Safari ITP Storage Eviction and Client-Side Cookie Persistence

Understanding ITP Storage Persistence

No, programmatic updates to localStorage or document.cookie do not reset the Intelligent Tracking Prevention (ITP) eviction clock. Safari distinguishes between automated script execution and genuine user engagement to prevent sites from artificially extending their storage lifespan through background scripts or automated refreshes.

Confirmed ITP Behaviors

• Client-Side Cookie Cap: Cookies created via document.cookie are capped at a 7-day expiration, regardless of the Max-Age or Expires attributes provided.
• Server-Side Exemption: Cookies set via HTTP response headers (Set-Cookie) are generally exempt from this 7-day programmatic cap and can persist longer.
• Storage Eviction: localStorage and IndexedDB are subject to deletion if the user does not interact with the domain for a specific period (typically 7 days).

Likely Explanation for Eviction Logic

Safari's ITP is designed to combat "fingerprinting" and persistent tracking. If a script could reset the eviction timer simply by writing a value to storage, any site with a background worker or a frequent redirect could maintain a permanent identifier without the user ever returning to the site. Consequently, the "clock" is tied to User Interaction, not Storage Mutation.

Required Triggers for Persistence Extension

To extend the persistence of first-party storage beyond the default caps, the user must perform a direct interaction. While Apple does not publish a comprehensive list of "qualifying events," the following generally trigger a reset of the interaction window:

• Clicking a link or button.
• Typing into an input field.
• Performing a gesture (swipe or scroll) that triggers a specific event listener.
• Explicitly navigating to the site via the address bar.

Verification Steps

To verify these constraints in your specific Safari version:

1. Set a cookie via document.cookie with a 30-day Max-Age.
2. Open the Web Inspector > Storage tab to observe the actual expiration date assigned by Safari.
3. Wait 7 days without visiting the site, then check if the storage persists.
4. Repeat the test, but perform a single click on the page on day 6 to see if the eviction window shifts.

Diagnostic Detail Needed: Are you observing this eviction in a first-party context (the domain in the address bar) or a third-party context (an iframe or API call)? ITP rules are significantly more aggressive for third-party storage.