Intelligent Tracking Prevention (ITP) is a set of privacy features in Apple’s Safari browser, built into WebKit, the engine behind it, that blocks third-party cookies and shortens the life of many first-party cookies used for tracking. It is one of the main reasons analytics tools and ad platforms under-count returning visitors and conversions from iPhone, iPad and Mac users.
How ITP works
Apple has tightened ITP in stages since 2017. At the time of writing (October 2026), its main effects are these:
- Third-party cookies, set by a domain other than the site being visited, are blocked completely.
- First-party cookies created by JavaScript in the browser, which is how the _ga cookie and the Meta pixel’s cookies are usually set, expire after no more than seven days. If the visitor arrived from a domain Safari classifies as a tracker, through a link carrying extra information in the URL, the limit drops to 24 hours.
- Cookies set by a server can also be capped at seven days when the server answering looks like a third-party service rather than part of the website’s own setup, which targets tracking disguised behind a company subdomain.
- Other storage a script can write to, such as local storage, can be cleared after seven days of Safari use without the visitor interacting with the site.
- In Private Browsing, Safari strips some known click identifiers from links.
Other browsers have their own versions. Firefox calls its protection Enhanced Tracking Protection (ETP), and Brave blocks more still. Chrome’s plans for third-party cookies have changed several times, so check its current position rather than relying on older announcements.
Why it matters
Apple devices are widely used in the UK, so a substantial share of most sites’ visitors browse with ITP. When a cookie expires after seven days, someone who visits on a Monday and returns the following Tuesday looks like a new user. A purchase made more than a day after an ad click may not be connected to that click in your own analytics. The result is fewer returning users, more traffic labelled direct, shorter apparent customer journeys and under-reported ad performance. Businesses where customers take time to decide, such as solicitors, private clinics or home improvement firms, feel this most.
Ad platforms partly compensate with modelling and with conversion data you send them directly, which is why features such as enhanced conversions in Google Ads and Meta’s Conversions API now matter. Even so, the figures you look at are partly estimates, and comparing Safari with Chrome in GA4 often shows the gap clearly.
Common mistakes
- Reading a fall in returning visitors or a rise in direct traffic as a real change in customer behaviour, when it mostly reflects cookie expiry.
- Judging campaigns with long decision cycles on browser-based attribution alone.
- Trying to get round ITP with fingerprinting or trackers hidden behind a subdomain. Apple targets these methods specifically, and in the UK they still need consent under PECR.
- Assuming server-side tracking removes the need for a cookie banner. It changes where data is processed, not whether consent is required.
How to act on it
Measure the effect on your own site before changing anything. In GA4, compare returning-user rates and conversion rates by browser. A large gap between Safari and Chrome visitors, on otherwise similar traffic, is a sign that ITP is shaping your numbers.
Then strengthen the data you control. Send conversions from your server or CRM where you can, using enhanced conversions for Google Ads and the Conversions API for Meta, with the visitor’s consent choices respected. A server-side tracking setup running on your own subdomain and infrastructure can set cookies the browser treats as genuinely first-party, although Apple’s rules about server addresses mean it has to be done properly to make any difference.
Finally, judge marketing over longer windows using sales and enquiry data from your own systems, not only browser-based reports. That combination is how I set up measurement as part of my performance marketing service.