The Tracking Crisis Nobody Talks About - Because It Already Happened

Safari's Intelligent Tracking Prevention (ITP) has blocked all third-party cookies by default since March 2020. Firefox's Enhanced Tracking Protection blocks known cross-site tracking cookies by default and uses Total Cookie Protection to isolate remaining cookies into site-specific jars.

The mechanisms differ between the two browsers, but the practical effect is similar: third-party cookie-based cross-site tracking is heavily restricted on both.

This matters because Safari and Firefox together account for a meaningful share of eCommerce traffic. According to StatCounter's June 2026 data, Chrome holds approximately 69.65% of global browser market share across all platforms, with Safari at approximately 15.31%. In the United States, Safari's share is approximately 25.91%. In the UK, it is approximately 27.71%.

A meaningful share of your store's traffic — varying by geography, device mix, and audience — is already browsing in an environment where third-party cookie-based tracking is heavily restricted. This does not mean those visitors are entirely invisible to all tracking methods. First-party cookies, server-side events, consented identifiers, click IDs, aggregated reporting, and modeled conversions may still provide partial signal. But the traditional third-party cookie-based tracking that many merchants rely on does not function as expected for these visitors.

In April 2021, Apple launched App Tracking Transparency (ATT) with iOS 14.5. Every app on iOS must now explicitly ask users for permission before tracking their activity across other apps and websites.

ATT opt-in rates vary significantly by source, definition, country, vertical, and whether the measurement counts all users or only those shown the prompt. Adjust reported approximately 35% industry-wide opt-in among prompted users in Q2 2025. An FTC-published research paper found that ATT reduced the share of trackable Apple traffic in one advertising dataset from 73% to 18% in the United States.

Regardless of the exact rate, the directional impact is clear: the majority of iOS users are either opting out or not being prompted, which reduces the deterministic conversion signal available to ad platforms.

For eCommerce merchants, the impact is direct. When a customer sees a Facebook or Instagram ad on their iPhone, clicks through to your store, and makes a purchase — but has opted out of ATT tracking — Meta may receive less deterministic conversion signal for that transaction. The sale happened, but the ad platform's ability to attribute it accurately is reduced.

The practical effects: campaign optimisation algorithms receive fewer conversion signals, which can lead to slower learning and higher cost per acquisition. Audience building for remarketing becomes less precise. Budget allocation between iOS and Android becomes less reliable because iOS-attributed ROAS may appear artificially lower than it actually is.

Beyond Safari/Firefox restrictions and iOS ATT, a growing percentage of users actively reduce tracking through browser extensions (uBlock Origin, Privacy Badger), VPNs that strip tracking parameters, consent management platforms where users decline non-essential cookies, and increasingly privacy-conscious default browser settings.

When multiple tracking restrictions combine — browser cookie restrictions, iOS ATT, ad blockers, and consent management — the measurement gaps can be substantial. The exact size of the gap varies by store and should be audited individually rather than assumed from industry averages.

If a meaningful portion of your conversions are not being attributed back to the campaigns that drove them, your reported ROAS is systematically lower than reality. Merchants who do not understand this may underinvest in campaigns that are actually performing well.

Facebook's algorithm, Google's Smart Bidding, TikTok's optimisation — all of them learn from conversion signals. When fewer conversions are visible to the platform, these algorithms optimise on incomplete data. The result can be higher cost per acquisition, slower campaign learning, and less precise targeting.

A customer clicks a Facebook ad on their iPhone, browses on Safari, returns through an email link on their laptop, and purchases through a Google search. If any of those touchpoints happens on a device or browser where tracking is restricted, that segment of the journey may disappear from your attribution model. You cannot optimise what you cannot measure.

Shopify has invested in tracking infrastructure more comprehensively than most platforms. Shopify's Customer Events system and Web Pixels provide a browser-side event framework running in a controlled pixel environment — this is primarily client-side JavaScript, not server-side tracking.

Separately, Shopify offers Meta data-sharing integration that supports both Meta Pixel (browser-side) and Conversions API (server-to-server) for purchase data, depending on the data-sharing level the merchant selects. Under Enhanced or Maximum data sharing, Shopify sends purchase events directly to Meta through a server-to-server connection. Shopify states that this server-to-server data cannot be blocked by browser-based ad blockers.

The limitation: while these capabilities exist, many Shopify merchants still rely primarily on default data-sharing settings rather than properly configuring Enhanced or Maximum sharing. The tools are available; the adoption gap remains.

This is why we built GTM Assistant — our server-side Google Tag Manager app for Shopify. After working on over 500 store migrations, we consistently observed a gap between ad platform-reported conversions and actual backend order data. GTM Assistant implements server-side GTM for Shopify stores, routing conversion events through a first-party server endpoint rather than relying solely on browser-side delivery. This approach is less dependent on browser cookie restrictions, ad blocker interference, and iOS ATT — though it does not eliminate the need for consent compliance or guarantee complete signal recovery.

The value is not just data completeness. It is decision quality. When your conversion data more accurately reflects actual sales, your ad platforms can optimise more effectively, your ROAS calculations are more reliable, and your budget allocation decisions are better grounded in reality.

WooCommerce does not provide a single native, managed server-side tracking layer comparable to Shopify's Meta data-sharing integration. Tracking relies on third-party plugins — typically a combination of Google Tag Manager, Facebook for WooCommerce, and various analytics plugins. Each plugin adds its own JavaScript tags to the storefront, all of which are subject to the same browser-level restrictions that affect any client-side tracking implementation.

Server-side tracking on WooCommerce is possible but requires significant custom development: setting up a server-side GTM container, configuring a tagging server (typically on Google Cloud), mapping WooCommerce events to server-side tags, and maintaining the integration through WooCommerce and WordPress updates. For merchants already managing the complexity of self-hosted WordPress — as we discussed in our WordPress 7.0 analysis — adding server-side tracking infrastructure is another layer of technical overhead.

Adobe Commerce offers integration with Adobe Experience Platform for enterprise-grade data collection. However, this capability is largely restricted to Adobe Commerce Cloud (the enterprise tier) and requires significant implementation effort within the broader Adobe ecosystem.

For merchants on Magento Open Source — many of whom are approaching the August 11, 2026 end-of-support deadline for version 2.4.6 — server-side tracking options are limited to custom GTM server-side implementations, similar to the WooCommerce approach but with Magento's own complexity added.

PrestaShop, currently navigating ownership changes and restructuring, has minimal native tracking infrastructure. Tracking depends on third-party modules, most of which use client-side JavaScript.

For merchants on legacy platforms like osCommerce, OpenCart, Zen Cart, VirtueMart, and CubeCart, the tracking situation is even more constrained. These platforms were built before server-side tracking was a concept, and the developer ecosystems are too small to produce and maintain modern tracking solutions.

Conversions that might not be delivered through browser-side pixels due to cookie restrictions or ad blockers can be supplemented through server-side events. Merchants who implement server-side tracking alongside browser-side tracking typically observe improved conversion reporting — the magnitude varies by store, audience, and implementation quality.

When Meta and Google receive more complete conversion data through server-side APIs, their optimisation algorithms have more signal to work with. More signal can lead to better targeting, more efficient bidding, and improved cost efficiency.

Server-side tracking combined with first-party data collection can provide improved visibility into the customer journey, particularly for cross-device and cross-browser journeys.

What server-side tracking does NOT do: it does not bypass user consent requirements under GDPR, CCPA, or other privacy regulations. Meta's privacy and data-use requirements apply equally to browser-side and server-side tools. Server-side tracking changes where data is processed, not whether consent is required.

Compare your ad platform's reported conversions against your actual order data (from Shopify, WooCommerce, or your commerce backend) for the same time period. Filter by device type and browser where possible. The gap between reported conversions and actual orders is your tracking blind spot. If the gap is meaningful, your optimisation decisions may be based on incomplete data.

For Shopify merchants, check your Meta data-sharing level in the Facebook & Instagram sales channel settings — Enhanced or Maximum sharing enables server-to-server purchase data delivery. For WooCommerce and Magento merchants, evaluate whether server-side GTM implementation is feasible for your technical environment.

Rather than relying solely on platform-reported ROAS (which may be systematically understated due to missing conversion signal), calculate blended ROAS across all channels: total revenue divided by total ad spend. Monitor channel-level ROAS for directional guidance, but use blended metrics as your primary optimisation signal.

Email addresses, phone numbers, and customer accounts are tracking-resilient identifiers. They work across devices, across browsers, and across sessions regardless of cookie or ATT restrictions. Every customer touchpoint that captures a first-party identifier strengthens your ability to measure and attribute more accurately.