Safari's Intelligent Tracking Prevention (ITP) deletes your visitor cookies after 7 days — turning returning customers into strangers. You end up paying to re-acquire people you already paid for. This article explains exactly what's happening, why it's getting worse, and what you can do about it.
Picture this. A customer clicks your Meta ad on a Tuesday, browses your store, adds a product to cart, but doesn't buy. You set up a retargeting campaign to bring them back. Seven days later they return — ready to purchase.
But here's the problem: your tracking pixel has no idea who they are. Safari wiped their cookie. Your Meta campaign counts this as a brand new acquisition. You get charged for a customer you already had. Your ROAS tanks. Your CAC balloons. And nobody on your team knows why.
This isn't an edge case. If more than 30% of your traffic comes from iPhone or Mac users — and for most Shopify stores it does — this is happening to you right now, every single day.
Intelligent Tracking Prevention (ITP) is Apple's built-in privacy feature in Safari. It was introduced in 2017 and has been tightened with every major update since. The goal is genuine — stop advertisers from following users around the web without their consent.
But the effect on e-commerce marketers is brutal. Here's what ITP actually does to your tracking:
Safari now commands roughly 26% of global browser market share — and significantly more on mobile in the US, UK, and Australia, where iPhone penetration is highest. For Shopify stores targeting premium consumers, that number is often closer to 40–50% of all traffic.
Let's make this concrete. Imagine your store gets 10,000 visitors a month. 35% use Safari — that's 3,500 people. Of those, roughly 40% return within 8–30 days to make a purchase. That's 1,400 customers per month whose identity gets wiped before they convert.
When those 1,400 customers come back, Meta and Google see them as brand new users. They get added to your acquisition audience. You spend acquisition-level budget to show them ads. They convert — and your platform reports it as a new customer acquisition, boosting your reported ROAS.
Meanwhile your actual CAC is inflated, your retention metrics are suppressed, and your retargeting campaigns are cannibalising the customers your email and organic channels already warmed up. You're paying for something you already owned.
The sneaky part: Because the customer still converts, everything looks fine on the surface. Your campaigns show conversions. Your ROAS looks acceptable. The problem only becomes visible when you look at true incrementality — what would have happened without the ad spend. Most stores never look.
You may have already tried some of the standard recommendations — server-side tracking, the Meta Conversions API, Google's Enhanced Conversions. These are all worthwhile and you should implement them. But they don't solve the underlying identity problem.
Here's why. Server-side tracking moves the data collection off the browser — but it still needs a way to identify which customer triggered an event. If the cookie that holds that identity has been wiped, server-side tracking has nothing to match against. You're sending events to Meta with no user ID, and Meta's match rate drops significantly.
The Conversions API improves signal quality for events that happen after a session — like delayed purchases. But it doesn't re-identify customers whose cookies were wiped before they returned. The gap remains.
The only durable fix is to establish a first-party identity for each visitor that lives in your own infrastructure — not in a browser cookie that Safari can delete.
This means connecting the dots using signals you own: email address from a Klaviyo signup, phone number from an SMS opt-in, a logged-in account on your store. When a returning visitor comes back after an ITP reset, you can re-identify them through these owned signals rather than relying on a cookie that may no longer exist.
Done well, this lets you:
You don't need to solve everything at once. Here's a practical order of operations:
Step 1: Measure the damage. Pull your Safari traffic percentage from Google Analytics or Shopify Analytics. Multiply by your monthly returning customer rate. That's roughly how many identity resets you're experiencing per month.
Step 2: Audit your email capture rate. First-party identity starts with an email address. If less than 15% of your visitors are giving you their email, that's your biggest lever to pull — before any technical fix.
Step 3: Implement server-side tracking. If you haven't already, get the Meta Conversions API and Google Enhanced Conversions set up. They won't solve identity, but they'll recover some signal quality.
Step 4: Look at a first-party identity layer. Tools like Cignify's Spark Pixel are built specifically for this problem — maintaining a persistent first-party identity for each visitor across ITP resets, devices, and sessions, so the work you did on steps 1–3 actually sticks.
Safari ITP isn't going away. If anything, every Apple update has made it stricter, and other browsers are following suit. The era of relying on third-party cookies and browser-based tracking is genuinely over.
The stores that will win the next few years are the ones building durable, first-party customer relationships — not just ad funnels. Better data means better targeting, lower CAC, higher LTV, and margins that actually reflect the work you're putting in.
The leak is real. Now you know where it is.
Cignify's Spark Pixel re-identifies returning customers after Safari ITP resets — restoring the journeys your current tracking misses.
Install Free on Shopify