Conversion API and pixel news
What changed in vendor conversion APIs, pixels, and the measurement stack, and what each change means for the people who ship the payload. Reference material lives in the docs; this is the timely layer on top. RSS feed.
Norway's Xandr fine says an advertising ID in RTB needs consent your CAPI pipe cannot borrow from the app.
The Norwegian DPA fined Xandr NOK 92 million for joint-controller RTB processing of Grindr users' advertising IDs and app context. Copying madid into a server conversion event does not inherit Grindr's invalid consent.
Pixellint 0.44.0 checks Mixpanel SDK plain-text captures.
Mixpanel Track, Engage and Groups inspect the SDK data= string body in explicitly captured text/plain requests. Endpoint ownership, original headers and local evidence limits remain explicit.
Pixellint 0.43.0 checks AppsFlyer web events and visits.
Two endpoint-specific AppsFlyer web S2S packs check observable HTTP, identity, event and visit contracts. Mobile S2S keeps its distinct body and authentication requirements.
Pixellint 0.42.0 checks Mixpanel and Segment batch cardinality.
Mixpanel Track arrays now enforce the documented 2,000-event limit, and Segment batch arrays enforce 2,500 calls. Boundary controls verify aggregate checks beside existing event-level validation.
Pixellint 0.41.0 checks IAS identities across declared ad sessions.
Explicit session groups let Pixellint compare IAS UVP identities within an ad session and detect reuse across sessions. Relationship findings retain original row targets and visible incomplete coverage.
Pixellint 0.40.0 inspects explicitly captured gzip request bodies.
An explicit binary HTTP capture and bounded gzip decoder let existing Mixpanel Import checks inspect compressed JSON and NDJSON. Original transport and availability context stay visible.
Pixellint 0.39.0 checks PHP parsing and sanitization in Matomo bulk requests.
Matomo bulk entries gain bounded PHP bracket parsing and sanitization. Browser capability flags now accept the zero values emitted by Matomo’s official tracker.
Pixellint 0.38.0 adds documented tracker checks and deepens IAS session validation.
Google PCS, ADCTV and the documented 00px counting pixel gain narrow packs. A fresh 8,800-sample replay adds 24 IAS warnings and preserves all 323 errors.
Pixellint 0.37.0 flags Segment setup tokens and accepts PostHog redaction.
Segment installation tokens now warn, PostHog accepts documented null context values, and 12 more observed tracker hosts receive attribution with explicit core-only coverage.
Pixellint 0.36.0 catches an IAS installation placeholder and identifies more VAST pixel hosts.
IAS video pixels now reject the copied installation stub in xsId. Six vendors gain directory attribution, while Vastlint exposes core-only coverage and refreshes its embedded engine.
Pixellint 0.35.0 deepens six rulepacks and adds local HAR replay.
Six existing packs gain source-backed checks and parser corrections. Local HAR import preserves capture uncertainty. All 320 new evaluation cases pass; the frozen 8,550-artifact stored corpus stays unchanged.
Pixellint 0.34.0 deepens collector protocols and payload validation.
Two new packs and six deeper destinations add source-backed collector, bulk and multipart checks. All 601 evaluation cases pass; a full 8,550-artifact replay adds one warning and no errors.
Pixellint 0.33.0 validates more destinations and links HTTP transport to event contracts.
159 vendor packs across 85 vendors, complete HTTP capture validation, and 1,310 more stored artifacts selecting vendor checks. Full corpus replay adds 24 supported error findings; one redacted case remains ungradable.
Pixellint 0.32.0 deepens destination rules and adds 13 error findings in corpus replay.
137 vendor packs reviewed, 4,205 field contracts, and a replay of all 8,133 stored samples against 0.31.12. Error findings rise from 231 to 244, with the redaction and coverage limits reported alongside the result.
A Rockerbox Attributed CPA on ChatGPT Is Not Ads Manager CPA
October 2026 press cited attributed cost per acquisition 15.3% below a benchmark without spend or dates; that journey-model credit is not the click-through Conversions column OpenAI uses for CPA or the order_created rows your worker POSTs.
ChatGPT Ads Manager Conversions Is Click-Through Only; View-Through Sits in a Different Column
OpenAI documents that Conversions in Ads Manager remains click-through based while view-through conversions report separately with a one-day window. DSP exports that sum the wrong field will mis-train the bidder.
A high invalid click rate on ChatGPT landings is not the same as a broken Conversions API pipe.
TrafficGuard counted datacenter and impossible-device clicks on advertiser sites using OpenAI click references; that post-click score does not show what OpenAI billed or whether bzr.openai.com ingested order_created with oppref.
Server-side GTM does not invent click IDs the browser never saw.
A server container can hash PII and still ship empty gclid or fbclid if the web container never wrote them onto the event the client forwards.
A ChatGPT ads phone lead in a tracking dashboard is not the same conversion OpenAI optimizes on.
Lead platforms can attribute calls and forms to ChatGPT campaigns and forward qualified conversions to OpenAI, but the advertiser still owns the bzr.openai.com POST, the events[] types, and oppref from the click.
OpenAI CAPI vs Meta CAPI wants order_created and timestamp_ms, not Purchase.
Meta posts event_name Purchase and event_time in seconds to Graph. OpenAI Ads posts type order_created and timestamp_ms in milliseconds to bzr.openai.com. The click id is oppref, not fbclid. A ten-digit clock is outside the seven-day window.
Floodlight vs Google Ads conversion tracking is a Campaign Manager activity, not an AW- send_to.
Floodlight is an image on doubleclick.net with src, type, cat, and ord on the path. Google Ads conversion tracking is send_to AW-id/label, or /pagead/conversion/{id} with label. ord=1 undercounts. A Floodlight cat does not select a Google Ads conversion action.
Server-side GTM vs Meta CAPI Gateway is a fan-out container against a Pixel-to-Graph box.
sGTM starts with a browser hit to your collector and can forward to more than Meta. Meta CAPI Gateway takes the Pixel and posts Conversions API to Meta, with event_id generated for you. Google tag gateway only serves the Google tag from your domain. None of the three is the other.
SKAdNetwork vs AdAttributionKit splits on re-engagement: click-only, no runner-up postbacks.
SKAN 4 still has one fine conversion value, and only on the first postback when crowd anonymity allows. AdAttributionKit re-engagement is click-only, has no did-win false copies, and gives the device 2 days for the first update. A SKAN 2 campaign-id mapping does not describe that conversion.
gclid vs fbclid vs ttclid are three click ids, and none of them fills the others.
gclid is the Google Ads landing query, not the _gcl_aw cookie. fbclid becomes Meta fbc only as fb.1.milliseconds.fbclid. ttclid is TikTok and web-only on Events API. A shared click_id column that always stores gclid starves Meta and TikTok.
AppsFlyer vs Adjust is an event name on one host and a dashboard token on the other.
AppsFlyer S2S wants eventName and eventTime as a UTC string on api3.appsflyer.com, joined on appsflyer_id. Adjust S2S wants event_token and app_token on s2s.adjust.com, with s2s=1, and returns 400 when the token does not exist. A shared Purchase string feeds one of them.
Snap CAPI vs Meta CAPI wants PURCHASE and WEB, on tr.snapchat.com/v3.
A legal Meta Purchase uses event_time in seconds, action_source website, and a Graph pixel id. Snap CAPI v3 wants event_name PURCHASE, action_source WEB, and the pixel id in the path. v2 /v2/conversion is the retired body.
Reddit CAPI vs Meta CAPI stores event_at in milliseconds and WEBSITE in uppercase.
Meta event_time is ten-digit seconds and action_source is website. Reddit CAPI v3 stores event_at as thirteen-digit milliseconds and action_source as WEBSITE. A Meta body on ads-api.reddit.com lands the clock in 1970. test_mode is gone.
LinkedIn CAPI vs Meta CAPI wants conversionHappenedAt in milliseconds, inside 90 days.
Meta event_time is ten-digit seconds, and a value older than about seven days fails the batch. LinkedIn conversionHappenedAt is thirteen-digit milliseconds inside 90 days. The ten-digit clock reads as 1970 and returns INVALID_CONVERSION_TIME_FIELD_VALUE.
Pinterest CAPI vs Meta CAPI wants checkout and action_source web, and event_id is required.
Meta Purchase with action_source website can train. Pinterest standard event_name is checkout, action_source is web, and event_id is required for tag dedup. Purchase is a custom name. Unmapped custom events stay untracked.
TikTok Events API vs Meta CAPI splits on event_source, and on which clock the path still uses.
A Meta Purchase with ten-digit event_time and action_source website is a legal Graph event. TikTok Events API 2.0 wants event_source, event_source_id, and event_time in seconds on /event/track/. The older /pixel/track/ path still wants timestamp as ISO 8601. fbc does not fill ttclid.
An advertiser conversion worker should fail in CI on the clock, not in Test Events.
A measurement engineer at an advertiser can pin the pixellint action on the fixture the worker emits. Exit 1 is an error finding. Exit 0 still allows warnings. Test Events stays empty until that fixture is the body production posts, and the playground is the check for the fired URL CI never sees.
An agency Pixel Helper check is not a contract pass on the client pixel.
An ad ops manager at an agency can see the tag fire and the vendor count, and they often cannot open the client repo. Pixel Helper shows a browser hit. It does not show a 13-digit server clock, a raw email, or an event_id that does not match eventID. The playground checks the URL and the JSON they were actually sent.
A DSP sandbox CAPI sample is not the event production will send.
A solutions engineer at a DSP can validate the partner sample and still be looking at fields production leaves empty. The sample has fbc, a ten-digit clock, and a hash. The webhook has a millisecond clock and no click id. The bidder trains on the webhook. Evaluate both before you promise a match.
Meta CAPI vs Google enhanced conversions lines up a Graph event with a Data Manager upload.
adIdentifiers.gclid is the landing-page query value. _gcl_aw is only the cookie the linker writes so a later tag can find it. Pasting the cookie into the upload is the same miss as pasting a raw fbclid into Meta's fbc.
Meta pixel vs Conversions API lines up a browser hit with a server event on the same dataset.
The middle number in _fbp and _fbc is milliseconds. event_time is seconds. Dividing every timestamp by 1000 makes the server clock legal and forges a click cookie the pixel never wrote. You can rebuild fbc from a stored fbclid. You cannot invent _fbp.
GTM Consent Initialization Must Fire Before Conversion Tags
Google built a trigger that runs before Container Loaded so consent defaults exist first; a Conversion Linker or CAPI tag on All Pages still races the CMP when that trigger never carried your defaults tag.
Adjust S2S Event Tokens Are Not AppsFlyer Event Names
A shared MMP worker that posts AppsFlyer eventName into Adjust's S2S event_token field silently drops the conversion.
Amazon Ads Events API Is Not Meta CAPI With a New Host
Amazon conversionType and eventSource enums reject Meta event_name plus action_source payloads even when email hash and event_time look right.
Consent Mode URL passthrough is not a license to fire conversion tags before consent
ads_data_redaction plus url_passthrough can keep click ids on the next hop and still leave conversion tags in denied ad_storage until the CMP writes.
ChatGPT ads MMP attribution is not proof your OpenAI CAPI pipe ingests order_created
MMPs now attribute ChatGPT Ads through OpenAI's Conversions API, but the advertiser-owned bzr.openai.com POST still needs oppref and events[] the MMP dashboard never validates for you.
A Meta Test Event Code Does Not Train Production Matching
Test Events only proves CAPI payloads that still carry test_event_code; Meta tells you to strip that field on production POSTs, so a green Test panel can hide a dead live pipe.
Meta _fbc Is Empty Unless fbclid Hits the Landing Page
CAPI can send a well-formed user_data.fbc and still match nobody if fbclid never reached first-party storage on the landing hop before checkout fired server-side.
ChatGPT ads have a conversion API. Copying Meta CAPI is how the purchase never attributes.
OpenAI Ads posts conversions to bzr.openai.com with timestamp_ms, type, and oppref. A Graph CAPI body on that host is a miss that still looks live.
Reddit v3, Snap v3, and OpenAI CAPI landed in one year. One shared worker failed all three.
Reddit event_at milliseconds and UPPER_SNAKE, Snap v3 path and PURCHASE, OpenAI timestamp_ms and order_created. Stacks that still emit Graph JSON keep their 200s. Attribution does not.
LiveRamp ATS Mobile SDK sunsets September 30, 2026. The envelope moves to the ATS API.
LiveRamp's ATS Mobile SDK is deprecated and fully sunsets September 30, 2026. In-app authenticated traffic that still calls the SDK after that date will not mint RampID envelopes. Web ATS and the API remain.
Google tag gateway did not replace the conversion linker. gclid still dies on the thank-you host.
Google tag gateway serves the tag from your domain. It does not copy gclid onto a hosted checkout host. Conversion linker still writes the first-party cookie. Enhanced conversions hashed email is a match key, not a substitute.
Microsoft published UET CAPI docs. Access is still a per-account pilot.
capi.uet.microsoft.com is documented with data[], eventId, and msclkid. Microsoft's own help page still says not every account has CAPI. A 200 is not enrollment.
AppsFlyer S2S eventTime is a UTC string. A Meta epoch is how the subscription never attributes.
AppsFlyer S2S posts to api3.appsflyer.com with eventTime as yyyy-mm-dd hh:mm:ss.sss UTC. A Meta epoch on that path can 200 and still never record the renewal.
Meta CAPI Gateway only forwards the Pixel. Signals Gateway is the hub. Mixing them is a silent Meta-only pipe.
Conversions API Gateway is Pixel-in, Meta CAPI-out on your cloud. Signals Gateway adds pipelines, BigQuery, and custom HTTPS. A Gateway that only talks to Meta is not a multi-vendor CAPI.
Safari still blocks third-party cookies. Chrome keeping them did not unbreak Safari purchases.
Chrome's April 2025 choice to keep third-party cookies did not change WebKit ITP. A Meta pixel that only looks healthy in Chrome still misses Safari checkout.
AdAttributionKit re-engagement has no runner-up postbacks. SKAN 2 mappings do not apply.
AdAttributionKit re-engagement is click-only and sends no did-win false copies. Conversion tags on iOS 18.4 are not a SKAN 2 campaign-id. SKAN mappings do not describe that conversion.
SKAN 4 still has one fine conversion value, and it is only the first postback.
SKAdNetwork 4 added three windows and coarse low, medium, high. Fine 0-63 only arrives on postback 1 when crowd anonymity allows. Windows 2 and 3 are coarse.
Nextdoor CAPI wants event_time_epoch in seconds. pixel_id is deprecated. data_source_id is the pixel.
Nextdoor CAPI posts event_time_epoch in Unix seconds and data_source_id as the pixel. A Meta body with pixel_id and ISO event_time is a miss that still looks live.
Google merged enhanced conversions for web and leads. The April 2026 switch is one on/off.
Starting April 2026 Google Ads accepts user-provided data from website tags, Data Manager, and API together. Hash email, phone, names, and street. Leave city, region, postal, and country raw.
GA4 Measurement Protocol is microseconds. Pasting it into Meta CAPI is 1970.
GA4 mp/collect wants timestamp_micros, about 16 digits, 72-hour backdate. Meta event_time is seconds. LinkedIn is milliseconds. OpenAI is timestamp_ms. Date.now() cannot feed all four.
X Conversion API event_id is the Ads Manager UUID. conversion_id is the dedup key.
On X, event_id is the conversion event created in Ads Manager, not your order id. Dedup with the pixel uses conversion_id. OAuth 1.0a. Need twclid, hashed email, or hashed phone.
TCF v2.3 made disclosedVendors mandatory. A v2.2 string after March 1 is invalid on new consents.
IAB Europe released TCF v2.3 on 19 June 2025. After 28 February 2026, new TC strings without disclosedVendors are invalid. Old strings stay until the user renews. tcfPolicyVersion stays 5.
Taboola lands tblci. The postback wants click-id. The hyphen is the conversion.
Landing pages receive tblci. Taboola S2S GET and bulk JSON require click-id with a hyphen. Sending tblci to trc.taboola.com records nothing. Bulk POST still returns 204.
Yahoo DSP CAPI takes eventTs in seconds or milliseconds. LINE Yahoo truncates 13 digits.
Yahoo Inc DSP posts eventTs as 10 or 13 digits to batch.datax.yahoo.com. LY Corporation Conversion API treats 13-digit event_time as seconds by dropping the last three digits. One worker cannot serve both stacks.
UID2 inside a LiveRamp envelope still wants SHA-256. MD5 is how the token never appears.
Publishers on LiveRamp ATS mint a UID2 beside RampID only with Interoperable IDs on, SHA-256 hashing, and Prebid storage.refreshInSeconds at 1800. Bidstream sharing is tokens, never raw UID2s.
CHIPS survived the Privacy Sandbox cull. Unpartitioned iframe cookies did not.
Cookies Having Independent Partitioned State remain supported after Topics and ARA died. A third-party pixel iframe that sets SameSite=None without Partitioned is a cookie the top-level site cannot share. CHIPS is not CAPI.
Chrome bounce tracking still wipes redirect pixels. Third-party cookies staying did not save the bounce hop.
Bounce tracking mitigations stay on Chrome's supported list after Privacy Sandbox ads APIs died. When third-party cookies are blocked, Chrome deletes state on bounce sites with no 45-day interaction.
TikTok Events API 2.0 is one endpoint. Web, app, offline, and CRM are event_source, not three hosts.
Events API 2.0 posts to open_api/v1.3/event/track with event_source web, app, offline, or crm. App via 2.0 is allowlist. Dedup is event_id plus event. Unix seconds on the server; ISO on the old pixel path.
Pinterest CAPI wants checkout, lowercase. Purchase is a custom event that never trains.
Pinterest standard event_name values are add_to_cart, checkout, lead, page_visit, signup. event_time is Unix seconds. action_source is web, not website. A Meta Purchase body on api.pinterest.com is how ROAS never moves.
Google retired Attribution Reporting. Chrome cookies stayed. The replacement stack is gone.
On October 17, 2025 Google retired Topics, Protected Audience, Attribution Reporting, and the rest of the low-adoption Privacy Sandbox ads stack. CHIPS, bounce tracking mitigations, FedCM, and UA-CH continue. ARA-only measurement has no Chrome API left.
CM360 started reading GPP National v2. A US Privacy 1YNN string is not that hop.
From September 2025 Campaign Manager 360 supports GPP National v2 and still v1. TCF strings stuffed into gpp are rejected. Pixel URLs still need gpp and gpp_sid. us_privacy is a different signal.
Google tag gateway is not server-side GTM. First-party mode was renamed, not replaced.
First-party mode is now Google tag gateway for advertisers: a CDN or load balancer serving gtag from your domain. It does not enrich, consent-gate, or fan out to Meta. Complementary to sGTM, not a swap.
Google cut EEA conversion tracking for Consent Mode misses. A CMP banner is not ad_user_data.
From July 21, 2025 Google began disabling personalized ads, remarketing, and conversion tracking on EEA properties that failed the EU User Consent Policy after notice. Consent Mode v2 needs four signals, not a banner screenshot.
LinkedIn conversionHappenedAt is milliseconds. A ten-digit Meta clock fails the 90-day check.
LinkedIn conversionHappenedAt is epoch milliseconds within the past 90 days. Copying Meta event_time in seconds reads as 1970 and returns INVALID_CONVERSION_TIME_FIELD_VALUE. If your source is seconds, append 000.
Reddit CAPI v3 made event_at milliseconds. A Meta-second clock is a silent miss.
Reddit CAPI v3 stores event_at as integer Unix milliseconds on POST /api/v3/pixels/{PIXEL_ID}/conversion_events. A ten-digit Meta event_time lands in 1970. tracking_type is UPPER_SNAKE. test_mode is gone.
Meta put Event Match Quality on an API. The Events Manager tile is not the only score.
As of May 28, 2025 the Dataset Quality API exposes EMQ diagnostics, coverage, dedup, and freshness. April 2026 added event spend and ad-set breakdowns. A 200 from graph.facebook.com events is still not a match.
Chrome kept third-party cookies. The cookieless Chrome plan is the miss.
On April 22, 2025 Chrome said it will not roll out a new standalone third-party cookie prompt. Safari, Firefox, and Incognito still block them. Pausing CAPI for Chrome 3PCD is optimizing on a browser that did not flip.
Snap CAPI v2 is gone. The v3 path is tr.snapchat.com/v3/{id}/events.
Snap deprecated Conversions API v2 in early 2025. Posting the old conversion body to /v2/conversion is how Snap never sees the purchase. v3 wants data[] with event_name in SCREAMING_SNAKE, event_time, and event_source_url on web.