Apple shipped Intelligent Tracking Prevention (ITP) on June 5, 2017, and it is still the reason a Safari visitor who clicked an ad last week can look like a stranger today. ITP is the anti-tracking system inside WebKit, the engine behind Safari on iPhone, iPad, Mac and Vision Pro. It classifies domains that behave like trackers, then deletes, isolates or shortens the data they store.
How the on-device classifier works
ITP does not use a fixed blocklist. A machine-learning model on the device scores a domain against three signals: how many unique first-party sites load it as a third-party subresource, how many load it as a third-party iframe, and how many cross-site redirects it performs. Bounce tracking and tracker collusion also trigger classification. If a person has not interacted with the domain directly as a first party in the last 30 days of browser use, WebKit deletes all its website data. That clock counts days of actual Safari use, not calendar days.
The caps that break attribution
- Third-party cookies are blocked outright, with no exceptions. A widget can request access through the Storage Access API only after a user gesture.
- Script-written storage gets seven days. Cookies set with document.cookie, localStorage, IndexedDB, SessionStorage and Service Worker caches are deleted after seven days of Safari use without a return visit.
- Link decoration gets 24 hours. If a classified domain sends a visitor to a landing page with a click ID in the URL, JavaScript cookies on that page survive 24 hours rather than the 90 days the tag may request.
- CNAME and IP cloaking get seven days. Server-set cookies from a subdomain that resolves to a third-party server, or to an IP far from the main site, are capped at seven days.
A social ad click shows how this compounds. The social network’s domain is classified, so the landing page’s click-ID cookie lives for 24 hours. If the purchase happens on day three, the browser-side tag sees a new visitor. Direct visits every few days reset the seven-day clock.
Where ITP sits in the ad transaction
ITP acts inside the browser before a bid request is formed, so a supply-side platform cannot attach a cookie-based user ID. Cookie syncing, frequency capping, retargeting and cross-site attribution stall. On the sell side, Permutive’s unaudited vendor data puts the CPM penalty for impressions without an identity signal at 41% lower. Buyers have shifted toward server-to-server conversion APIs that bypass the browser.
Why the industry went server-side
Server-set cookies on first-party domains escaped the seven-day limit for years, which made server-side tagging attractive. Google launched a first-party mode beta for its tags on October 9, 2024. The CNAME and IP caps specifically target those set-ups when a third party operates the server. Safari 26, released in September 2025, made Advanced Fingerprinting Protection the default for all browsing, cutting scripts classified as fingerprinters off from high-entropy APIs, long-lived storage and query parameters.
The 2026 escalation
WebKit merged an unconditional domain-blocking hook in February 2026, and iOS 27 began rolling out on September 14, 2026. The Trade Desk filed a WebKit bug on September 21 listing blocked domains including adsrvr.org and id5-sync.com. On October 19, WebKit published its rationale: it blocks third parties that turn email addresses into tracking IDs. “For the majority of users, their email address serves as a globally unique ID that they keep for years, even decades,” the post said. ID5 chief executive Mathieu Roche called the move “an attack against the business model of the web.” The IAB Tech Lab has pushed its Trusted Server edge runtime in response.
The dispute cuts deeper. ITP shifts power to platforms with logged-in users such as Google, Meta and Amazon because they keep identity through direct visits, while open-web identity weakens. Tracking prevention has also leaked information in the past, and Apple’s 2026 blocklists are not public.
What to do now
Treat Safari as cookieless by default. Audit attribution windows that rely on 30- or 90-day browser cookies; Safari resets them far sooner for most visitors. Move conversion capture to server-side APIs or first-party data collection with clear consent, and test campaigns against Safari-specific cohorts rather than blended reports. The bigger strategic point: when browser identity weakens, first-party relationships and logged-in experiences become the moat.
Source: PPC Land
