How to Future-Proof Your Attribution: Preserving Ad Click IDs with Server-side Tagging

Introduction

The landscape of digital tracking is constantly evolving, driven heavily by privacy measures. With major announcements, such as Apple expanding Link Tracking Protection (LTP) with iOS 26, marketers face increasing difficulty in maintaining accurate paid ad attribution.

Link Tracking Protection is designed to remove various tracking parameters, such as gclid, from the page URL. This feature is enabled by default in Safari’s Private Browsing Mode, and if expanded further, it could seriously cripple your ability to attribute paid ad conversions.

Although industry tests conducted following the iOS 26 release suggest that ad click parameters are not currently being removed in normal browsing mode, this status quo may not remain in the future.

This guide details a step-by-step strategy to make your tracking setup more resilient by explaining exactly how to preserve critical ad click IDs using a combination of your ad platform’s settings and a server-side Google Tag Manager (GTM) container.

Why Ad Click IDs Matter

Before diving into the solution, it is essential to understand the “why”.

When a user clicks on one of your paid advertisements, the ad platform (such as Google Ads or Facebook Ads) appends a unique parameter known as an ad click ID to the destination URL.

Common examples of these parameters include:

• Google Ads: gclid, wbraid, gbraid
• Facebook Ads: fbclid
• Microsoft Ads: msclkid

This ID is the key to connecting that specific user’s session and any conversions they complete back to the exact advertisement they clicked. Link tracking protection features are designed specifically to strip these types of parameters from the URL, effectively breaking your attribution chain. Without these IDs, attribution becomes incredibly difficult, turning the optimization of your ad spend into a guessing game.

The Solution: A Two-Part Strategy

The core strategy for solving this attribution challenge is to “disguise” these ad click IDs so that browsers and privacy features fail to recognize and remove them. We then use our server-side GTM container to “un-disguise” them before they are sent to analytics tools.

This process involves two key parts:

1. Modify URLs in the Ad Platform:

   We use the ad platform’s tracking settings to establish new, custom “decoy” parameters that hold the same value as the original click IDs. For example, if the original ID is gclid, we create a custom parameter, say c_gci, to hold its value.

2. Transform Data in Server-side GTM:

   We configure our server container to identify these custom parameters and transform them back into the standard parameters (like gclid, wbraid, etc.) before forwarding the data to tools such as Google Analytics.

The result is that the browser’s privacy feature sees the custom parameter (c_gci), does not recognize it as a known tracker, and leaves it alone. The server performs the necessary restoration behind the scenes.

Configure the Tracking Template in Google Ads

This solution relies on an ad platform feature that allows for the dynamic modification of destination URLs. Google Ads fully supports this using the Tracking template feature. (Note: Not all platforms support this; for instance, at the time of writing, Facebook Ads does not offer an equivalent feature for parameters like fbclid).

Steps for Google Ads Configuration

1. Navigate to Tracking:

   In your Google Ads account, go to Admin > Account settings and select the Tracking section.

2. Enable Auto-tagging:

   Ensure that Auto-tagging is enabled (set to “Yes”) above the Tracking section, as this is the feature that enables the standard gclid parameter.

3. Implement the Tracking Template:

   In the Tracking template field, copy and paste the following string. This string tells Google Ads to take the final landing page URL ({lpurl}) and append our custom query parameters:
   {lpurl}?c_gci={gclid}&c_wbr={wbraid}&c_gbr={gbraid}

   • {lpurl}: This is a ValueTrack parameter representing the final URL.
   • c_gci, c_wbr, c_gbr: These are the custom “decoy” parameter names.
   • {gclid}, {wbraid}, {gbraid}: These ValueTrack parameters are dynamically replaced by Google Ads with the actual click ID values.

4. Save Changes:

   Click Save.

Now, every time someone clicks on a Google Ad, the URL will contain both the original click IDs and the custom, disguised versions.
Configure Your Server-side GTM Container

The second part involves configuring the server container to transform the custom parameters back into standard ones. For example, if the landing page URL arrived as www.example.com?c_gci=abc123, the server container will rename c_gci back to gclid to ensure attribution continues properly.

1. Import Query Replacer Variable Template

This transformation is managed using a Query Replacer custom variable template.

1. In your server GTM container, navigate to Templates.
2. Under “Variable Templates”, click Search Gallery.
3. Search for Query Replacer (the one by stape-io), click Add to workspace, and confirm permissions.

2. Create the Query Replacer Variable

1. Go to Variables and click New under “User-Defined Variables”.
2. Choose Query Replacer for the variable configuration.
3. Define the replacement rules by clicking Add Row for each standard parameter:
   • Replace c_gci with gclid
   • Replace c_wbr with wbraid
   • Replace c_gbr with gbraid
4. Enable Crucial Setting: Important: Enable the “Skip existing query parameters” checkbox. This ensures that if the original parameter (e.g., gclid) is not removed by the browser, the custom parameter is not renamed. This prevents problematic URL formats like example.com?gclid=123&gclid=123.
5. Give the variable a descriptive name, such as page_location with restored click ids, and save.

3. Create a Transformation

Transformations globally modify event data. We will create one to apply our new variable to every incoming event, ensuring all tags use the modified (restored) page_location.

1. Go to Transformations and click New.
2. Give it a name (e.g., “page_location with restored click ids”).
3. Set the “Transformation Type” to Augment Event.
4. Under “Parameters to Augment”, click Add Row.
   • Set the Parameter Name to page_location.
   • For the Value, select the {{page_location with restored click ids}} variable you just created.
5. Leave “Matching Conditions” as Always apply and “Affected Tags” as All Tags.
6. Save the transformation.

This transformation is now a global rule, ensuring that the page_location parameter is processed, restored, and used for all subsequent tags.

3. Test Everything

With the Google Ads template configured and the server-side transformation set up, testing is essential.

1. Enable Preview mode in both your web and server GTM containers.
2. Create a test URL using your website and manually append the custom parameters with fake values (e.g., https://yourwebsite.com/?c_gci=12345&c_wbr=w12345).
3. Paste the test URL into your web GTM Preview and connect.
4. In the server GTM Preview tab, select the page_view event. The “Event data” tab should show the custom parameters (c_gci, etc.) in the request URL—this is what the server received.
5. Click on a subsequent tag, such as the GA4 Tag, that fired on the page_view event.
6. Scroll down to the Modified Event Data section. You should now see that the page_location parameter contains the standard, restored parameters (gclid, wbraid, and gbraid).

If the “Skip existing query parameters” checkbox was correctly enabled, you should also run a test where both the original and custom parameters are present (e.g., https://yourwebsite.com/?gclid=12345&c_gci=12345). The final page_location in the Modified Event Data should contain both parameters.

Once testing is complete and successful, remember to Submit and Publish your changes in both the web and server containers to push the solution live.

What About UTM Parameters?

While UTM parameters do not currently appear to be targeted by tracking protection, this setup is flexible and can be extended to protect them, preparing you for the future.

To protect UTMs, you would:

1. Update the Google Ads Tracking Template:

   Add custom parameters mapped to relevant ValueTrack parameters (e.g., …&c_src=google&c_med={network}).

2. Update the Query Replacer Variable:

   Add new rows to map the custom UTMs back to the standard ones (e.g., replace c_src with utm_source).

The Operational Challenge

The most difficult part of protecting UTMs is operational consistency. Protecting UTMs requires a thorough audit and coordinated effort across your entire organization.

You generate URLs with UTM parameters in many places beyond Google Ads:

• Email Marketing Platforms (e.g., Mailchimp, Klaviyo)
• Social Media Management Tools (e.g., Hootsuite, Buffer)
• Manual Links for social posts, affiliates, or QR codes

For the UTM protection solution to work effectively, every single one of these sources must be updated to use your new custom parameters (e.g., c_src instead of utm_source). If a link is missed and its standard UTMs are stripped by a privacy feature, the server-side setup will not have the necessary custom parameters to restore the data, resulting in loss of attribution.

Final Words

By leveraging the tracking templates of your ad platform and the transformation power within server-side Google Tag Manager, you can create a highly resilient system that preserves your vital ad click IDs. This strategy protects your current attribution setup and prepares your website for future privacy-related changes.