400-day first-party cookies that survive Safari ITP

What Safari ITP actually does to your cookies

Apple's Intelligent Tracking Prevention has been progressively tightening cookie controls since 2017. The current state of play affects every measurement and attribution surface you care about.

The actual Set-Cookie header

No magic, no workaround, no probabilistic linking. The 400-day cookie is a single HTTP response header from your own subdomain. Below is what the gateway sends.

# How a 400-day first-party cookie is set
# 1. Browser requests https://collect.yourbrand.com/c/event
# 2. Datafly Ingestion Gateway responds with Set-Cookie header
# 3. Cookie is treated as first-party (server-set, same-domain)
# 4. ITP, ETP, and other browser controls do NOT cap it at 7 days

# Response headers from collect.yourbrand.com:

Set-Cookie: _df_aid=a3f9...; Domain=.yourbrand.com;
            Path=/; Max-Age=34560000; Secure;
            HttpOnly; SameSite=Lax

# Max-Age = 34,560,000 seconds = 400 days
# Domain scoped to your brand, not a vendor's
# HttpOnly prevents document.cookie tampering
# SameSite=Lax allows cross-tab measurement

# The same cookie carries:
#   - Datafly anonymous_id (cross-session identity)
#   - GA client_id (mirrored server-side, no _ga client cookie needed)
#   - Meta _fbp / _fbc (mirrored, no Meta Pixel needed)
#   - TikTok _ttp (mirrored, no ttq.js needed)
#   - LinkedIn _li_id, Pinterest _pin_, Reddit _rdt_uuid
#   - Click IDs: gclid, fbclid, ttclid, msclkid, twclid

Cookie lifetime by setup

How long the customer's identity actually persists across browsers, depending on how cookies are written.

Frequently asked questions

Why does Safari ITP cap cookies at 7 days?

Apple's Intelligent Tracking Prevention treats cookies set by JavaScript via document.cookie as third-party tracking signals and limits their storage lifetime to 7 days, regardless of the Max-Age value the script requests. When a known cross-site tracking parameter (gclid, fbclid, etc.) is present in the landing URL, the cap drops further to 24 hours. This is why _ga, _fbp, and other vendor-set cookies regularly expire on Safari users.

Does Datafly Signal use any fingerprinting to extend cookies?

No. There is no canvas hashing, no IP-based identity heuristic, no probabilistic stitching. The 400-day cookie is a standards-based first-party Set-Cookie response header from your own subdomain. ITP does not cap server-set first-party cookies the way it caps JavaScript-set ones because they are exactly what cookies were designed to be.

How does this work on Firefox and Brave?

Firefox Enhanced Tracking Protection and Brave Shields both preserve server-set first-party cookies on your own domain. The same 400-day cookie that survives Safari ITP also survives Firefox ETP and Brave. Chrome's upcoming controls preserve them too. The recovery story is uniform across every modern browser.

What is the difference between server-set and client-set cookies?

A client-set cookie is created by JavaScript via document.cookie. A server-set cookie is created by the server via a Set-Cookie HTTP response header. Browsers track both, but ITP and similar privacy controls treat them differently: server-set first-party cookies retain their requested Max-Age, client-set ones are capped to 7 days on Safari. The behaviour is documented in the WebKit ITP changelog.

Will I lose data if a customer doesn't visit for 400 days?

The cookie expires after 400 days of no activity. In practice, every visit refreshes the expiry, so as long as the customer returns within 400 days the identity persists indefinitely. For most B2C and B2B businesses 400 days covers more than the full buying cycle. Both Apple and Google formalised 400 days as the maximum first-party cookie lifetime, so you can't set longer than this on any browser.

Does this require a CNAME or DNS change?

Yes. You point a CNAME at the Datafly Ingestion Gateway, e.g. collect.yourbrand.com → gateway.datafly.com. From the browser's perspective the cookie is being set by your own domain, which is what makes it first-party. The setup is a single DNS record and an SSL certificate (handled automatically), no application changes.