> ## Documentation Index
> Fetch the complete documentation index at: https://oneviewhub.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Intelligent Tracking Prevention

> Understand Apple® WebKit's Intelligent Tracking Prevention.

export const IntegrationHero = ({logoSrc, alt = "Integration logo", maxHeight = 160}) => {
  const containerStyle = {
    display: 'flex',
    alignItems: 'center',
    justifyContent: 'center',
    width: '100%',
    height: '220px'
  };
  const imgStyle = {
    maxHeight: `${maxHeight}px`,
    maxWidth: '100%'
  };
  return <Frame>
      <div style={containerStyle}>
        <img noZoom src={logoSrc} alt={alt} style={imgStyle} />
      </div>
    </Frame>;
};

<IntegrationHero logoSrc="/assets/logos/WebKit.svg" alt="WebKit" />

## What is Intelligent Tracking Prevention?

[Intelligent Tracking Prevention](https://webkit.org/tracking-prevention/) is a feature of [WebKit](https://webkit.org/) (the browser engine that powers [Safari](https://www.apple.com/safari/) on **macOS**, and all mobile browsers on **iOS** and **iPadOS**), which protects users' privacy by placing **technical restrictions** on tracking methods websites can use.

> ITP aims at  *"blocking practices that are harmful to users because they infringe on a user's privacy without giving users the ability to identify, understand, consent to, or control them."* <br />
>
> — [WebKit's Tracking Prevention Policy](https://webkit.org/tracking-prevention-policy/)

## What does ITP block?

This section outlines the restrictions that impact **marketing teams** the most, and how OneView achieves compliance with them. For the full list of restrictions, please check [WebKit's technical documentation](https://webkit.org/tracking-prevention/#intelligent-tracking-prevention-itp).

### Cookies

<Check>
  **OneView achieves full ITP compliance** when you send data from a **tracking endpoint** under your website domain (like `www.example.com/track`) using [Google Tag Manager Server-Side](/docs/guides/sending-events/backend/gtm-server).
</Check>

<Info>
  **Understanding cookies:**

  When you visit `www.example.com`, cookies fall into two categories:

  * **Regular cookies**: set directly via  [`document.cookie`](https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie) by scripts on the browser; these are always **first-party** cookies.
  * **HTTP cookies**: set via [`Set-Cookie`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie) header by a remote server, called by scripts on the browser; depending on the remote server domain:
    * **Same-site domains**: Your domain (like `blog.example.com` or `api.example.com`), these are **first-party** cookies.
    * **Cross-site domains**: Any other domain (like `tracking.vendor.com`), these are **third-party** cookies.
</Info>

| Restriction                                                                 | Effect (Engineering)                                                                                                     | Impact (Marketing)                                                                                                       |
| --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ |
| **Restricted cookie lifetime**: *7-Day Cap on All Script-Writeable Storage* | ➡️ **Regular cookies** (e.g. set by **GTM Web**): deleted after 7 days after the last user interaction.                  | ❌ Tracking data is lost after **7 days** without user interaction, when using **client-side tracking**.                  |
| **Tracking subdomains** *CNAME and Third-Party IP Address Cloaking Defense* | ➡️ **HTTP cookies** (e.g. set by **GTM Server**): deleted after 7 days. Exemption for first-party `same-origin` cookies. | ❌ Tracking data is lost after **7 days**, when using **server-side tracking** on a subdomain (e.g. `track.example.com`). |

**Intelligent Tracking Prevention (ITP)** intentionally breaks all forms of tracking solutions by modifying the fundamental browser mechanisms that make cookies work. Specifically:

* **if set by `cross-site` domains**: they are blocked by default
* **if set by `same-site` domains** or **javascript**: they are deleted after 7 days of <Tooltip tip="Regular and HTTP cookies have effectively identical behavior under ITP, as regular cookies are usually set once after the ad click, and HTTP cookies are usually refreshed on each page view by the remote server.">no user interaction</Tooltip>.
* **if set by `same-origin` domains**: they are [exempted from the 7-day cap](https://github.com/WebKit/WebKit/pull/5347).

Learn more about their differences in [this guide](https://web.dev/articles/same-site-same-origin).

OneView achieves **full ITP compliance** when you send data from your tracking endpoint under your domain (like `www.example.com/track`) using [Google Tag Manager Server-Side](/docs/guides/sending-events/backend/gtm-server), for which you manage the custom domain configuration through your Tag Manager Server provider.

***

### URL Parameters

<Check>
  **OneView achieves full LTP compliance** when you:

  * Use `utm_source` **parameters** in your campaigns (matching the ones you configured in your OneView workspace)
  * Enable [Enhanced Conversions](/docs/platform/features/delivery/enhanced-conversions) for your Media Partners
</Check>

<Info>
  **Understanding link decorators:**

  When you click on an ad, the redirect URL often includes parameters ("*link decorators*") such as:

  * `domain.example/landing?gclid=123abc` (from Google Ads)
  * `domain.example/landing?fbclid=456def` (from Facebook/Meta)
  * `domain.example/landing?msclkid=789ghi` (from Microsoft Ads)

  When these known **URL parameters** (i.e. `gclid`, `fbclid`, `msclkid`) are detected in the URL on your website, they are used as a trigger to set advertising cookies:

  * as **Regular cookies** by javascript (e.g. via **GTM Web**)
  * as **HTTP cookies** by a server (e.g. via **GTM Server**)
</Info>

| Restriction                                                                     | Effect (Engineering)                                                                                                                                                                                                                                                      | Impact (Marketing)                                                                                                                                                                            |
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Parameter redaction**: *Detection of Cross-Site Tracking Via Link Decoration* | 🌐 ➡️ **Normal browsing**: Regular cookies expiration capped to **1 day**, if a tracking decorator (e.g. `gclid`, `fbclid`, `msclkid`) is detected in URL.<br /><br />🕵️‍♀️ ➡️ **Private/Incognito browsing**: Blacklisted decorators are stripped from URLs altogether. | 🌐 ❌ **Normal browsing**: Tracking data is lost after **24 hours** when using **client-side tracking**.<br /><br />🕵️‍♀️ ❌ **Private/Incognito browsing**: Tracking data is **always lost**. |

**Link Tracking Protection (LTP)** intentionally breaks traditional cookie-based tracking by modifying the fundamental browser mechanisms that make cookies work. Specifically:

* Capping regular cookie lifetime to **24 hours** when third-party link decoration (e.g., `gclid`, `fbclid`, `msclkid`) is detected
* Stripping URL parameters that ad tracking scripts rely on altogether (private browsing mode only)

OneView offers full LTP compliance for both **Normal browsing** and **Private browsing** modes.

#### Normal Browsing mode

OneView workspaces **are not affected** by LTP restrictions because the [cookieless advertising](/docs/platform/features/collection/cookieless-advertising) architecture saves Click ID information in your workspace, and not in users' browsers.

#### Private Browsing mode

OneView achieves LTP compliance through two complementary methods that work even when the browser, a plugin, or a VPN strips all tracking parameters:

1. **UTM-based attribution**: You can configure the `utm_source` you use in your Media Partners campaigns, so that if their click ID is unavailable, this parameter will be used to identify them instead.

2. **Enhanced Conversions**: When a source is identified via its `utm_source` (and both `ad_storage` and `ad_user_data` consents are granted), OneView sends data via Conversion API, without the need for a click ID.

Enhanced Conversions allow your Media Partners to close the loop ***on their end***, by matching the identifiers you provide to those among their own userbase. OneView uses [Identity Resolution](/docs/platform/features/processing/identity-resolution) to increase the match rate of your [Enhanced Conversions](/docs/platform/features/delivery/enhanced-conversions).

<AccordionGroup>
  <Accordion title="Which decorators are blocked by LTP?">
    <Danger>
      **Apple does not provide a public list of actively blocked decorators.**
    </Danger>

    However you can test if your parameters are blocked by visiting any webpage with **Safari** (in **Private Browsing** mode) with your tracking parameter appended to the URL (e.g. `https://www.example.com/landing?myparam=123`), and see if, **after the page is loaded**, the parameter is still present in the URL or not.
  </Accordion>

  <Accordion title="Can I use custom tracking templates to bypass LTP?">
    <Danger>
      **Circumventing browser privacy protections is not recommended.** Techniques like parameter renaming:

      * Violate your users' privacy expectations through active circumvention
      * Are trivial for browsers to block in future updates
    </Danger>

    **Mechanism:**

    It is possible to use custom [tracking templates](https://support.google.com/google-ads/answer/10070427) to rename blocked parameters (e.g., changing `gclid` to `mygclid` or `gcl`), to then rewrite the URL with the original parameters before sending it to OneView.

    **Why this is fragile:**

    Browsers currently block parameters primarily by name, but extending this to value-based detection is trivial. A click ID like `123456789.987654321` follows a distinctive, recognizable format regardless of whether it's named `gclid`, `mygclid`, or `my_tracking_param`.

    Browser vendors already maintain blocklists of **known tracking domains** and parameters. Applying pattern matching to detect renamed click IDs—*especially from known advertising referers*—requires minimal additional effort.
  </Accordion>
</AccordionGroup>

## How to implement ITP compliance with OneView

Configure your Google Tag Manager Server Container to receive events from your website. For reverse proxy configuration to ensure same-origin cookie compliance, consult your Tag Manager Server provider documentation (e.g., Google Cloud, Stape, Addingwell).