Safari’s Intelligent Tracking Prevention caps the cookie your platform sets right after someone clicks a decorated affiliate link (a URL carrying a parameter like ?ref= or ?aff=) at 24 hours, and caps most other client-side cookies at 7 days. WebKit announced the 7-day rule in February 2019 and shipped the tighter 24-hour rule that September with Safari 13. Safari now carries 51.8% of US mobile web traffic as of early August 2026, according to Cloudflare Radar. If your program still reads a browser cookie to credit a sale, you’re losing attribution on most of your mobile clicks the moment a buyer waits more than a day to check out.
Affiliate managers keep asking why conversion numbers from their own platform don’t match what Google Analytics or their store shows. Most of the time the answer isn’t fraud, and it isn’t lazy affiliates. It’s a browser policy that’s been quietly tightening for seven years, and it hits affiliate links harder than almost any other kind of tracked link on the web. Programs selling anything with a real decision cycle, coaching, courses, SaaS, high-ticket physical products, feel it the most, because those are exactly the purchases that take longer than a day to close.
What Safari’s ITP actually did to affiliate cookies
WebKit, the engine behind Safari, announced in February 2019 that it would cap the expiration of any cookie set through JavaScript at 7 days, a rule that became Intelligent Tracking Prevention 2.1. Before that update, a cookie your affiliate platform dropped in a visitor’s browser could sit there for 30, 60, or 90 days, however long your terms promised. After it, Safari deletes that cookie in a week no matter what your platform tells the affiliate.
This mattered immediately for affiliate tracking because most platforms set their tracking cookie with JavaScript on the landing page, not through some obscure server header nobody thought to check. How affiliate tracking works covers the normal mechanism: a click lands, a cookie drops, a later purchase gets matched against it. WebKit’s 2019 change didn’t touch that mechanism. It just put a clock on it that most program owners never noticed until their numbers started drifting.
If you’ve never actually mapped out what happens between a click and a credited sale on your program, start there before you touch anything else. How Affiliate Tracking Works walks through the click, the cookie, and the pixel in plain language, and it’s the piece this post assumes you’ve read.
Why affiliate links trigger the harsher 24-hour rule
Apple tightened the rule again seven months later. ITP 2.3, which WebKit shipped with Safari 13 on September 23, 2019, cuts a cookie’s life to 24 hours specifically when that cookie gets set right after the browser follows a link with a query string or fragment attached, which is exactly what a decorated affiliate link is. An affiliate link almost always carries something like ?ref=jane or a subdomain built for tracking, and Safari’s classifier reads that as a signal the destination is a tracker, not a coincidence.
So the 7-day rule was never really the number that mattered for affiliate programs. The 24-hour rule is. A buyer who clicks an affiliate link on Tuesday and checks out on Thursday already falls outside Safari’s real window, even though your program’s terms page still promises 30 days. Program owners who quote a generous affiliate cookie duration to recruit affiliates are, on Safari, quietly promising something the browser won’t let them deliver.
What a “30-day” or “90-day” cookie window actually means on Safari
Do the math on a 30-day window and about 97% of it doesn’t exist on Safari. One day survives out of thirty advertised, and that’s before you account for the visitor closing the tab, switching devices, or clearing their browser between the click and the purchase.
That gap punishes exactly the purchases affiliate programs care most about protecting: the ones with a real consideration period. Someone doesn’t usually buy a $2,000 coaching program, a SaaS annual plan, or a course bundle in the same session where they first heard about it from an affiliate. They click the link, close the tab, think about it for a few days, then come back through a bookmark or a direct search. Affiliate attribution models built around last-click cookie matching assume that gap doesn’t exist. On Safari, it exists for almost everyone.
Cookie expiration isn’t the only thing quietly draining a program’s payouts. Matt’s Top 20 Affiliate Program Mistakes report covers the other ways a $12.6 million program almost got wrecked, tracking blind spots included, and how each one got fixed.
Why CNAME cloaking and subdomain tricks stopped working
WebKit closed the most common workaround on November 12, 2020. Starting with Safari 14, ITP began detecting CNAME cloaking, the practice of pointing a subdomain like track.yourdomain.com at a third-party tracking vendor’s servers through a DNS record so the cookie looks first-party. Once detected, Safari caps any cookie set through that disguised request to the same 7 days it already applies to ordinary JavaScript cookies.
Some affiliate and analytics platforms leaned on this trick specifically to dodge the tighter rules. It worked for about a year. Renaming the tracking domain never fixed the underlying problem, and now it doesn’t even buy you time. If you’re evaluating platforms on how to set up an affiliate program on Shopify or any other platform, ask directly whether their tracking depends on a cloaked subdomain. If the answer is yes, you’re one browser update away from the same problem you’re trying to solve now.
Why Chrome’s cookie reversal doesn’t bail you out
Google spent five years promising to eliminate third-party cookies in Chrome, then reversed course in 2024 and confirmed they’ll stick around indefinitely behind a new opt-in privacy prompt instead of a hard deprecation date. Some affiliate managers heard “Chrome backed off” and assumed the whole cookie problem got called off with it.
It didn’t. Chrome’s decision only ever applied to Chrome, and it mostly concerned third-party cookies used for ad retargeting, not the first-party cookies most affiliate platforms already switched to. Safari’s rules came from a completely different team at Apple, apply regardless of what Google does, and never had a deprecation date to reverse. Firefox runs its own version of the same restriction by default too. For a program selling to consumers, where how affiliate marketing works for e-commerce brands already means a meaningful share of traffic arrives on a phone, Safari’s 24-hour rule is the one setting your actual ceiling, not whatever Chrome decided to do this year.
What server-side tracking changes about the mechanism
Server-side tracking replaces the browser cookie with a click ID: a random string your platform generates the instant someone clicks an affiliate link, stored in your own server’s database instead of the visitor’s browser, and matched to the sale later through a postback request your server sends the tracking platform when the purchase completes. Nothing about the match depends on a cookie surviving the visit, because nothing about the match happens in the browser at all.
A typical postback request looks something like this: track.example.com/postback?click_id=8f2a91&offer_id=204&status=approved&payout=250.00&event=sale. Every field in that string does a specific job. The click ID ties the postback back to the original click your server already logged. The offer ID identifies the campaign. The status and payout tell your platform exactly what to credit and how much. None of it lives in the visitor’s browser, so none of it is exposed to ITP, ad blockers, or a visitor who clears cookies between the click and the sale. IREV, one platform built around this model, documents postback accuracy above 98% under normal configuration, specifically because the match happens between two servers instead of waiting on a cookie that might already be gone. That’s the entire case for switching: not that server-side tracking is more modern, but that it doesn’t ask a browser’s permission to remember anything. Look for this capability by name, not just “cookieless,” when you’re comparing the best affiliate program software, and check the vendor’s glossary against your own if terms like click ID and postback are new. Affiliate marketing terms explained covers the rest of the vocabulary you’ll run into during that comparison.
Matt built AffiliateHQ after two decades of running programs on software that treated tracking accuracy as an afterthought. Every feature, including how it handles attribution, maps back to what actually holds up once ITP starts deleting cookies.
How to tell you’re already losing conversions to this
Split your platform’s reported conversion rate by browser and compare Safari against Chrome for the same offer over the same window. If Safari traffic converts at half the rate of Chrome traffic or worse, cookie expiration is a more likely explanation than a sudden drop in affiliate quality.
Two more checks worth five minutes each. First, compare your average time between click and purchase against your advertised cookie window. If buyers regularly take more than a day to convert and most of your traffic is mobile, the gap between what you promise affiliates and what Safari actually delivers is probably wide. Second, look at how much of your “direct” traffic in analytics shows the same landing pages and campaign timing as your affiliate promotions. A spike in direct sales that lines up suspiciously well with an affiliate’s big send is often that affiliate’s traffic, just uncredited. Third, ask two or three of your top affiliates to self-report their own click counts from their link shortener or email platform for a specific campaign, then compare that number against what your affiliate platform recorded for the same window. A gap of 15% or more between what the affiliate saw and what your platform counted is a tracking problem, not a performance problem. The affiliate management Q and A on clicks, commissions, and cookies walks through a few more ways this shows up in a program’s numbers before anyone realizes what’s causing it.
What actually fixes it
Three changes move the needle, and none of them require you to rebuild your program from scratch. Move your tracking to a platform that supports server-side postbacks, so attribution stops depending on a cookie surviving the visit at all. Set your advertised cookie window to match what you can actually deliver instead of a number that sounds generous on a recruiting page but quietly breaks on the majority of mobile traffic. And add a first-party fallback, like a unique coupon code or an email capture tied to the affiliate’s link, so a sale still gets credited correctly even on the rare case where a cookie never gets read.
None of this requires abandoning cookies altogether or scaring affiliates with browser jargon they don’t need to know. It requires picking a tracking method that doesn’t rely on Safari’s goodwill, because Safari has made it clear for seven years running that it doesn’t have any to spare.
If you’re not sure which of these three fixes to prioritize first for your program, that’s exactly what a free 20-minute call with Your Affiliate Launch Coach is for. Matt reviews your current setup and gives you a specific 30-60 day plan instead of a generic checklist.
