Bypass Safari ITP limitations

Safari’s Intelligent Tracking Prevention (ITP) limits most first‑party cookies to 7 days. That sounds harmless, but it breaks long‑term attribution, remarketing lists, and any analysis that relies on recognizing the same visitor over time.

Stape offers three practical ways to sidestep those limits and keep your cookies alive for months instead of days: Cookie Keeper, Own CDN, and the Same Origin approach.

Benefits of bypassing Safari ITP

• Truer attribution windows – measure conversions that happen weeks after the first click, not just within a single week.
• Consistent customer journeys – stitch sessions together to see how people actually move from awareness to purchase.
• More effective retargeting & personalization – keep audiences intact so your ads stay relevant and your on‑site experiences stay tailored.

How to bypass Safari ITP

Here is a brief explanation of the three options you have to bypass Safari’s ITP:

1. Cookie Keeper power-up

Cookie Keeper regularly restores the cookies that you choose. Safari can’t shorten cookies that are continuously renewed by the server, so lifetimes extend to either a set period (e.g. 90 days or 13 months) or indefinitely.

If you’d like to use the Cookie Keeper power-up, please follow this guide to configure it.

2. Own CDN option

It points your sGTM custom domain through the same IP address as your main website (e.g., Cloudflare proxy). To Safari and Firefox, the tagging server now looks like the site itself. Because the request comes from the identical host IP, cookies are treated as true first‑party and are exempt from ITP’s 7-day cap.

If you’d like to use the Own CDN option, please follow this guide to configure it.

3. Same Origin approach

This approach works somewhat similarly to the previous method, so it makes the most sense if you’d like to avoid using Own CDN. Proxies your sGTM endpoint through a path on your primary domain (e.g., example.com/metrics). Tools like Nginx, Netlify, or CloudFront forward traffic to Stape while keeping the URL origin unchanged. The browser sees every server-side request as coming from the exact same origin as the page, so ITP’s restrictions don’t apply. 

If you’d like to use the Same Origin approach, please follow this guide to configure it.