Skip to main content

Apple ITP - Measures and Actions

This article will give you insights about what actions can be taken into consideration given the current development of Apple ITP

Updated yesterday

Note: Adtriba Core is a legacy feature that we continue to support but no longer sell. The latest version of this feature is available as Funnel Measurement.
If you are already using Funnel Measurement, find more information here. To upgrade, contact us.

Intelligent Tracking Prevention (ITP) Overview

Intelligent Tracking Prevention (ITP) is a privacy feature in Safari designed to reduce cross-site tracking. It uses a built-in machine learning system to identify domains that have the capability to track users across different websites. Based on statistical patterns collected during browsing, Safari can then limit or block storage mechanisms (such as cookies) associated with those domains.


Changes Introduced in ITP 2.3

Apple released Safari 13 with ITP version 2.3 on March 24, 2020.
This update altered how measurement and attribution data is retained:

  • Previous change (ITP 2.2): First-party cookies created via JavaScript were automatically removed after 24 hours if the site was classified as capable of tracking. This significantly reduced the attribution window from seven days to just one day.

  • New approach in ITP 2.3: The seven-day window can now be preserved if sites store attribution identifiers in non-cookie browser storage, such as localStorage or IndexedDB, instead of relying solely on cookies. This gives advertisers and analytics platforms more flexibility for maintaining tracking continuity while still complying with Safari’s privacy rules.

Mitigation Strategies for ITP Restrictions

While each browser’s tracking prevention rules may differ, a general best practice for maintaining longer-term tracking involves server-side data storage.

A common approach is:

  1. Identify the first-party tracking identifier when a user first visits the site.

  2. Check if the identifier already exists in the browser’s storage. If not, generate a new one.

  3. Store the identifier both client-side and server-side. This way, if the browser deletes the client-side cookie, the server can reissue it during a future visit.

  4. Refresh the cookie’s expiration date whenever the user returns, ensuring it remains valid for the intended attribution window.

Example (Node.js / Express):

app.get('/', (req, res) => {
const trackingId = req.cookies['tracking_id'];

if (trackingId) {
res.cookie(
'tracking_id',
trackingId,
{
domain: 'example.com',
path: '/',
secure: true,
httpOnly: true,
expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 365 * 2) // 2 years
}
);
}

res.render('home');
});

By storing identifiers on the server and syncing them with client-side cookies, sites can reduce data loss caused by ITP’s automatic deletion policies, even if a user returns after more than seven days.

Did this answer your question?