ITP 2.1 Caps JavaScript Cookies at Seven Days

What Changed

In February 2019 WebKit announced ITP 2.1, which shipped in iOS 12.2.¹ Until then ITP had targeted third-party cookies. ITP 2.1 went after a workaround: first-party cookies written by JavaScript.

Cookies created through the browser's document.cookie API, the method most analytics and advertising tags use, now expired after seven days, however long the tag asked to keep them. Cookies set by the website's own server in an HTTP response were not affected.

Two months later, ITP 2.2 went further for one common pattern. When a visitor arrived from a domain Safari classified as a tracker, with a click ID or other identifier added to the link, script-set cookies on the landing site expired after one day. In September 2019, ITP 2.3 closed the next workaround, trackers storing identifiers in localStorage instead: after the same kind of visit, the landing site's other script-writable data was deleted after seven days without interaction.²

Why It Mattered

Analytics tools store a visitor ID in a first-party cookie set by JavaScript. With a seven-day cap, a Safari visitor who came back on day eight looked like a new visitor. New-user counts rose, returning-visitor counts and lifetime metrics fell, and any conversion more than a week after the click lost its link to the original visit.³

Ad platforms that had moved their click tracking into first-party cookies to get around ITP 1.0 were caught by the same cap. Many advertisers responded by setting cookies from their own servers instead. One version of that, CNAME cloaking, points a subdomain of the advertiser's site, such as a "metrics" subdomain, at a tracking company's servers, so the tracker's cookies look first-party; WebKit said trackers had persuaded site owners to set it up precisely to get around tracking prevention. In November 2020, Safari 14 capped cookies set that way at seven days too.⁴

ITP 2.1 showed that "first-party" was no longer a safe harbour. What mattered to Safari was who set the cookie and for what purpose.

Safari's Cookie Limits at a Glance

For reference, every limit described on this timeline, from ITP 1.0 on:

• Third-party cookies: blocked by default since 2020, with iOS 13.4.
• First-party cookies set by JavaScript: expire after 7 days (ITP 2.1, 2019).
• Script-set cookies after a click from a classified tracker with a link identifier: expire after 1 day (ITP 2.2, 2019).
• localStorage and other script-writable storage: deleted after 7 days without interaction (ITP 2.3 for some traffic, 2019; all sites from 2020).
• Cookies set through a CNAME pointing to a third party: expire after 7 days (2020).