reported conversions against your own order data for one month before assuming a number.
Do I still need Google Analytics if I have platform tracking?
For paid media decisions, not really. Ad platform conversion data drives bidding, and back end order data settles what happened. Analytics sits in the middle and agrees with neither. Keep it for on site behaviour and funnel diagnosis, but stop using it to arbitrate whether a campaign worked, because its attribution model was never designed for that argument.