Apple's Intelligent Tracking Prevention - Problems for PPC & Affiliate Marketing

[Ryuzaki]

In late 2017 when iOS 11 rolled out, Apple added their new Intelligent Tracking Prevention (ITP) "feature" into mobile Safari. They just rolled out Mac OS Mojave for desktop users which now includes it on the desktop.

Why is this a problem? Because an estimated:

• 10% of users use Safari on desktop in the USA
• 51% of users use Safari on mobile in the USA

We're talking hundreds of millions of users here. Take that globally and it's something around 3% and 22%, respectively.

So users in their privacy tabs on Safari have the option to do two things:

1. Prevent cross-site tracking
2. Ask websites not to track me

THE TIMELINE

Intelligent Tracking Prevention initially started when Safari was blocking third-party cookies. As an example, a lot of display ads will load as many as 50 third-party cookies to track users around the web and sell that data, let you use it for retargeting, etc. But since the user lands on yourdomain.com and the cookies are loading from adtracker.com then Safari can block all of that.

Then they rolled out the official ITP which stopped even first-party cookies from tracking you around the web after 24 hours. They limited these cookies to 24 hours in length. If you didn't revisit the site within 30 days, the cookie is deleted. Think about how bad that screws up Google Adwords campaigns.

Now, the 24-hour window is toast. In Safari, you flat out can't track users if they enable either of those two tick boxes in the image above. That's horrible for PPC advertisers. But it's worse than that for Affiliate Marketers.

I'm not entirely clear yet on how far reaching this is, but I know for sure that affiliate programs that have you send users through tracking links like aoe2bxuc28oe.commissionjunction.com will no longer be allowed to drop any cookies at all. These are called "first party bounce trackers." To follow up with that example, CJ.com is already working on and rolling out another solution. This is set by default, even if they don't check either of the two privacy boxes.

So does that screw with Amazon cookies being dropped? I don't know. Maybe the cookie is a first-party cookie since it's dropped on the user when they land on Amazon. But what about the 24 hour tracking window? So now if they don't buy immediately you don't get a commission? I don't know, and I'm hoping we can all solve this together.

Google Adwords and Analytics and Tag Manager are trying to cook up solution revolving around some new "_gac" cookie, but my understanding is it will use machine learning to estimate your traffic and conversions instead of actually tracking them accurately.

They've also added "Origin-Only Referrer," which means they'll chop the referring URL down to the root domain so you can't track exactly which URL sent the sale. This sounds like everyone will need to start using URL parameters to pass data now (which they may block in the future).

Here's another example: You have a user who wants to buy a product click a link and they go through a tracking redirect. No cookie is dropped from the affiliate program like CJ / Shareasale. Let's say they do manage to drop a cookie on your site using your domain. That's okay because it's now a first-party cookie. The user ends up at the checkout and purchases something. Now the cookie tries to fire a conversion pixel redirect in order to give you credit for the sale. Nope, because now your first-party cookie is firing off in a third-party context. All of the old ways are screwed with this.

HELPFUL LINKS

• https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/
• https://clearcode.cc/blog/intelligent-tracking-prevention/
• http://junction.cj.com/article/what-you-need-know-about-apple-intelligent-tracking-prevention-itp
• http://blog.shareasale.com/2018/08/...-0-and-how-to-prepare-your-affiliate-program/
• https://smarterchaos.com/itp_2-0_affiliate_marketing_tracking_fix/
• https://neilpatel.com/blog/intelligent-tracking-prevention/

WHAT NOW?

Expect Chrome and Firefox to follow suit. So does this mean we just sit on our hands until all the programs get it together? Hell no, not if you don't want to be sending your valuable traffic to programs that can't track the sale and pay you your share.

Do you guys know much about this? We need to crack this mystery open and figure out which programs have already moved on to cookie-less tracking and which we are losing money on. Even in those cases you'll have to update your affiliate links. We need a team effort here!

 

[Ryuzaki]

I've just spoken to Amazon and was passed an internal email. I won't paste it for the obvious reasons but...

It basically says they're aware of the new ITP 2.0, they investigated the potential impact, and have concluded that it will have no impact on sale tracking or commission attribution. No action is required of affiliates.​

​

On the other hand, I'm 99% certain if you're doing business with CJ or Shareasale that they've been setting up some new tracking and you'll need to do some work to get on board, replacing your links or whatever it is they figured out.

 

[eliquid]

Really...

Because I know it impacts Google and their tracking. Seems like it would have impacted theirs too.

We had to change around lots of pixels and tags for Adword accounts. Maybe it was just the tech Google had though

Edit: yeah, just read all of your post. You mentioned Google already.

 

[bernard]

I know the affiliate network I'm using is moving to cookie less tracking, but it requires advertisers to update some stuff, which as we all know, will probably take a long time.

I currently have 10-15% of my clicks affected and I'm not happy about this at all. It seems to me that networks and advertisers are not at all treating this as the emergency it is.

 

[Ryuzaki]

@CCarter and I talked about this at length yesterday. I feel like we managed to get to the bottom of it for first-party cookies anyways.

For a lot of vendors with their own affiliate programs, I don't think much has to change unless they were doing something inefficient. Either track the referrer at the root domain level and stuff the cookie with that, get the affiliate to use URL parameters to then load the first-party cookie, or both. And then that cookie only works on the domain that installed it and no others. And you only get 30 days max, but if the user returns to your domain then that timer starts over and you get 30 more days. But all of this requires a rewriting of how you deal with the cookie as seen here.

Any affiliate program not using one of the two methods (or both) above will have to switch to that, because all intermediate redirects will no longer drop the cookie. Companies that don't switch will be ripping off their affiliates by not assigning conversions to them that happen in Safari.

This also means that any affiliates using programs that drop first-party cookies are fine except if they're using some kind of third-party tracking that acts as a redirect. That'll block your own cookie and possibly screw up the domain that shows up in the referrer slot of the browser headers. Sadly, we might have to go direct and drop our own "double check analytics" or accept that the figures will be low since we can't track Safari users.

Companies that broker and manage affiliate programs for lots of companies are probably going to have to go for a full Javascript solution that adds URL parameters to the affiliate's links on the page (or generate them for them in the dashboard like Amazon does), and get vendors to add a script that then calls back home to the affiliate program to count the conversion. Basically they'll have to develop some API's and get vendors on board while getting affiliates to use URL parameters.

TL;DR: URL Parameters are back on the menu, boys! (correct me if I'm wrong)

 

[Antti]

It may cause problems with affiliate tracking, but PPC with Google/FB Ads is unaffected.

If you use conversion data from GA with Google Ads, you don’t have to do anything. ITP won’t work as GA is 1st party. Or alternatively you can update the Ads pixel.

Facebook is also releasing update on their pixel on 24th of October (atleast in Finland). After that it’ll track with 1st/3rd party cookies. It’s possible to force 1st party tracking now on pixel settings, so you won’t have to wait until 24th and miss conversions.

 

[Samwise89]

ITP won’t work as GA is 1st party.

But isn't it saying that they treat subdomains as different "1st party domains," so passing information around from one service to another might goof it up, even if both are Google?

Google Adwords and Analytics and Tag Manager are trying to cook up solution revolving around some new "_gac" cookie, but my understanding is it will use machine learning to estimate your traffic and conversions instead of actually tracking them accurately.

The opening post says that. It must have some effect or they wouldn't have rolled out a new cookie and be doing estimations.

Or alternatively you can update the Ads pixel.

What does this do for you and what problem was it solving specifically?

It seems like all of these work arounds will be the next target, like Facebook's workaround. They don't want us using cookies at all for tracking if it's not all 1st party.

 

[Antti]

What does this do for you and what problem was it solving specifically?

It seems like all of these work arounds will be the next target, like Facebook's workaround. They don't want us using cookies at all for tracking if it's not all 1st party.

As far as I know, the updated Google Ads pixel does the same thing as Facebook's one; Mimic actual first party cookies so they can record conversions on all browsers.

From Google Ads Support center (bolding mine):

To ensure that Google Ads can measure all of your conversions, regardless of the browser that your site visitor is using, it's recommended that you use the updated Google Ads conversion tracking tag. This tag consists of a global site tag and an event snippet. This tag sets new cookies on your domain that will store information about the ad click that brought people to your website. The cookies receive the ad click information from a GCLID (“Google click identifier”) parameter that is included in the conversion tracking tag.

https://support.google.com/google-ads/answer/7521212?hl=en

But you are true, these are just workarounds. Tracking based on cookies is probably going away soon. I'm still 100% sure G/FB will figure out how to track conversions effectively as their whole business model depends on it.