Extending cookie lifetime on Safari & iOS
Safari's Intelligent Tracking Prevention (ITP) limits the lifetime of cookies set via JavaScript — especially third-party and cross-site contexts. Server-side tagging with a first-party subdomain improves the situation, but it is not a magic fix.
Why first-party matters
When GTM loads from mbase.yoursite.com, cookies set by your tagging server are first-party relative to your domain. ITP applies less aggressive caps than it does to third-party analytics cookies loaded from vendor domains.
Cookie Keeper: the concrete fix
First-party alone still leaves your cookie lifetime at the mercy of whatever each tag sets · Safari's ITP caps a JavaScript-set cookie at 7 days, first-party or not. Cookie Keeper, found on each domain's Power-ups page, re-issues recognized first-party marketing cookies over HTTP on every request, refreshing their full intended lifetime instead of letting the countdown run out.
It recognizes cookies from every major platform out of the box: Google Analytics (_ga, FPID, and the per-property _ga_* cookie GA4 issues), Google Ads and DV360 click identifiers, Meta's _fbp/_fbc, TikTok, Microsoft, LinkedIn, Snapchat, Pinterest, ChatGPT Ads, and the major affiliate networks, so returning-visitor and attribution data lasts as long as it is meant to. It's on for all of them by default, with its own toggle per cookie if you'd rather exclude a specific one · grouped by vendor for readability, but switched individually.
On Safari, that full lifetime needs one more step. Since Safari 16.4, cookies a subdomain sets in its HTTP responses are also capped at 7 days when the subdomain runs on a different server than your website, and your tagging subdomain runs on Measurebase's servers. Serve your tagging from your own domain with Same-Origin Tracking and Cookie Keeper's cookies keep their full lifetime on Safari too. Without it, Safari caps them at 7 days as well.
What server-side GTM can improve
- More stable client IDs when cookies are set server-side with
Set-Cookieheaders - Better session continuity for returning visitors, on Safari too with Same-Origin Tracking
- Improved match rates for conversion APIs that rely on consistent identifiers
What it cannot fix
- Users who block all cookies or use Lockdown Mode
- Missing or declined consent for analytics storage
- Cross-device identity without a logged-in user ID
Practical recommendations
Combine first-party server-side tagging with Cookie Keeper, Same-Origin Tracking for Safari, a proper CMP, server-set cookies where your platforms support them, and the Enhanced loader script if ad blockers are eating a measurable share of your traffic. Measure the uplift in GA4 rather than assuming a fixed percentage gain.
Full list of extended cookies
Cookie Keeper recognizes the following first-party cookies out of the box and re-issues each one with its full intended lifetime on every request. Every cookie below is extended by default — grouped by vendor here for readability, but each one has its own toggle in the domain's Cookie Keeper settings, so you can turn off an individual cookie rather than a whole vendor at once.
Google Analytics
_ga FPID _ga_* (per GA4 property)
Google Ads
FPAU FPGCLAW FPGCLGB FPGCLGS FPGSID _gcl_au _gcl_aw _gcl_gb _gcl_gs
Google DV360
FPGCLDC _gcl_dc
Meta
_fbp _fbc
TikTok
_ttp ttclid
Affiliates
awin_awc awin_source awin_sn_awc rakuten_site_id rakuten_time_entered rakuten_ran_mid rakuten_ran_eaid rakuten_ran_site_id outbrain_cid taboola_cid cje
Snapchat
_scclid _scid
li_fat_id
Microsoft
uet_vid _uetmsclkid
_epik
ChatGPT Ads
__oppref __obref