Answer
How long do cookies last in Safari?
Cookies set by JavaScript in Safari are deleted after 7 days of browser use without interaction with the site, and can expire in 24 hours after navigation from a known tracker to a URL with query parameters or fragments. Cookies set in an HTTP response aren't covered by the JavaScript rule, so they usually last longer. Safari can still cap them at 7 days in specific setups.
October 31, 2026
Cookies set by JavaScript in Safari are deleted after 7 days of browser use without interaction with the site. Cookies set by a server in an HTTP response aren't covered by that rule, so they usually last longer, with exceptions below.
What are the limits?
| How the cookie is set | Lifetime in Safari | Source |
|---|---|---|
| By JavaScript | Deleted after 7 days of browser use without interaction with the site | WebKit, Klaviyo |
| By JavaScript, after navigation from a known tracker to a URL with query parameters or fragments | 24-hour expiry | Klaviyo |
| By a server, in an HTTP response | Outside the JavaScript rule | WebKit |
| By a server whose IP doesn't match the site's first half | Can be capped at 7 days from Safari 16.4 | Aimerce write-up |
| By a server on a subdomain pointing to a cross-site host | 7-day cap can apply | Klaviyo, WebKit on CNAME cloaking |
The rule behind these is part of Safari ITP, Apple's tracking prevention.
Why does the way a cookie is set matter?
A first-party cookie written by a script on the page falls under the 7-day rule. A server-side cookie arrives with the page response, and WebKit's JavaScript rule doesn't apply to it. Klaviyo's __kla_id shows the difference. It's set by JavaScript for 2 years, though browsers can shorten that, and Klaviyo's server-set __kle_id can restore it.
Elevar's documentation carries a caveat similar to the Safari 16.4 one above, so ask any vendor how its cookie is served.
What can't a longer cookie do?
A cookie stays in one browser. It can help a returning shopper be recognized on the same device, and it can't carry anyone to a new one. That's why a shopper who built a cart on a laptop and opens your email on a phone can land on an empty cart however long the laptop's cookie lasts.
How does reOtter handle cookie limits?
reOtter recognizes people who've already given your brand their details, without a third-party network, in a record that doesn't depend on a browser cookie surviving. It doesn't identify strangers. When someone clicks your Klaviyo cart email, that recognition helps the cart recovery page restore their cart, when reOtter holds it.
Key takeaways
- Script-set cookies in Safari last up to 7 days of browser use without interaction with the site.
- Server-set cookies sit outside that rule, with exceptions for mismatched IPs and cross-site subdomains.
- No cookie lifetime helps on a second device, where an email click or login has to identify the person.
See how reOtter restores the cart → Abandoned cart recovery
Frequently asked questions
- Is Safari's limit 7 calendar days?
- It's 7 days of browser use without interaction with the site. Klaviyo's cookie documentation describes it that way. Someone who rarely opens Safari may keep a cookie for longer than a calendar week.
- Are server-set cookies safe from Safari's limit?
- They're outside the JavaScript rule, but they aren't exempt in every setup. Safari 16.4 can cap them at 7 days when the setting server's IP doesn't match the site's, and Klaviyo notes a similar cap when a subdomain points to a cross-site host. Check how your vendor's cookie is served.
- How does Safari's limit compare with other browsers?
- Klaviyo's documentation says Chrome allows cookies up to 400 days. Brave caps JavaScript-set cookies at 7 days and server-set cookies at 6 months. Lifetimes vary by browser and change over time, so treat these as current behaviour.
- Does a longer-lasting cookie help on another device?
- It doesn't, because cookies stay in the browser that received them. A shopper who moves from laptop to phone starts fresh on the phone. Recognizing them there takes an email click or a login.