Apple’s Intelligent Tracking Protection

By Tinuiti Team

There’s been a lot of buzz about the implementation of Apple’s new Intelligent Tracking Protection, or “ITP”. Although there have been a lot of perspectives and opinions floating around since this update was implemented, no one has really answered the “so what” question — so here it goes. First, a quick overview of Apple’s ITP and what it is. Then I’ll dive into the “so what” for the channels and technical information you should know as well.

Breaking down Apple’s Intelligent Tracking Protection Update

What is ITP?

ITP stands for “intelligent tracking protection”. It’s a machine learning algorithm built into new versions of Safari that identifies advertising tracking cookies and deletes them after 24 hours of inactivity.

What does it mean for tracking?

Depending on your tracking (more info below by channel), you could lose visibility to conversions beyond a 24-hour period on affected devices/browsers. In other words, if you have a click and visit captured day 1, then return on day 7, those two visits may no longer be connected.

Who does it impact?

All Safari users on MacOS High Sierra (released in June 2017), and Safari users on iOS 11 (released mid-Sept 2017).

Actions taken by vendors

Google has already implemented a new way of tracking beyond 24 hours by using a new cookie in Google Analytics. Additionally, affected AdWords conversions will be estimated based on Google’s AI/Machine Learning algorithms. Other vendors are “investigating” but no major updates as to how they are going to solve for ITP.

Is it the end of the world?

No, it’s not the best move for marketers, but it’s another play in the cat-and-mouse game of privacy vs. data availability. As always, adaptation is key to quickly overcoming any potential tracking issues.

Breakdown of impact by channel


This is probably the single largest potential impact that we will see. Since Apple ITP is purging cookies after 24 hours, long- and multi-touch conversions will likely struggle to connect conversions to prior view through and click-through events.


We may see disruption based on conversion windows. As mentioned above, Google has put some measures in place to ensure greater accuracy of affected campaigns. Kenshoo and Marin may have some trouble tracking longer tail conversions on the affected devices since they use traditional methods. However, Kenshoo and Marin have both said that they have not seen significant differences in their tracking when analyzing conversions by the device, so this may not be much of an issue.


Social may have some of the same side effects as search. However, Facebook, in particular, has the advantage of being integrated virtually everywhere. That cookie is going to refresh multiple times within 24 hours across multiple sites for typical users, so the impact will likely be minimal.


No significant impact. I would just keep it in mind when looking at holistic multichannel/multisession reports.


Also, little to no impact unless doing multi-touch user tracking.


We’ll be keeping an eye on our Analytics services to see the impact. Since Google has put some measures in place to bridge the gap, there may be little to no issue in GA.

So What Does This All Mean?

First off, let’s keep this in perspective. MacOS users on Safari are a small chunk of traffic, 20% (source: eMarketer). So while in some cases (mobile display campaigns outside of GDN/DCM for example) measurability may take a hit, it might not be as severe as everybody fears.

Another key aspect of this is the somewhat unfair advantage that big players in the game (namely, Facebook and Google) have over smaller, less-widely adapted platforms. The Google cookie can refresh across sites since it traditionally lives on the Google Ad Services domain. This means, that as long as you have a tag somewhere on your site, this cookie is going to get refreshed. The same principle applies to Facebook, Pinterest, and every other id-tracking cross-domain cookie. Basically, if a user goes to more than one site in a day with Facebook or Google tags on them, it resets the 24-hour timer.

But the problem lies in smaller services. Kenshoo and Marin for example, while linking with AdWords, do not necessarily have the widespread adoption necessary to refresh this cookie as much as Google or Facebook. That means that a click on day 1 may not be attributed to a conversion on day 7. All of this signals an advantage to running everything through the major players. Is that good? You be the judge. However, we have reached out to both Kenshoo and Marin who have both confirmed that their conversions have not been significantly affected.

So what do we do? What we always do — test, measure, assess, adjust, repeat.

This is something we should get used to if we’re not used to it already. Privacy advocates have long been vocal about ad tech and 3rd party data/measurement. Apple is in a somewhat unique place to put privacy rules in place. Think about it — is Google going to restrict Google tracking from Android devices? I would expect more action from Apple in the future on this front, along with other interface developers (such as Mozilla) and marketed as a competitive advantage, and Google will be forced to comply only if they start to lose measurable market share due to privacy concerns. Treading the line between data collection/usability and privacy has always been difficult, but the line will continue getting thinner and thinner as technology progresses and consumers become more aware of their privacy.

Technical Info for ITP

Cookie usage

Trackers use cookies to track interactions across sites. This is done in form of an ID, often hashed, that gets placed in the browser. Cookies are always attributed to domains. Site-specific cookies are owned by the root domain of the site that you are on. However, the ITP updates mainly affect 3rd party or cross-domain cookies. An example would be a cookie set on, but scoped to the domain. These 3rd party cookies are reset every time someone visits a page with that domain referenced on it. This is why Google and Facebook are going to be minimally impacted, while smaller vendors will feel more of an impact.

Cookies all have timeout periods. They can range from seconds to years. Often, vendors try and set timeout periods as far in the future as possible, so that their cookie persists. Apple is intervening and basically clearing your cookies (dynamically) after 24 hours for 3rd parties and 30 days for root domains.

Google has placed a new cookie in its latest analytics.js build that sits on the root domain but can reference the overall gaq_ cookie ID, so that the two can be tied together even in the event that cookies are cleared. This should help bridge the gap. For AdWords campaigns, Google has also said that they will use ML techniques to estimate numbers for iOS users on Safari.

An article for further reading. Kudos to Aaron for the mention!

Don’t forget, attracting visitors to your site is only half the battle! It’s important to make sure your website is optimized to help ease conversions. Find out how U.S. Polo Assn. tested their way to a +46% mobile revenue increase in this case study.

You Might Be Interested In

*By submitting your Email Address, you are agreeing to all conditions of our Privacy Policy.