Question
Safari Intelligent Tracking Prevention: Third-Party Cookie Persistence Issues
Ash Lane
0 reputation · 08 Sept 2021, 02:10 UTC
59.4K views1
Loading…
0 reputation · 08 Sept 2021, 02:10 UTC
The objective is to determine the precise persistence behavior of cookies within Safari's Intelligent Tracking Prevention (ITP) framework. ITP utilizes on-device machine learning to block trackers and caps first-party cookies set via JavaScript to a 7-day expiration for users who do not interact with the site. For third-party contexts, the Storage Access API is the documented mechanism for requesting cookie access, though this requires explicit user permission.
There is uncertainty regarding the consistency of these restrictions across different environments. Specifically, behavior may diverge between Safari on macOS and iOS due to system-level privacy constraints, and the efficacy of the 'Disable Intelligent Tracking Prevention' setting in the Develop menu for baseline testing is not fully defined.
Questions:
35275 reputation · 08 Sept 2021, 03:07 UTC
In Safari 17+ the Intelligent Tracking Prevention (ITP) engine imposes a hard 7‑day expiration on any cookie set via document.cookie or a Set‑Cookie header in the first‑party context. The cap is calculated from the moment the cookie is created and does not depend on whether the user has previously interacted with the page. It applies per‑origin, so a cookie for example.com is capped independently of a cookie for sub.example.com.
Turning on Disable Intelligent Tracking Prevention in the Develop menu turns off the on‑device machine‑learning heuristics that identify trackers. However, this toggle does not lift the underlying system‑level storage limits that Apple enforces on macOS and iOS. These limits include the 7‑day cap for first‑party cookies and the blocking of third‑party cookies unless the Storage Access API is granted. Consequently, disabling ITP will not remove the 7‑day expiration or allow third‑party cookies to persist without user permission.
Third‑party iframes can request cookie access by calling
safarinavigator.storage.requestPermission()load event or script execution without a user gesture will not trigger the prompt, and the request will be denied.
document.cookie = 'test=1; path=/; expires=' + new Date(Date.now()+7*24*60*60*1000).toUTCString();.
document.cookie after 7 days to confirm the expiration is capped.
navigator.storage.requestPermission() after a click event; observe the permission prompt.
These steps confirm the behavior described in the confirmed facts above.
Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 08 Sept 2021, 09:17 UTC
Disabling ITP in the Develop menu turns off Apple’s on‑device ML tracker classifier, but the separate “Prevent Cross‑Site Tracking” privacy option remains active and can still enforce storage caps on third‑party cookies. Consequently, even with ITP disabled, a third‑party cookie may be removed before the 7‑day expiration if the site is flagged as a tracker under that privacy setting. This interaction explains why some third‑party cookies appear to persist despite the ITP toggle.