Safari ITP: Cookie Limits, Tracker Rules and the Analytics Impact

Safari ITP (Intelligent Tracking Prevention) is Apple’s built-in, on-by-default protection against cross-site tracking. It blocks every third-party cookie, uses on-device machine learning to spot tracking domains and delete their data, and caps cookies written by JavaScript at seven days, or 24 hours when the visit came from a tracker with a decorated link. For marketers, that means Safari visitors who come back after a week look like new users, and their conversions lose the source that first brought them.

This guide covers the rules ITP enforces today, how it decides what is a tracker, what it breaks in your reports (and what it leaves alone), how to check its effect in your own data, and which fixes actually work. If you are here as an iPhone user wondering about Safari’s tracking settings, skip to the section on settings and questions near the end.

What Is Safari ITP?

Intelligent Tracking Prevention is a feature of WebKit, the open-source engine behind Safari on Mac, iPhone and iPad. Apple shipped the first version in 2017 with iOS 11 and macOS High Sierra. In Safari settings it appears as Prevent Cross-Site Tracking, and it is on unless you turn it off.

The problem it targets is simple to describe. When you look at a product on one site and then see ads for it on five others, some company is recognizing your browser across sites. Historically that ran on third-party cookies. When Safari blocked those, trackers moved to first-party cookies, link parameters, local storage, redirects and DNS tricks. Each ITP release closed one of those routes, which is why the feature reads like a long list of specific rules rather than one switch.

Two design choices matter. First, classification happens on the device: Safari learns which domains behave like trackers from your own browsing, and Apple says that data is not sent to it. Second, ITP does not only target ad networks. Some rules apply to every site, including yours, because a first-party cookie written by a script looks the same whether it holds a login preference or a tracking ID.

The Rules ITP Enforces Today

WebKit keeps a current list of its shipping behavior on its Tracking Prevention in WebKit page. Here is what each rule means in practice.

Two terms in that table need a plain explanation. Link decoration means adding identifiers to a URL, like ?gclid=abc or ?fbclid=xyz, so the destination page can read them and store them. Classified means Safari’s classifier on that specific device has flagged the domain as having cross-site tracking capabilities.

7 days after what? Where the guides disagree

Many articles say ITP deletes JavaScript cookies “seven days after the last visit.” Others say cookies are simply “capped at seven days.” Both are partly right, and the difference matters when you debug.

WebKit’s ITP 2.1 announcement describes a cap on the expiry date: persistent cookies created through document.cookie get at most a seven-day expiry, and cookies that already had a shorter expiry keep it. Nothing refreshes that date by itself. What refreshes it is a script writing the cookie again. Google’s GA4 tag rewrites its _ga cookie on page loads by default, so in practice the cookie lives seven days from the last visit that ran the tag. A script that only sets its cookie once, on the first visit, gets seven days from that first visit, period.

The storage rule (LocalStorage and the rest) is worded differently: data goes after seven days of browser use without interaction with the site. Days when Safari is not used do not count toward that one.

How ITP Decides a Domain Is a Tracker

The blanket rules (no third-party cookies, the 7-day cap) apply to everyone. The harsher actions apply only to classified domains. Safari collects statistics as you browse and a machine learning model flags a domain when it matches known tracking patterns:

• Showing up everywhere as a third party. The model weighs how many different sites loaded the domain as a subresource, as an iframe, and how many it redirected through.
• Bounce tracking. A domain that sits in the middle of navigation redirects, even with a short delay on a landing page, gets counted.
• Tracker collusion. Once a domain is classified, every domain that redirected users to it is checked and classified too, recursively.

Because the classification lives on each device, there is no public list of classified domains. A domain can be classified on one iPhone and not on another. For planning, assume the major ad and social platforms are classified for most users.

A Short History of Safari ITP

ITP has also been studied from the other side. A 2020 paper by Google security researchers showed that early ITP state could itself leak browsing information, and Apple addressed several of those issues in Safari 13.0.4 and iOS 13.3. After ITP 2.3, Apple stopped numbering releases and ships tracking changes as part of regular Safari updates.

Beyond Cookies: Fingerprinting, Private Browsing and Advanced Protection

When cookies get harder to use, trackers fall back to fingerprinting: identifying a browser from its fonts, screen size, hardware and settings. Safari answers this by presenting a simplified configuration so more devices look the same, by exposing only system and web fonts, and by refusing to ship web APIs it considers too identifying (Battery Status, Web Bluetooth, Device Memory and others).

The most recent step is in WebKit Features in Safari 26.0. WebKit says Safari now stops known fingerprinting scripts from reliably reading device characteristics such as screen dimensions and canvas output, prevents them from setting long-lived cookies or LocalStorage, and blocks them from reading query parameters and document.referrer. If a vendor script you use is on Apple’s list, it may silently lose campaign parameters in Safari 26.

Private Browsing goes further than standard ITP. Since Safari 17 it blocks known trackers from loading at all and strips known tracking parameters such as gclid and fbclid from links. Users can also turn on Advanced Tracking and Fingerprinting Protection for all browsing in Safari’s advanced settings, which applies the same blocking everywhere. Plain UTM parameters are not what this feature targets; click identifiers that point to one person are. That makes clean UTM tagging more useful than ever for Safari traffic.

What ITP Breaks in Your Analytics, and What It Leaves Alone

Most guides stop at “attribution gets harder.” It helps to be precise, because some reports are untouched and you can keep trusting them.

The pattern: anything that needs to recognize the same browser across visits more than a week apart degrades. Anything measured within one visit holds up. This is why session-level reporting of conversions by landing page and channel, the core of SEO conversion tracking, survives ITP far better than user-level attribution does.

Worked Example: What Safari ITP Does to Organic Revenue

The numbers below are illustrative, chosen to show the arithmetic. Swap in your own.

In GA4, a direct return visit inherits the last non-direct source only if GA4 recognizes the same client ID. Here is how each group lands in the report:

• 25 first-visit buyers: credited to Organic Search. ITP has no effect.
• 20 buyers within 7 days: the _ga cookie is still alive, so GA4 credits the earlier organic visit.
• 15 buyers after 8+ days: the cookie has expired. GA4 sees a new user arriving direct, so the sale is credited to Direct.

The same 15 buyers also show up as 15 extra new users, so your new-user rate rises while organic revenue falls, even though nothing about your SEO changed. If those first visits had come from a classified domain with a decorated URL (a paid social click, for example), the cookie would have lasted 24 hours, and the 20 within-a-week buyers would have been at risk too.

The fix for reading this report is not to guess a correction factor. Judge organic search on conversions that happen in the visit that search sent, by landing page, and treat the Direct line as partly made of returning buyers whose first source you lost. Our guide to attribution windows covers how lookback settings interact with this.

Organic and AI Search Traffic Under ITP

Organic clicks from Google carry no click ID, so the 24-hour link decoration rule usually does not fire on them: the landing URL is clean and only the 7-day cap applies. Search engines also already send only their origin as the referrer, so ITP’s referrer downgrade changes little for SEO reporting.

AI assistant traffic is less predictable. Some assistants add UTM parameters to outbound links, which puts a query string on the landing URL. Under WebKit’s rule, a query string plus a referring domain classified on that device triggers the 24-hour cap. Whether any given assistant’s domain is classified depends on each user’s browsing, so you cannot know it in general. Plan for the shorter window: measure AI-driven conversions in the visit the assistant sent, as described in AI conversion tracking.

How to Check ITP’s Effect in Your Own Data

1. Read the cookie expiry in Safari

On a Mac, turn on the developer features in Safari’s Advanced settings, open your site, then open Web Inspector and go to the Storage tab. Under Cookies, check the Expires column for your analytics cookie (for GA4, _ga). If your tag asks for two years and Safari shows about seven days from now, ITP’s cap is in effect. Cookies your server set in the HTTP response will show their full expiry unless the cloaking rule applies.

2. Compare browsers in GA4

In GA4, build a free-form exploration with Browser as the row dimension and Total users, New users, Sessions and Key events as metrics. Calculate new users divided by total users for each browser. Then add Session default channel group and compare the share of key events credited to Direct.

• Safari with a clearly higher new-user share than Chrome on desktop or Android points to expired IDs.
• Safari with a higher Direct share of key events points to lost first sources.
• Use desktop or Android Chrome as the comparison. On iPhone and iPad, other browsers run on WebKit too and have received ITP protections since iOS 14, so Chrome on iOS is not a clean control.

3. Watch for the symptoms

Short conversion paths for Safari users, multi-session journeys that never exceed a week, and ad platform conversions that run lower for Safari than your backend orders suggest are all signs you are hitting ITP rather than a tracking bug. If Safari key events drop to zero overnight, look for a broken tag first: ITP shortens memory, it does not stop single-visit tracking.

What Actually Works Against ITP Data Loss

Every workaround below is legitimate measurement of your own visitors. None of them restore cross-site tracking, and WebKit has closed each trick that tried to.

For the server-side route, our server-side GTM guide walks through the setup. Note that WebKit’s page does not publish the exact rule it uses to decide when a server’s IP address counts as third party; tagging vendors report it compares the first half of the address. Treat that as something to verify with the Web Inspector check above, not a guarantee.

The other route is to stop depending on a long-lived ID for the questions that matter most. If the decision is “which pages and channels produce leads and sales,” you can answer it from the converting visit alone. That is the approach behind cookieless tracking. SEOConversion works this way: it is a cookieless, first-party tracker, so there is no visitor cookie for Safari to expire, and it reports conversions and their value from Google, Bing and AI assistants by landing page.

Safari ITP on iPhone: Settings and Common Questions

On iPhone, ITP is the Prevent Cross-Site Tracking switch in Settings > Apps > Safari (Settings > Safari on older iOS versions). It is on by default. Next to it you will find options to hide your IP address from trackers and, under Advanced, the tracking and fingerprinting protection setting.

• Turning it off lets third parties use cookies across sites again. Ads follow you more closely. People usually switch it off to fix an old embedded login or payment flow; turn it back on afterward.
• Does it protect you? Against cross-site tracking by websites, yes, and by default. It does not stop a site from logging what you do on that site, and it is not antivirus.
• Why so many trackers? The Privacy Report in Safari lists the trackers ITP prevented from profiling you. A long list means it is working on tracker-heavy sites.
• Is my Safari hacked? ITP and the Privacy Report do not detect compromise. Signs worth checking are unknown extensions, unfamiliar configuration profiles in Settings, and pop-ups that persist across sites. Remove what you do not recognize and update iOS.
• Can someone track my iPhone? ITP covers websites only. For people and apps with access to your location or accounts, use Safety Check in Privacy and Security settings.

Safari ITP vs Firefox ETP vs Chrome

Safari is the browser where your own first-party analytics data degrades fastest, which is why Safari share is the first thing to check when user counts and attribution look off.

FAQ