Why Safari still caps your cookies at 7 days, even with server-side tagging
Moving to server-side tagging is often sold as the fix for Safari's 7-day cookie limit. For most setups it no longer is. Since Safari 16.4, the deciding factor is not who sets the cookie but where the server that sets it runs, and for nearly every hosted tagging server that is somewhere other than your website.
What Safari limits
Safari's Intelligent Tracking Prevention (ITP) caps cookies that JavaScript writes, such as the _ga cookie the Google tag sets in the browser, at 7 days. When a visitor arrives from a link with tracking parameters on a known tracking domain, that drops to 24 hours. A visitor who comes back after a week is a new user to your analytics.
Cookies a server sets in an HTTP response were the way around this: Safari treated them as genuine first-party cookies and let them live for their full lifetime. That is what server-side cookie extension, including our Cookie Keeper, is built on.
The change in Safari 16.4
Since March 2023, Safari also caps server-set cookies at 7 days when the server looks like a third party in disguise. It checks two things:
- a subdomain that is a CNAME to another company's domain;
- a subdomain whose IP address is unrelated to your website's own: for IPv4, the first two numbers of the address differ, and one side on IPv4 with the other on IPv6 counts too.
A tagging subdomain like mbase.yourshop.com points at your tagging provider's server, not at your website's. Safari sees the different address and caps every cookie that subdomain sets at 7 days, server-set or not.
Who is affected
Practically every setup where the tagging server runs on a separate subdomain, whichever provider hosts it. Our tracking audit finds it on more than half of the domains it checks. The ones that escape it run their website and tagging server on the same network, which is rare.
What it costs: returning Safari and iPhone visitors are counted as new after a week, conversions that take longer than that lose their original source, and remarketing audiences built on returning visitors shrink. On many Dutch sites, Safari is a third or more of all traffic.
How to check your own setup
The Measurebase tracking audit checks it every night and says so plainly: "Safari caps the cookies your tagging subdomain sets at 7 days: it runs on a different server than your website." To check by hand, look up the IP address of your website and of your tagging subdomain (for example with dig or an online DNS lookup) and compare the first two numbers.
The fix: serve tracking from your own domain
Safari only looks at the server that answers. Serve your tagging from a path on your own website, such as https://www.yourshop.com/mb, and the requests are answered by your website's own address. Your hosting or CDN forwards that path to the tagging server behind the scenes, and Safari treats the cookies as your own again.
In Measurebase this is the Same-Origin Tracking power-up. It gives you a ready-made forwarding rule for Vercel, Next.js, Cloudflare, Netlify, nginx and Apache, and the WordPress and Shopware plugins do the forwarding themselves. A live check confirms that the path reaches your tagging server, forwards the visitor's IP address and passes cookies back. Then you generate your script again and it loads from your own domain.
Two things to know:
- Cookie Keeper needs it on Safari. Cookie Keeper re-sets your marketing cookies from the server with their full lifetime. On Safari that only helps when the server is your own domain.
- Shopify storefronts can't use it yet. Shopify's app proxy strips cookies, so a forwarded path can't set them.
Frequently asked questions
Does pointing a CNAME at the tagging server help?
No. Safari detects CNAME cloaking as well, and caps those cookies in the same way.
Do Chrome and Firefox do the same?
No. They don't apply this check. Chrome limits every cookie to at most 400 days, whoever sets it.
Will my existing visitors keep their history?
Visitors whose cookie is still valid keep it. From the switch onwards, their cookies are set from your own domain and keep their full lifetime.