POV: Safari’s Full Third-Party Cookie Blocking

Background:

Apple recently announced a significant update to its Safari Intelligent Tracking Prevention (ITP) which means that cookies for cross-site resources are now blocked by default on Safari.

Details and Implications:

Safari’s Intelligent Tracking Prevention (ITP) is a privacy feature that allows the company’s web browser to block cookies. Apple first launched ITP within Safari nearly three years ago and it immediately set a new bar for web privacy standards.

Following the release of Safari 13.1 and through updates to the (ITP) privacy feature, Apple now blocks all third-party cookies in Safari by default. It is only the second browser, after the Tor browser, to block all third-party cookies by default.

However, it’s important to note that this doesn't mean that Safari now blocks all user tracking, only tracking methods that rely on planting a cookie file in Safari and (re-)checking that cookie over time to identify the user as they move from site to site. Other user tracking solutions such as user/browser fingerprinting, will most likely continue to work.

The subtle but significant change is that whilst other browsers have publicly said they now have a mechanism to allow users to block third-party cookies altogether, none of them do it by default apart from Tor and now Safari. Google previously announced that it would start phasing out third-party cookies on Chrome but not implement this fully until 2022 and Microsoft's Edge has also begun gradually blocking third-party cookies but the feature is not enabled by default for all users.

John Wilander, an Apple software engineer said in a blog post that this is a significant improvement for privacy since it removes any sense of exceptions. However, users may not notice much difference: ‘it might seem like a bigger change than it is. But we’ve added so many restrictions to ITP since its initial release in 2017 that we are now at a place where most third-party cookies are already blocked in Safari’.

In addition to blocking third-party cookies by default, the new feature set also ensures that websites and trackers that are deployed across a consumer journey can’t use login IDs to digitally fingerprint users who might otherwise be using tracking prevention or other privacy tools.

Summary:

Safari’s market share is relatively low (3.62%) compared to Google’s Chrome browser (67.72%). However, this is another tightening in privacy levels for users. Advertisers have been aware of ‘the death of the cookie’ for some time and this has pushed the industry to innovate to protect consumers privacy while also leveraging new technology to be able to deliver the experience brands strive to offer.

Further Reading:

The Verge | ZDNet | Webkit blog |