How Safari's PCM Enables Private Ad Attribution

This article explores how Apple’s Private Click Measurement (PCM) in the Safari web browser enables advertisers to measure the effectiveness of their ad campaigns without compromising user privacy. By utilizing on-device storage, strict data limits, and delayed reporting mechanisms, PCM successfully connects ad clicks on one website to conversions on another, completely eliminating the need for cross-site user tracking and third-party cookies.

On-Device Processing

Traditionally, ad attribution relied on third-party cookies and tracking pixels to follow a user across the web. PCM replaces this by moving the entire attribution process directly onto the user's device.

When a user clicks an advertisement on a publisher's website, the site informs the Safari browser of the click using specific HTML link attributes. Instead of sending this data to an external server, Safari privately logs the click event in local, on-device storage. The browser holds onto this record for up to seven days, waiting to see if the user eventually converts on the advertiser's website.

Strict Limits on Data Collection

The primary way trackers identify users is by assigning them unique, lengthy ID numbers. PCM prevents this by enforcing severe limits on the amount of data—known as entropy—that can be attached to clicks and conversions.

• 8-Bit Source ID (Click Data): When a user clicks an ad, the publisher can only attach an 8-bit identifier to that click. This translates to a simple whole number between 0 and 255. This allows the advertiser to track up to 256 different ad campaigns simultaneously, which is enough to measure campaign performance, but mathematically impossible to use for identifying individual users.
• 4-Bit Trigger Data (Conversion Data): When the user completes an action on the advertiser's website, such as buying a product or signing up for a newsletter, the advertiser can only assign a 4-bit value to that event. This is a number between 0 and 15, allowing the advertiser to categorize up to 16 different types of conversion events (e.g., 1 for "sign-up", 2 for "purchase").

Matching the Click to the Conversion

To trigger an attribution event, the advertiser's website directs a specific HTTP request to a standardized .well-known URL path belonging to the ad network or publisher where the click originated.

Safari intercepts this request rather than letting it function as a standard tracking pixel. Upon interception, the browser checks its private on-device storage to see if the user previously clicked an ad leading to this destination. If a match is found, Safari combines the 8-bit campaign ID and the 4-bit conversion value into a single attribution report.

Randomized Delays and Anonymized Reporting

If Safari sent the attribution report the exact moment a purchase was made, the advertiser could easily match the timestamp of the report with the timestamp of the purchase in their database, thereby uncovering the user's identity.

To break this correlation, PCM uses a randomized timer. Once a conversion is matched to a click, Safari waits a random period between 24 and 48 hours before sending the report to the publisher and the advertiser.

When the report is finally sent, it is transmitted via an ephemeral session. This means the request is completely stripped of all cookies, credentials, and identifying browser headers. Combined with IP address masking, the advertiser receives verifiable proof that a specific ad campaign resulted in a specific conversion type, with zero insight into the identity of the person who made the click.