Apple’s cookie clampdown: ITP 2.1

Alistair Johnstone

Data & Analytics Consultant

The latest version of Apple’s Intelligent Tracking Prevention (ITP 2.1) caps the lifespan of first-party cookies to a maximum of seven days.

The update has far-reaching implications for marketing technology that relies on first-party cookies, affecting platforms like Google Analytics, Google Ads, Facebook, Adobe and affiliate tracking.

What is ITP?

Apple’s Intelligent Tracking Prevention is a setting enabled by default on Safari browser versions 11 and above. It was first rolled out in 2017, designed to prevent cross-site tracking and unwanted third parties collecting data without the user’s knowledge or consent. The latest update takes further measures, introducing strict rules for first-party cookies.

What’s changed?

All persistent, client-side cookies can now only be stored for a maximum of seven days.

Apple is addressing a number of issues with this latest release and, according to a Webkit blog post, the reason for the changes include privacy, security, and performance concerns.

Increasingly, cross-site trackers have started to use first-party cookies. ITP 2.1 aims to prevent this, because a shared storage space means third-parties are able to read and write other’s cookies. This could have serious privacy implications.

The update also prevents methods used to steal first-party cookie data like cross-site scripting attacks and speculative execution attacks on memory.

The beta releases of iOS 12.2 and Safari 12.1 on macOS High Sierra and Mojave include the updated version of ITP.

Will this this affect me?

All marketing technology platforms relying on client-side, first-party cookies will be affected by this change, including Google Analytics, Google Ads, Facebook, Adobe and affiliate tracking.

For example, in Google Analytics, metrics such as Users and Sessions will be artificially inflated because users will no longer be recognised after seven days, instead showing up as new users.

There’s already some speculation that these platforms could use localStorage in the browser as a backup for storage, in cases where the cookie mechanism is no longer reliable.

Is this the end of cookie tracking?

ITP appears to be aimed mainly at third parties, but because cross-site trackers have been misusing first-party storage, first parties are now also paying the price.

With the marketing industry still figuring out the effects of previous ITP releases, only time will tell what impact these new changes will have on the future of cookie tracking and the industry in general.

Continue reading


Are you ready to make a digital step-change?

We believe that moving too slowly in digital is the biggest risk your business faces. If you are ready to move faster in digital, we are here to help.

Get In touch