iOS 26 strips click IDs in in-app browsers and Private Browsing - most of your paid-social web-to-app traffic.
This is specifically a web-to-app handoff problem, and it bites hardest where paid social actually runs: the in-app browser. The path it breaks: user taps your ad inside Instagram or TikTok, the in-app webview (or Private Browsing) opens your landing page or App Store redirect, installs the app. Link Tracking Protection fires as that webview loads the URL and strips gclid, fbclid, and other known tracking parameters before the page renders. Standard Safari tabs and your UTM parameters are left alone - it's the in-app and private contexts that get cleaned.
Your MMP SDK initializes after the page loads. The param was already gone.
The teams I've seen get caught by this are running web interstitials between the ad and the App Store - typically Meta App Promotion or other social campaigns where a landing page sits in the redirect chain and the tap opens in the platform's in-app browser. The click ID lives in that landing page URL. Inside the webview, iOS 26 strips it there.
Two fixes, in the order I'd wire them.
First: server-side click ID capture on the initial request. When a user clicks your ad and your server receives the first request, the gclid or fbclid is still present in the URL at that point - before any Safari processing fires. Capture it server-side through Stape or GTM Server on that first hit and pass it into your attribution pipeline server-to-server. The parameter exists at the server-request layer. It's gone after Safari's redirect chain processes it.
Second: Apple Universal Links for the App Store redirect. Universal Links bypass Safari's URL parameter stripping. If your App Store redirect runs through a domain you control with Universal Links configured, you can pass first-party campaign parameters through that aren't on Apple's stripping list. You lose click-level gclid fidelity, but you preserve campaign-source and ad-group attribution at the level most teams actually act on.
One more consideration for the App Store redirect setup: the deep link destination matters for which parameters survive. Universal Links with your own domain as the intermediary give you the most control. Standard App Store redirect URLs with query params don't benefit from the same protection.
The one channel that's unaffected in this entire breakdown: ASA. Apple controls both the ad serving and the app install infrastructure, so the attribution loop closes server-side without any click ID traversing a URL. If iOS UA is a meaningful share of your budget and web-to-app funnels are part of the mix, the ASA share of iOS spend is worth reexamining - it's the only path that doesn't lose the click to a webview.
Ruslan co-founded Tegra in 2017. Runs the Google Ads practice - feed, PMax, search, attribution. Writes weekly about the parts of paid search operators are afraid to touch.