How long do affiliate cookies last? Safari, ITP and consent

How long do affiliate cookies last – and does the 30-day cookie duration a program promises affiliates also hold on an iPhone? The answer depends on two things that are often mixed up: the program's cookie window and the cookie's lifetime in the browser.

This guide separates the window from the lifetime. You get a dated overview of the browsers as of November 2026, nine situations that decide who gets the sale, and the setups that last the whole period on each platform. It is written for store owners and their developers who are choosing a network or an integration, and for affiliates who wonder whether they lose commission in Safari – their advice is in the section on how to lose the least commission. If you are new to the subject, start with our guide to affiliate marketing.

The cookie window, also called the cookie duration or attribution window, is a rule: how long after a click a purchase still earns commission. The store chooses it per program – at Affilyflow 14, 30, 45, 60 or 90 days, and we recommend 30. The window is locked on the click and decided on our server from the click's own timestamp, so the browser can neither extend nor shorten it.

The cookie lifetime is something else entirely: how long the click ID is actually stored in the customer's browser. That depends on the browser – and on who set the cookie. Our script stores the click for up to 90 days from the click, but the browser can delete it sooner. A purchase only earns commission when both hold, and the shorter of the two decides: a program with a 30-day window gives 30 days in Chrome, Edge, Firefox and on Android, but about a week after the last visit in Safari, if only a script stored the click.

The matrix shows how long a click survives with each tracking method, as of November 2026. It is built on the browsers' own documentation, and how we lock the click and the window on the server is described on affiliate tracking. What we have not been able to verify is in the sections on iPhone browsers and in-app browsers below – not in the table.

Sources, read in November 2026: WebKit, Mozilla, Google Privacy Sandbox and Stape – the full list is at the end. A customer can always delete cookies themselves; the table shows what the browser does on its own.

Where in the click's journey the browser decides

This is how the click travels from the affiliate's link to a recorded sale. The full technical version is in How tracking works.

1. 01

   The click is recorded

   The affiliate's link goes through Affilyflow. The click is recorded here, and the commission and the cookie window are locked on it with our server's timestamp.

2. 02

   The customer lands with a click ID

   The store opens with ?afid=c_… in the address. The click ID is in the URL, but it is not yet stored in the customer's browser.

3. 03

   The store's tracking stores the click

   A script, the Shopify pixel, the WooCommerce plugin or the store's own server stores the click ID on the store's domain. This is where the browser decides how long it lives.

4. 04

   The purchase is reported – and the server decides

   The order is reported with the click ID, and our server checks the click's age against the window that was locked at the click. A new visit never extends the window.

Safari ITP and affiliate tracking: 7 days – and sometimes 24 hours

Safari's tracking protection is called Intelligent Tracking Prevention (ITP) and is part of WebKit, the engine behind Safari on Mac, iPhone and iPad. Apple has tightened it several times. In 2019, cookies set by a script were capped at 7 days. In March 2020 (Safari 13.1 and iOS 13.4), third-party cookies were blocked completely, and all storage a script can write – localStorage included – is now deleted after 7 days of Safari use without interaction with the site.

Interaction means a click, a tap or a keystroke on the site. Scrolling does not count. Our script writes the cookie again on every visit, so it lasts 7 days from the customer's last visit – but never beyond 90 days from the click, and the renewal never extends the window. The storage, on the other hand, is deleted after 7 days of Safari use without a click or tap on the site. If the customer does not come back within a week, a click that only a script stored is gone.

The 24 hours come from a stricter rule from 2019 (ITP 2.2). If the customer arrives from a domain Safari has classified as a tracking domain, and the landing URL has parameters such as ?afid=, cookies that a script sets on that very page are capped at one day. Among other things, Safari classifies domains that redirect to many different sites – which is exactly what an affiliate link does, ours included. Nobody can tell from the outside whether that has happened on a particular iPhone. That is why our script stores the click both as a cookie and in browser storage, and restores the cookie from storage on the next visit – but the storage does not last more than about 7 days either.

Chrome, Firefox and Edge on iPhone are not the same as Safari, and we have not verified which of Safari's rules they follow. The matrix applies to Safari.

Chrome, Edge, Firefox and Android

Here a first-party cookie on the store's domain lasts the whole window. In its update of 17 October 2025, Google retired most of its Privacy Sandbox technologies, and Chrome leaves third-party cookies to the user's own choice. Firefox's default protection, Total Cookie Protection, partitions third-party cookies per site. Neither affects a click stored as a first-party cookie at the store – and at Affilyflow, attribution never relies on a third-party cookie. Here the click is only lost because of the customer: cleared cookies, a private window or a purchase in another browser.

Private browsing and in-app browsers in Instagram and TikTok

A private window forgets everything when it is closed – in every browser. From version 17, Safari's Private Browsing goes further with Link Tracking Protection: known click IDs are stripped from the URL before the page opens, and scripts from another domain get the URL without parameters. A tracking script loaded from the network's domain therefore cannot count on seeing the click ID in a private tab. The store's own server sees the URL as it was requested. The same rules apply in normal tabs for people who have turned on Advanced Tracking and Fingerprinting Protection for all browsing.

Instagram and TikTok open links in their own browser inside the app. Clicks from there count as clicks with us, and if the customer buys in the same session in the app's browser, the sale is normally recorded as usual – we have not verified that in every app. But the app's browser generally has its own storage, separate from the phone's Safari or Chrome, so if the customer later opens the store in their regular browser, that browser has no record of the click. We have not tested how long storage lasts inside the app itself either. The safest backup is a personal discount code that the creator can say out loud or write in the post – see also our guide to making money on TikTok and Instagram.

A common idea is to give tracking a subdomain such as track.yourstore.com that points to the network's server with a CNAME or A record. The server then sets the cookie in a response from the store's own domain, so the cookie looks like a first-party cookie that Safari would let live. Safari has closed both routes.

Since Safari 14 and iOS 14 (2020), Safari detects a subdomain whose CNAME points to a third party and caps all cookies from its responses at 7 days. A similar rule for IP addresses came later: if the subdomain's IP address does not resemble the main site's, the cookie is capped at 7 days too. According to Stape, which cites WebKit's source code, the first 16 bits of an IPv4 address or the first 64 bits of an IPv6 address must match. A subdomain that points to a third party therefore gives the same 7 days as a script.

What works is the store's own server or CDN setting the cookie: the WooCommerce plugin or the server snippets for a custom-built store. A path on your own host, such as /af/, that is forwarded to us makes it harder for ad blockers to stop tracking – and according to WebKit's description, a script from your own domain is not covered by the Private Browsing rule about URLs without parameters.

Cookieless affiliate tracking sounds like the answer to both Safari and consent. In practice, the term covers four very different things, and they do not solve the same problem.

S2S tracking: what server-to-server solves – and what it does not

The key point: a sale can be reported server to server, but the click still has to be remembered somewhere between landing and buying – in a cookie, on the customer's account or on the order. Server-to-server tracking (S2S tracking, also called postback or server-side tracking) solves how the sale gets through to the network – not how long the click survives, and not the question of consent to store it. That is why we do not call Affilyflow cookieless: attribution is built on a click ID and a first-party cookie. The glossary entry on cookieless tracking goes through the term.

Any solution where the store's own server stores the click and reports the sale. The vendor's name matters less than the answers to four questions:

1. Does the store's own server set the cookie – from the store's own domain, and not from a subdomain that points to the vendor?
2. Is the sale reported server to server, so an ad blocker or a closed tab does not stop it?
3. Can a personal discount code earn commission when there is no click to link the sale to?
4. Can you see how many affiliate clicks arrive, get stored and turn into a sale?

At Affilyflow the answer is yes to all four for WooCommerce and for custom-built stores using the server snippets. Personal discount codes can be used on most of our platforms – on many only when the order confirmation or GA4 sends the code along – but not yet in the Shopify app.

If the store has chosen "Wait for consent" and the customer says no, the click is never stored – and then only a personal discount code can earn commission.

What happens depends on the store's setup. The store owns the site and the cookie banner and chooses whether tracking should wait for consent. With "Wait for consent", the script stores nothing in the browser until the customer has accepted marketing. The click ID is only held in the page's memory, so if the customer says no, a later purchase earns the affiliate no commission.

An active no also deletes what has already been stored, including the click cookies the store's server has set. Without that setting the script behaves as it always has, and consent is handled by the store's own cookie solution.

The script reads consent itself from these solutions:

• Cookiebot and Cookie Information
• IAB TCF v2
• Google Consent Mode v2
• The built-in banners of Shoporama, DanDomain Classic and Smartweb/HostedShop, three Danish e-commerce platforms

If the store uses another solution, the developer has to tell the script. From version 1.12.0, the WooCommerce plugin follows banners that support the WP Consent API, and the Shopify pixel does not ask on its own – the store's own cookie solution takes care of that. The details are in Consent and cookies.

The only route to commission that needs no storage in the browser is a personal discount code: a code the store ties to one specific affiliate. The customer types it in, so it also works when the customer has declined marketing cookies. With the tracking script and the WooCommerce plugin, an order without a click is only reported to us when the customer used a personal code – they compare the code with hashes of your personal codes before anything is sent.

Whether an affiliate cookie requires consent is a legal question, and this is not legal advice. Two sources are worth knowing. The European Data Protection Board (EDPB) names affiliate marketing in Guidelines 2/2023 on Article 5(3) of the ePrivacy Directive (version 2.0, October 2024, section 3.1) and counts tracking links too, not just cookies. In Denmark, the joint cookie guidance from the Danish Data Protection Agency (Datatilsynet) and the Danish Agency for Digital Government (15 May 2025) describes that only what is technically necessary to provide a service the user has asked for – such as login and the shopping cart – is exempt from the consent requirement (section 4(2) of the Danish cookie order). Outside the EU and EEA the rules differ – the UK, for example, has its own in PECR. Ask your own advisor.

Affilyflow uses a single model: the sale belongs to the click ID the order carries – last click wins, and commission is never split between affiliates. The rate is locked the moment the customer clicks. This is how it plays out in the situations stores and affiliates ask about most:

The WooCommerce row, where another network's click came last, is a deliberate rule. From version 1.10.0, the WooCommerce plugin has "Last click wins" switched on by default: if the customer lands via another network's link after our click, the plugin forgets our click, so you do not pay us for a sale where another network had the most recent click. If the other networks' pixels should follow the same rule, you can make them conditional on the winner – see the WooCommerce guide. A code gives the program's current rate because there is no click to lock the rate on.

You cannot choose the customer's browser, but you can do three things. Ask the store for a personal discount code and share it alongside your link – it earns commission without a click, also when the customer has declined cookies or buys on another device. Link directly to the product you recommend, so the path from click to purchase is short. And ask the store how it tracks: if it saves the click from its own server, you get the whole window – Safari included.

Whatever the browser, the rate and the window are locked on our server when the customer clicks. A click that lasts until the purchase earns the rate the program showed at the click – even if the store changes its rate afterwards.

The most robust route depends on where you sell. The table shows what lasts the whole period in Safari on each platform, and what catches the rest:

Once tracking is running, "Tracking coverage" under Setup shows, for the last 30 days, how many affiliate clicks reached tracking, were stored and turned into a sale. It is the closest you get to seeing what Safari and the cookie banner cost you.

Choose the window from your customers' buying journey, not from Safari. At Affilyflow a program can have 14, 30, 45, 60 or 90 days, and we recommend 30. In Chrome, Edge, Firefox and on Android – and in Safari too, with a cookie from your own server – the window holds in full, and it is the number affiliates see and compare before they choose your program.

A short window makes the program less attractive: if you choose 14 days, the program editor warns that affiliates tend to pass over programs with short windows. A long window, on the other hand, means you pay for purchases that happen long after the click. If your customers have a long buying journey – expensive products, furniture, travel – 45, 60 or 90 days can make sense. If they buy on impulse, 30 days is plenty.

The window is locked on each click. If you extend it later, it only applies to new clicks; existing clicks keep their original window. The rules are collected on the program terms page.

So the honest answer to how long affiliate cookies last is: as long as the window says, if the browser lets them live. If you want the whole period – Safari included – the click has to be stored by your own server. See how price and terms fit together when you start an affiliate program.

Sources, read in November 2026: WebKit (Tracking Prevention in WebKit and the blog posts on ITP 2.2, Full Third-Party Cookie Blocking and More from March 2020, CNAME Cloaking and Bounce Tracking Defense from November 2020, and Private Browsing 2.0); Mozilla (the overview of Firefox's tracking protection); Google (the Privacy Sandbox update of 17 October 2025); Stape on the IP rule for subdomains, citing WebKit's source code; EDPB, Guidelines 2/2023, version 2.0; Datatilsynet and the Danish Agency for Digital Government, the joint cookie guidance (15 May 2025).

Written by

Loui Wagner

Co-founder, product and technology

Builds Affilyflow – the affiliate network from Denmark where businesses and affiliates can see exactly what their partnership delivers.

Found a number that no longer holds? Write to us – we will correct the article.