ITP (Intelligent Tracking Prevention)

ITP (Intelligent Tracking Prevention) is the privacy system built into Apple's Safari and WebKit. It identifies domains that behave like cross-site trackers and restricts what their cookies can do: third-party cookies are blocked outright, and many script-set first-party cookies are capped to a short life (as little as 24 hours in some cases). Firefox ships a similar system, and Chrome has been tightening third-party cookies too. For affiliate programs, ITP is the single biggest cause of conversions that quietly fail to attribute.

Why it breaks affiliate tracking

Classic affiliate tracking leaned on a shared third-party tracking domain setting a cookie in the visitor's browser at click time, then reading it back at conversion. ITP treats that shared domain as a tracker and withholds or deletes the cookie — so when the conversion pixel fires, the click ID cookie is simply gone, and the conversion records as unattributed. The affiliate did the work and does not get paid, and your reports understate the program.

A worked example

A visitor on an iPhone clicks an affiliate link served from a shared tracking subdomain, browses, and buys two days later. Under ITP, the cookie that shared domain set may have already been capped or withheld. The conversion pixel fires with no click ID and no readable cookie: unattributed, $0 credited. Run the same journey through a first-party tracking domain like track.yourbrand.com that matches your site, and the cookie is treated as first-party and survives — the conversion attributes normally.

How to survive ITP

Three defenses, in order of strength:

1. Use your own first-party tracking domain, so cookies are first-party rather than third-party.
2. Pass the click ID explicitly from the landing URL through to the conversion, so attribution never depends on a cookie at all.
3. Use server-to-server postbacks, which do not touch the browser.

How this works in LimeliJourney

LimeliJourney is built for the post-ITP world. Every account runs on its own tracking domain — a domain you own, so the attribution cookie is first-party and far more likely to survive between click and conversion. On top of that, the platform appends the click ID (ll_cid) to the landing URL by default so you can capture and echo it, making attribution independent of cookies entirely. And the full server-to-server path is available for funnels where the browser can't be trusted. The result: conversions that ITP would silently drop on a shared-domain setup keep attributing.