In this guide
- ITP caps cookies written by JavaScript at 7 days (24 hours in some cases when the visit follows a link with tracking parameters).
- Cookies set in an HTTP response from your own server fare better, but Safari can still cap them at 7 days when the server's IP address does not match your website's.
- Open Tracked's Cookie Keeper keeps platform cookies on your tagging server and gives them back when the visitor returns without them.
Intelligent Tracking Prevention (ITP) is Safari's set of rules that limits cross-site tracking. It has changed many times since 2017. For marketers the result is simple: a visitor who clicked your ad on Monday and bought on Sunday may look like a new visitor, and the platform loses the link between ad and sale. This page explains the current rules in practical terms and what helps. WebKit's own posts are the authority on details, and Safari changes, so test on real devices. See also Safari removes click IDs and extending cookie lifetime.
The rules that matter
| Rule | What it does | Who it affects |
|---|---|---|
| 7-day cap on script-set cookies | Cookies written with document.cookie expire after 7 days at most | Analytics and ad cookies set by JavaScript |
| 24-hour cap after link decoration | If the visit comes from a known tracker with parameters in the link, script-set cookies may last only 24 hours | Paid clicks from some platforms |
| 7-day cap for storage without interaction | Local storage and similar can be cleared after 7 days without a visit | Sites that rely on local storage |
| Link tracking protection | Known click ID parameters may be removed from URLs in some contexts | Ads that use gclid, fbclid and similar |
| Server-set cookies and IP matching | Cookies set in HTTP responses can be capped at 7 days when the setting server's IP does not match the site's | Tracking subdomains that point to a different IP range |
The last row is why a server container alone does not always solve the cookie problem. The details of the IP rule are technical and Apple has adjusted it, so check current WebKit documentation and test, rather than relying on a blanket promise from any vendor.
3 things to remember
Scroll and the points stack up.
ITP caps cookies written by JavaScript at 7 days (24 hours in some cases when the visit follows a link with tracking parameters).
Cookies set in an HTTP response from your own server fare better, but Safari can still cap them at 7 days when the server's IP add
Open Tracked's Cookie Keeper keeps platform cookies on your tagging server and gives them back when the visitor returns without th
What the chain of events looks like
Monday: ad click
The visitor lands on your site. Your tags write cookies, such as _fbp or a Google client ID.
Cookies start their clock
Script-set cookies are given a short life by Safari.
Sunday: the visitor returns and buys
The cookies have expired. The purchase looks like a new visitor.
The ad platform sees no earlier click
The sale is not matched to the ad, so it is under-reported.
What helps
Server-set cookies
Set the cookie from your tagging subdomain in an HTTP response. It lives longer than a script cookie, subject to the IP rule above.
02Restoring cookies from your server
Keep the cookie value on your server under a hash of an identifier you know (customer ID, e-mail hash) and return it when the visitor comes back. Open Tracked's Cookie Keeper does this on every plan, with the Data Store holding the values.
First-party identifiers
A logged-in customer ID or a hashed e-mail lets the platform match the sale even if the cookie is gone. See Meta event match quality.
04Server-side events
Send purchases from your server with the customer data you have, so a missing cookie matters less. See what server-side tracking is.
Runs on your domain, anywhere
Your tracking runs on your own domain, so a visit from any country is handled the same way.
How Cookie Keeper works
Cookie Keeper remembers the platform cookies on your tagging server, under a hash of an identifier such as the customer ID, and gives them back when the same visitor returns without them. For each platform you choose whether its cookie is extended (kept for up to 400 days) or not. You choose how the visitor is recognised: a customer ID, a cookie, local storage, a JavaScript variable or a page element. On the Business plan and up, you can add cookies of your own, with a name and the days to keep it. It needs the Data Store switched on. You test it in GTM Preview: delete the _fbp cookie, reload the page, and the server container sets it again from the Data Store.
Check your own Safari problem
- On an iPhone, visit your site from an ad link and note the cookies in the Safari settings or in the developer tools of a connected Mac.
- Check the expiry date of your key cookies. Anything at about 7 days is capped.
- Come back after 8 days and see whether the visitor is recognised as returning.
- Compare Safari conversion rates and attribution with Chrome in your reports.
Common mistakes
- Assuming a first-party subdomain is always enough.
- Treating a long cookie expiry in the response as proof. Safari may still cap it.
- Ignoring consent. Longer cookies make consent more important, not less.
- Testing only on desktop Chrome.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
Frequently asked questions
What is Safari ITP?
Intelligent Tracking Prevention is Safari's set of limits on cross-site tracking, including short caps on cookie lifetimes.
How long do cookies last in Safari?
Script-set cookies are capped at about 7 days, sometimes 24 hours. Server-set cookies can last longer, unless the IP rule caps them.
Does server-side tracking fix ITP?
It helps, especially with server-set cookies and first-party data, but it does not remove every limit. Restoring cookies from your server closes more of the gap.
Does ITP affect Chrome?
No. Chrome has its own rules. Firefox has Enhanced Tracking Protection.
Do I need consent for cookies in Safari?
The consent rules depend on law, not browser. ITP is a technical limit on top of them.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Troubleshooting · 6 min read
