Your collection subdomain: the setup detail that decides how long cookies last

The case for first-party collection rests on cookies set by your own server, on your own domain, lasting far longer than the 7 days Safari allows for cookies set by JavaScript. That is true, with a condition that catches out a lot of server-side setups: Safari also checks where the server that set the cookie lives.

The rule

Since Safari 16.4, a cookie is capped at 7 days when the IP address of the server that set it does not share the first half of its address with the server that delivered the page. For IPv4 that is the first two octets (a /16); for IPv6, the first 64 bits.

The rule was built to catch tracking subdomains that look first-party by name but point at third-party infrastructure. It applies even to cookies set server-side, on your domain, through a DNS A record. A setup can do everything else right and still end up with 7-day cookies.

What decides the outcome

Only the server that terminates the connection and sends the Set-Cookie header matters. Where the rest of the pipeline runs is irrelevant to the cookie. So the question is simple: is your collection subdomain served from the same edge as your website?

• Same CDN or proxy as `www`: the addresses share the same range, and cookies last as long as you set them.
• A different provider or region: the first half of the address differs, and Safari caps the cookie at 7 days.
• A CNAME to a vendor’s hostname: Safari treats cookies set this way as third-party in character and limits them too.

Setting up the subdomain

1. Pick a name on your own domain, for example signal.yourdomain.com. 2. Serve it from the same edge as your website: the same CDN or reverse proxy that serves www, routing collection paths through to your collection service. 3. Use an address record on that edge, not a CNAME to a third-party hostname. 4. Load the collector directly in your page, served from that subdomain, not from inside a tag manager. If the tag manager is blocked, a collector loaded inside it is blocked too. 5. Test in Safari. Open the site, inspect the cookies set by the collection subdomain and check the expiry Safari reports. Then compare the IP addresses of www and the collection subdomain: the first two octets should match.

Why it matters

Cookie lifetime is the foundation of everything else: a GA4 client_id that survives past a week, _fbp and _ttp values that keep matching, click IDs that are still there when the conversion happens. Get the subdomain wrong and every one of them quietly reverts to 7 days in Safari, which on many sites is a large share of mobile traffic.

Datafly Signal sets its cookies from your collection subdomain with Set-Cookie headers, and the setup above is part of deployment. For the background on why the 7-day limit exists, see why your 7-day cookies are breaking attribution, or see how Datafly Signal handles Safari ITP.