What Changed
WebKit announced the change with Safari 13.1, which shipped alongside iOS 13.4.1 Earlier versions of ITP only restricted cookies from domains classified as trackers. Now no site embedded in another site could read or set cookies at all, unless the user granted access through the Storage Access API, typically for a login.
The same release extended the seven-day cap from ITP 2.1 to all script-writable storage, including localStorage and IndexedDB, for sites the user had not interacted with in seven days of browsing.
Later that year, iOS 14 applied these protections to every browser on iPhone and to web views inside apps. Because all iPhone browsers have to use Apple's WebKit engine, choosing Chrome or Firefox on an iPhone did not bring third-party cookies back.2,3
Why It Mattered
Safari was the first mainstream browser to block third-party cookies outright, beating Google's announced plan for Chrome by years.1,4 WebKit argued that full blocking was simpler than ITP's classifier and closed a loophole: the classifier's decisions could themselves be used to fingerprint users.1
For advertisers, any third-party pixel on iPhone traffic stopped receiving cookies. Retargeting pools built from Safari visitors shrank, cross-site frequency capping stopped working, and attribution tools that relied on third-party cookies lost iPhone users entirely.
Moving localStorage under the seven-day cap also closed a popular workaround, since some tags had started storing identifiers there to avoid the cookie limits.
Blocking cookies also left Safari needing a way to tell advertisers which clicks led to sales. WebKit's answer was Private Click Measurement, which arrived in Safari with iOS 14.5 in 2021. It measures clicks only, not views, allows just 256 campaign IDs per site and 16 conversion values, and sends each report at a random time 24 to 48 hours after the conversion, so reports can't be tied back to an individual visit.5 Apple later made it the basis of the web half of AdAttributionKit.
Notes
- John Wilander, “Full Third-Party Cookie Blocking and More,” WebKit Blog, March 24, 2020, https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/. abc
- Kate Cheney, “App-Bound Domains,” WebKit, June 26, 2020, https://webkit.org/blog/10882/app-bound-domains/. ↩
- “App Review Guidelines,” Apple Developer, accessed October 17, 2026, https://developer.apple.com/app-store/review/guidelines/. Guideline 2.5.6; browsers in the EU and Japan may apply to use another engine. ↩
- John Gruber, “Safari Now Has Full Third-Party Cookie Blocking,” Daring Fireball, March 25, 2020, https://daringfireball.net/linked/2020/03/25/safari-third-party-cookies. ↩
- John Wilander, “Introducing Private Click Measurement, PCM,” WebKit, February 1, 2021, https://webkit.org/blog/11529/introducing-private-click-measurement-pcm/. ↩