Intelligent Tracking Prevention (ITP)

Intelligent Tracking Prevention is the anti-tracking system built into Safari and the underlying WebKit engine. Introduced in 2017 and tightened repeatedly since, it blocks third-party cookies outright and, more surprisingly, limits first-party cookies set by JavaScript to about seven days, and to 24 hours in some cases involving decorated links.

For affiliate marketing, ITP quietly rewrote the rules. Programs historically promised 30, 60, or 90 day cookie windows, but for Safari visitors a script-set cookie effectively lasts a week at most. Since many affiliate audiences skew heavily toward iPhones and Macs, the gap between the promised window and the real one is not a rounding error.

How it works in B2B SaaS

The typical breakage looks like this: a visitor clicks an affiliate link in Safari, the landing page's JavaScript sets a first-party cookie holding the click ID, and the visitor leaves to think it over. If they return to start a trial on day 10, the cookie is already gone and the signup looks organic.

ITP also targets workarounds. Cookies set through CNAME-cloaked tracking subdomains get capped as well, and script-writable storage like localStorage faces similar limits. The durable responses are structural:

• Set cookies server side through a true first-party HTTP response.
• Persist the click ID in your own database at first touch.
• Capture the identifier into the signup flow as early as possible, rather than waiting for the purchase.

A worked example

Suppose a SaaS company gets 1,000 affiliate clicks a month and 30% come from Safari. The product sells at $100 per month with a 25% recurring commission, and the typical click-to-trial delay is around 10 days.

With purely client-side tracking, most of those 300 Safari clicks lose their cookie before day 10. If the program's click-to-trial rate is 4%, about 12 Safari trials should exist, but suppose half convert after the cookie has expired: roughly 6 trials a month are never attributed.

If 30% of trials become customers, that is about 2 lost paying customers monthly, or $50 per month in commissions that affiliates earned but never see, compounding every month. After a server-side tracking upgrade, the same traffic attributes normally, and nothing about the affiliates' behavior changed.

Typical ranges and benchmarks

The concrete limits are documented browser behavior and safe to plan around:

• Safari blocks third-party cookies entirely.
• JavaScript-set first-party cookies are capped at seven days.
• A 24 hour cap applies in certain link decoration scenarios.

Cookies set properly server side, in a genuine first-party context, are not subject to the seven day script cap.

Safari's share of B2B traffic varies by audience, but it commonly represents a meaningful minority of visits, often larger for creator and consumer-adjacent audiences. Check your own analytics rather than assuming; the same program can have 10% Safari traffic in one niche and three times that in another.

ITP vs third-party cookie blocking

Most people file ITP under third-party cookie blocking, and that undersells it. Blocking third-party cookies kills the classic cross-site tracking pixel. ITP goes a step further and constrains first-party cookies too, when they are set by script, which is exactly how most affiliate tracking snippets work.

This is the part that catches programs off guard. Your tracking runs on your own domain, sets a cookie in a first-party context, and still expires in seven days for Safari users. Other browsers ship their own protections, such as Firefox's Enhanced Tracking Protection, but the aggressive first-party cookie capping is the distinctly ITP behavior to plan for.

How it shows up in affiliate and partner programs

ITP is a main reason the industry moved toward server-side tracking, postback URLs, and first-party tracking domains. It is also why honest programs stopped promising 90 day windows without qualification: the real window on Safari is a week unless the infrastructure is right.

It shapes partner economics too. Creators with iPhone-heavy audiences are systematically undercounted on client-side setups, and coupon codes have grown in importance precisely because a code in someone's memory outlives any cookie.

Common mistakes

The classic mistake is advertising a long cookie window while running JavaScript-set cookies, which makes the terms untrue for a chunk of traffic. Testing tracking only in Chrome is a close cousin: everything looks fine in the browser your team uses, while Safari conversions quietly vanish.

Teams also over-trust CNAME cloaking as a fix even though ITP caps those cookies too, and confuse ITP with consent banners. ITP is browser behavior that applies regardless of consent; a user can enthusiastically accept your cookies and Safari will still expire them.

Frequently asked questions

Questions that come up whenever Safari traffic and attribution collide.

Does ITP affect server-side tracking?

Far less. Cookies set via a proper first-party HTTP response are not subject to the seven day script cap, and conversions reported server to server through postbacks do not depend on a browser cookie surviving at all. That is why server-side infrastructure has become the standard answer to ITP.

What cookie duration can I honestly promise affiliates?

Promise the window your infrastructure actually delivers. With client-side cookies only, the truthful answer for Safari users is up to seven days, whatever your terms say. With server-set cookies and server-side click storage, a 30 to 90 day window is realistic across browsers.

Is ITP only a Safari problem?

ITP itself is Safari and WebKit, which also covers most iPhone browsing, since iOS browsers have historically been required to use WebKit under the hood. Firefox and Brave ship their own tracking protections with different rules, and Chrome has kept third-party cookies available subject to user choice. Design for the strictest browser and the rest follows.