Book a call

What is Intelligent Tracking Prevention (ITP)?

Analytics & measurement

By Wiesław Tkacz, Data Analyst and StrategistUpdated 3 November 2026

What does ITP actually limit?

A cookie is a small file a website stores in your browser. It lets the site recognise you later. A third-party cookie is one set by a domain other than the site you are visiting. Ad and analytics tools often use them to follow people between sites.

Safari blocks third-party cookies by default, according to WebKit1.

Do Safari's ITP cookies expire after 7 days?

Some do. WebKit's tracking prevention page says ITP deletes cookies created in JavaScript, and other storage that scripts can write, after seven days without user interaction with the website1. A visitor who comes back after a longer gap can then look new.

What is CNAME cloaking, and how does ITP treat it?

CNAME cloaking is a setup in which a subdomain of your own site actually points to a tracking company's server, so the tracker looks like part of your site. WebKit's November 2020 post, written for Safari 14, says ITP caps the expiry of cookies set in third-party CNAME-cloaked HTTP responses at seven days2. WebKit's current tracking prevention page still lists detection of third-party CNAME cloaking1.

Why does it matter for ecommerce?

When a cookie expires or is blocked, your tools no longer recognise the browser. A returning visitor looks new. A purchase can lose its link to the ad click that came before it. If Safari is a large part of your traffic, this can shape which channels look good in your reports.

That is why ITP belongs in any ecommerce tracking audit: it is one of the checks that can change a budget decision.

Our view: treat Safari as its own test case. A setup that looks fine in one browser can behave differently in another.

Easily confused with

  • Intelligent Tracking Prevention vs Server-side tracking

    Collecting data on a server the company controls and passing it on to analytics and ad platforms, instead of running every tag in the visitor's browser. It changes where data is collected. It does not exempt you from browser rules, and how a server-side setup is hosted matters, because WebKit singles out cookies set through CNAME cloaking2.

  • Intelligent Tracking Prevention vs Privacy Sandbox

    Google's initiative to build alternatives to third-party cookies in Chrome. Different browser, different programme.

  • Intelligent Tracking Prevention vs First-party data

    Data a brand collects directly from its own interactions with customers, such as orders, accounts and email sign-ups. It is about who collects the data. ITP is about how a browser treats cookies.

FAQ

A rider in a red cape and bicorne hat on a rearing yellow plush horse, after David's Napoleon Crossing the Alps

Does ITP only affect Safari?

ITP is part of WebKit, the engine behind Safari, and WebKit's page covers Apple platforms only1. Other browsers have their own rules, so test each browser that matters to your traffic.

Does server-side tracking get around ITP?

Not automatically. How the setup is hosted matters: WebKit caps cookies set through third-party CNAME cloaking2. Test it in Safari instead of assuming.

Where can I read the current rules?

On WebKit's tracking prevention page1. Rules change, so read the source rather than a summary, including this one.

Sources

  1. Tracking Prevention in WebKitPrimary source
  2. CNAME Cloaking and Bounce Tracking Defense (WebKit blog)Primary source

Let’s find what’s actually working.

Next step. Lost tracking data changes your ROAS, so start from your own numbers. Use the Is your ROAS real? calculator.

Is your ROAS real? calculator