Intelligent Tracking Prevention (ITP)

Intelligent Tracking Prevention (ITP) is Safari's privacy engine, built into WebKit and shipping since 2017, that limits cross-site tracking by blocking THIRD-PARTY-COOKIES and aggressively shrinking the lifetime of FIRST-PARTY-COOKIES set by scripts. It was the browser-side force that broke a great deal of web analytics, attribution, and retargeting years before the third-party-cookie debate went mainstream — quietly, version by version, on the browser with the affluent mobile audience marketers most wanted to measure.

The escalation that matters, because each step broke something: ITP 1.0 (2017) used machine learning to classify cross-site trackers and restrict their cookies; subsequent versions tightened until ITP fully blocked third-party cookies in Safari (WebKit, 2020) — years ahead of Chrome's stop-start timeline; and the part that surprised teams who thought 'we use first-party cookies, we're fine': ITP 2.1 capped script-set (document.cookie / JavaScript) first-party cookies to 7 days, and ITP 2.2 (April 2019) cut client-side cookies to 24 hours in cross-site-navigation cases — so analytics and attribution cookies written by JavaScript (which is most of them) expire in a day to a week on Safari, making returning visitors look new, attribution windows collapse, and cohort retention read as churn. What it didn't touch and what that implied: cookies set server-side in the HTTP response (Set-Cookie header) by the FIRST-PARTY domain are treated more durably, which is exactly why the fix became server-side: server-set first-party cookies, the CONVERSION-API / server-side-tagging migration this glossary documents (sending events server-to-server with durable first-party identity rather than relying on browser cookies the browser is deleting), CNAME and first-party-context setups, and consented authenticated identity (the HASHED-EMAIL join key) as the durable spine. The honest framing: ITP is not a bug to bypass but a privacy stance to design within — Apple has actively closed 'ITP circumvention' techniques, so the durable response is genuine first-party server-side architecture and modeled/aggregated measurement, not cat-and-mouse. ITP also previews where the open web is heading: the cookie's role as a stable cross-visit identifier is ending, and Safari got there first.

ITP matters to anyone whose audience skews Safari (affluent, iPhone-heavy, often the highest-value segment) — its cookie caps silently distort returning-visitor counts, attribution windows, frequency capping, and retention cohorts, and the distortion is invisible unless you segment analytics by browser. It matters as the early, real version of the cookieless future (it arrived in 2017, not in Chrome's perpetually-delayed someday) and as the forcing function behind server-side measurement. The discipline is browser-segmented analytics (read Safari separately before trusting any cross-visit metric), server-side first-party architecture as the durable fix, modeled measurement for the gaps, and designing within the privacy stance rather than chasing circumventions Apple closes.

Apple shipped ITP in Safari 11 (2017), built on a WebKit machine-learning classifier, and escalated it version by version - capping script-set cookies (ITP 2.1-2.2, 2019) and fully blocking third-party cookies (2020) - arriving at the cookieless web years before Chrome's repeatedly-postponed timeline and forcing the server-side measurement era early.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where intelligent tracking prevention (itp) is a core concern: