Become an affiliateStart your program

Technology and tracking

ITP (Intelligent Tracking Prevention)

Also called Intelligent Tracking Prevention, Safari ITP, WebKit tracking prevention, tracking prevention.

Short answer

ITP (Intelligent Tracking Prevention) is Safari’s built-in tracking protection, launched in 2017. It blocks third-party cookies entirely and limits script-set first-party cookies to 7 days – down to 24 hours when the link carries known tracking parameters. ITP changed the ground rules for affiliate tracking.

Definition of ITP (Intelligent Tracking Prevention).

ITP is a feature of WebKit, the engine behind Safari on Mac, iPhone and iPad. Apple launched it with Safari 11 in 2017 and has tightened it continuously: since March 2020 third-party cookies have been blocked completely, and first-party cookies set with JavaScript expire after at most 7 days. If the link carries parameters that ITP recognises as cross-site tracking, the cookie lifetime is cut to 24 hours.

For affiliate tracking, the consequence of ITP is concrete. Classic tracking set a third-party cookie from the network’s domain at the moment of the click – in Safari that cookie effectively no longer exists. Move tracking to a script-set first-party cookie on the store and it lives for 7 days at most. A 30-day attribution window therefore cannot be carried by a browser cookie alone for Safari users: the cookie dies long before the window closes.

The industry’s answer has been to shift the weight away from the browser. The click is recorded on a server, the click ID is passed on in the URL, and the conversion is reported back with the ID – either from the store’s own system or server-to-server. In that architecture the cookie is reduced to a means of transport between pages, while the attribution itself is decided by data that lies outside the browser’s reach.

What ITP means for the cookie window

A program can promise an attribution window of 30, 45 or 90 days, but the promise only holds if the window is decided somewhere ITP cannot reach. If the window lives in a script-set cookie, in Safari it is effectively a 7-day window, whatever the program says. If, on the other hand, the window is decided on the server based on the time of the click, the cookie’s lifetime does not affect the deadline itself.

So do not just ask how long the window is, but where it lives. Concretely: is the click recorded server-side, is the ID carried on in the URL, and is expiry calculated from the click time in the database – or does the whole chain depend on a cookie surviving in the user’s browser until the day of purchase?

ITP vs. cookie consent

AspectITPCookie consent
Who decidesthe browser – Apple enforces it technicallythe user – the law requires a choice
Basisa WebKit feature, no legal basisGDPR and the ePrivacy rules
Effectcookies are blocked or expire earlycookies may not be set without acceptance

ITP is technology that limits what is possible; consent is law that decides what is allowed. Tracking has to survive both – in the order the user meets them.

How it goes wrong

  • 01

    The window is promised but lives in the browser

    A 30-day attribution window in the program terms is fiction for Safari users if it depends on a script-set cookie with a 7-day lifetime. The window has to be decided server-side to hold.

  • 02

    Testing only in Chrome

    Tracking that works in a Chrome test can fail silently for iPhone users. Test the whole chain in Safari – including private browsing – before a program goes live.

  • 03

    Every loss blamed on ITP

    Missing conversions can just as well be caused by declined consent, an ad blocker or a tracking script that is down. Debug the chain before drawing conclusions.

At Affilyflow

ITP (Intelligent Tracking Prevention) in practice

Affilyflow is built for the conditions after ITP: the attribution window is locked the moment the click happens, and expiry is decided on our server based on the time of the click – not by a cookie’s lifetime in the browser. We do not try to recognise users with fingerprinting; that is a deliberate choice, not a shortcoming. And because the chain can still break on the store’s side, we monitor ourselves whether the store’s tracking script is down, and say so.

Frequently asked questions

What exactly does ITP do in Safari?

ITP blocks all third-party cookies and limits the lifetime of first-party cookies set with JavaScript to at most 7 days. If the user arrives via a link with parameters that ITP associates with cross-site tracking, the lifetime is cut to 24 hours. The rules are enforced automatically by the browser, without the user having to choose anything.

Is ITP the same as rejecting cookies in a cookie banner?

No. ITP is a technical limitation the browser enforces regardless of the user’s choice, while the cookie banner is about legal consent under GDPR and the ePrivacy rules. A user can accept all cookies in the banner and still have them limited by ITP.

Does affiliate tracking work in Safari after ITP?

Yes, if the architecture does not depend on long-lived cookies. If the click is recorded on a server, the click ID travels in the URL and the attribution window is decided server-side, conversions can still be matched correctly. Setups that store the entire attribution in a browser cookie, by contrast, lose tracking after a few days.

Which browsers have ITP?

ITP exists in Safari on Mac, iPhone and iPad, because it is part of WebKit. Other browsers have related mechanisms under their own names – Firefox calls its version Enhanced Tracking Protection – but the 7-day and 24-hour rules are Safari’s.

Read on