Cookie lifetime / ITP
Cookie lifetime is how long a cookie actually survives in the browser: Safari's ITP caps script-set cookies at 7 days, sometimes 24 hours, whatever expiry you set.
Safari's Intelligent Tracking Prevention (ITP) caps cookies set via JavaScript at seven days (24 hours when the visit arrives with a click ID in the URL), regardless of the expiry the script requested. Firefox applies its own limits. Most analytics and ad tags store their visitor IDs in exactly these script-set cookies.
#It hits first-party cookies too
This is not just a third-party-cookie story: the caps apply to first-party cookies written by script. A Safari visitor who clicks an ad and returns to buy on day 9 looks brand-new, so the conversion detaches from the click. Attribution windows on Safari traffic silently compress to a week, no consent banner involved. Cookies set server-side (HTTP response headers) escape the seven-day cap, which is much of why server-side infrastructure became a measurement topic.
| Browser | Cookie | Effective lifetime |
|---|---|---|
| Safari (ITP) | First-party, set by JavaScript | 7 days |
| Safari (ITP) | JS-set, arriving via link decoration (click IDs) | 24 hours |
| Safari (ITP) | First-party, set server-side (HTTP header) | Requested expiry |
| Firefox (ETP) | Third-party | Blocked by default |
| Chrome | Third-party | Allowed (deprecation walked back) |
The maintained version of this table, with per-context caveats and what to do about each row, is in Tracking after third-party cookies: what actually still works. The transport that sidesteps the caps is Server-side tracking.
Related terms
Cookieless tracking
Cookieless tracking is measurement that doesn't depend on third-party cookies: first-party data, server-side events, hashed-identifier matching, and modeled conversions.
Server-side tracking
Server-side tracking sends conversion and analytics events from a server you control instead of the visitor's browser: a more durable route for the same events.
Third-party cookies
Third-party cookies are cookies set by a domain other than the one you're visiting: the basis of cross-site ad targeting, blocked by Safari and Firefox, kept by Chrome.