Safari ITP

Safari ITP, or Intelligent Tracking Prevention, is Apple's set of browser limits on tracking. The limit ecommerce teams meet most often deletes script-writable storage, including JavaScript-set cookies, after 7 days of Safari use without interaction with the site.

What does ITP limit?

Situation	What Safari does	Source
Cookie or storage written by script	Deleted after 7 days of browser use without interaction with the site	WebKit
Script-set cookie after a click from a known tracker to a URL with query parameters or a fragment	24-hour expiry	Klaviyo docs
Cookie set in an HTTP response	Not covered by the script rule	WebKit
Server-set cookie through a subdomain pointing to a cross-site host	Can be capped at 7 days	Klaviyo docs, WebKit on CNAME cloaking
Server-set cookie where the server's IP doesn't match the site's first half (Safari 16.4)	Can be capped at 7 days	Aimerce write-up

The clock is worth reading closely. It counts days of Safari use without interaction with your site, so someone who visits often keeps resetting it. A customer who reorders every six weeks is much more likely to run past it.

Why does ITP matter for Shopify brands on Klaviyo?

Klaviyo's __kla_id cookie is set by JavaScript for 2 years, and browsers can shorten that. In Safari, a returning customer who stayed away long enough can lose the cookie and arrive looking anonymous. If they add to cart, Klaviyo may not know who to email. Why doesn't Klaviyo identify returning visitors? goes through the causes.

Klaviyo's Extended ID and First-Party ID respond to this directly. The server-set First-Party ID (__kle_id) can restore __kla_id for people with an existing profile. Extended ID is on all plans, so turn it on first.

What doesn't ITP explain?

ITP affects whether one Safari browser is recognized over time. It doesn't explain a shopper who starts on a laptop, opens your email on a phone and finds an empty cart. That's cross-device cart abandonment, and it happens in every browser. A server-side cookie that lasts longer still stays on one device. Keep the two problems apart when you diagnose a flow.

How does reOtter deal with browser limits?

reOtter recognizes people who've already given your brand their details, without a third-party network, in a record that doesn't depend on a browser cookie surviving. Strangers aren't identified, and carts are held only with analytics consent from your store's banner.

Key takeaways

• ITP's best-known rule deletes script-set storage after 7 days of Safari use without interaction with the site.
• Server-set cookies avoid that rule, with exceptions for cross-site subdomains and for IP mismatches on Safari 16.4.
• ITP limits recognition on one browser, so it doesn't explain empty carts on a second device.

See how reOtter restores the cart → Abandoned cart recovery