PCA PERFORMANCE LAB

Safari’s Tracking Update Explained: Organic Visits, CAPI and Enhanced Conversions

Your website can receive an enquiry while your advertising platform struggles to connect it to an ad. Understanding that difference helps you decide what to fix—and what your tracking tools can realistically do.

On 19 October 2026, WebKit described a Safari protection against third-party identity-resolution infrastructure. Here is what that means for marketers and business owners, using practical examples.

What did Safari change?

Some services connect information about a person across different websites. For example, an outside service may use an email entered on one website to help recognise the same person elsewhere. WebKit says Safari and WebKit in its version 27 operating-system releases block network access to this infrastructure at domain level.

This is a specific protection against cross-site identity resolution. It does not establish that every analytics event, CRM record or server integration stops working. Your exposure depends on the services your website actually uses. Read WebKit’s announcement.

Three different questions your systems answer

A record in one system does not guarantee a complete record in the other two. That is why “we have the lead in our CRM” and “the ad platform can attribute the lead” can both describe different parts of the same journey.

Example 1: Someone arrives organically

Riya searches for sofa-care advice and opens a furniture brand’s article through an unpaid Google result. She reads the page and leaves.

Depending on the measurement setup, browser restrictions and consent choices, analytics may record activity such as a page view. The business does not need her email to count a permitted page view. But it cannot assume it knows her name, phone number or personal identity.

If Riya later submits an enquiry, the business receives the information she supplies. Accepting a cookie banner alone does not reveal her email address.

For a business that does not advertise, useful work still includes measuring content engagement, recording enquiries, maintaining source information where available and tracking which enquiries become customers. Installing an advertising integration solely to identify every anonymous reader will not achieve that objective.

Example 2: Someone clicks an advertisement

Now imagine Riya clicks a Google ad, submits an enquiry and buys a sofa after a sales call. There are several handoffs:

1. The website receives the enquiry.
2. The CRM stores the contact and relevant source information.
3. The sales team records qualification and the eventual purchase.
4. The advertising setup receives the eligible conversion information needed for reporting and bidding.

If the CRM stores a phone number but the integration sends no usable matching information, the business can know about the sale while the platform has less information for connecting it to advertising.

That does not mean every unconnected sale should be assigned to an ad. Attribution still depends on an eligible interaction, timing, platform rules and available data.

Where Meta CAPI helps

Meta’s Conversions API supports sending events from a server or supported integration to Meta. Because this route does not depend entirely on a browser pixel, it can support event delivery when browser-side collection is limited. It can operate for journeys involving Safari as well as Chrome.

However, receiving an event and matching it to an eligible ad interaction are separate tasks. Match information, event accuracy, consent and configuration still matter. A server connection does not guarantee complete attribution or override a person’s choices.

Reference: Meta Conversions API documentation.

Where Google enhanced conversions helps

Google enhanced conversions supplements conversion measurement with supported first-party customer information, such as hashed email or phone data. Enhanced conversions for web supports website conversions; enhanced conversions for leads supports connecting website leads with imported offline outcomes.

Where available, preserve eligible click identifiers such as GCLID alongside the supported customer information in your lead workflow. Follow the requirements of the specific integration. Enhanced conversions can improve matching; it cannot guarantee that every customer is attributable. Reference: Google enhanced conversions.

Does adding more attributes help?

Relevant, accurate and permitted matching information can help a supported integration connect records. Start by using information already supplied for a legitimate purpose, rather than automatically adding more required form fields.

For example, a phone-only enquiry may still provide useful matching information if the integration supports it. Check whether that number reaches the correct field in the correct format. A useful first fix may be repairing an existing data handoff.

Do not send raw email addresses or phone numbers into ordinary GA4 event parameters or page URLs.

What consent changes

Google Consent Mode adjusts tag behaviour to consent choices. Basic implementation holds tags until consent; advanced implementation can send limited cookieless signals when consent is denied and support eligible modelling. Modelled reporting does not identify each anonymous visitor. Reference: Google Consent Mode.

A practical checklist for marketers

• Test real outcomes: Submit a test enquiry and follow it from the website to the CRM and destination platform.
• Inspect available identifiers: Check supported fields, formatting and whether identifiers survive the handoff.
• Check duplicate counting: Review browser and server events together where both are active.
• Review diagnostics: Event receipt, matching and attribution are different checks.
• Send useful outcomes: Where appropriate, return qualified leads or sales so reporting reflects more than submissions.
• Assess Safari dependencies: Ask which identity services the website uses and whether this specific protection affects them.

A practical checklist for business owners

• Confirm that genuine enquiries and orders reliably reach your own systems.
• Agree what counts as an enquiry, a qualified lead and a customer.
• Ask whether the contact information already collected reaches supported measurement tools correctly.
• Give the sales team a clear process for recording outcomes.
• Compare marketing reports with actual sales and explain differences before making budget decisions.
• Ask for a specific assessment of browser changes before approving extra tools or a rebuild.

A lead received, an event delivered, a conversion attributed and a sale caused by advertising are four different claims.

PCA’s practical interpretation: reliable measurement needs a connected process across website, CRM, sales and media. A browser update is a useful reason to inspect that process, while the actual repair should follow the evidence in your setup.

Sources

• WebKit: Blocking Identity Resolution Infrastructure, 19 October 2026
• Meta: Conversions API
• Meta: Customer information parameters
• Google Ads: Enhanced conversions
• Google Ads API: Offline conversion uploads
• Google: Consent Mode overview

Published 23 October 2026. Examples are fictional illustrations. Browser behaviour and product availability can change; implementation should follow the current documentation for your setup.