iOS privacy changes removed the identifiers that connected clicks to purchases: ATT cut device IDs, and Safari ITP capped and partitioned cookies. The signal that survives is server-side, payment-verified, first-party — exactly what Deep Conversions reports.
What iOS Privacy Actually Removed
Three separate mechanisms compounded into today's attribution fog:
- App Tracking Transparency (ATT): The opt-in prompt cut off device-level identifiers, degrading Meta's and TikTok's click-to-purchase matching for iOS users.
- Safari ITP: JavaScript cookies are capped to as little as 7 days and partitioned per-site, so multi-week journeys lose their thread.
- Private Relay & Shielding: IP-based matching weakened, and link trackers increasingly strip or shorten click identifiers.
ROAS didn't get worse — your visibility did. The buyers are still there; the identifiers connecting them to campaigns were removed from the browser where your pixels live.
| Signal Type | Post-iOS Reliability | Survives Privacy Features? |
|---|---|---|
| Device identifiers (IDFA/GAID) | Low (ATT opt-out) | No |
| Browser cookies & pixels | Low to medium | No — capped, partitioned, blocked |
| Server-side payment-verified journeys | High | Yes — first-party, server-held, webhook-verified |
How to Rebuild Trustworthy ROAS
- Move Conversion Delivery Server-Side: Report purchases from the server where browser privacy features have no jurisdiction.
- Verify Payments Cryptographically: Let the payment provider — not the browser — confirm every conversion.
- Preserve Click Identifiers in Signed Journeys: Store gclid/fbclid/rdt_cid/ttclid server-side at click time, before any cookie can expire.
- Recalibrate Expectations: Compare platform ROAS against verified journey revenue monthly to keep both honest.
Deep Conversions holds journeys and verifies payments server-side — immune to ATT prompts, ITP cookie caps, and browser blocking — so ROAS means something again.
Restore My ROAS Visibility →Frequently Asked Questions
Do I need users to opt in via ATT for this to work?
No. Server-side, first-party, payment-verified attribution does not depend on device identifiers collected through ATT.
Does Android face the same issues?
Android has its own privacy rollouts, but the same server-side approach solves attribution for all platforms uniformly.
Will my platform-reported ROAS match exactly?
Not exactly — platforms still model and claim differently. Verified journey revenue becomes your source of truth for business decisions.