Intelligent Tracking Prevention 1.1

In June of last year, we announced Intelligent Tracking Prevention, or ITP. ITP is a privacy feature which detects domains that have the ability to track the user cross-site and either partitions or purges the associated website data.

The biggest update to ITP so far is the introduction of the Storage Access API which provides a mechanism for embedded third-party content to get out of cookie partitioning through user interaction. In addition to the Storage Access API, ITP 1.1 includes two behavior changes described below.

Partitioned Cookies No Longer Persisted to Disk

With ITP 1.1, all partitioned cookies are treated as session cookies and are not persisted to disk.

Domains that have their cookies partitioned by ITP have a way to get access to their non-partitioned cookies through the Storage Access API. Therefore there is no longer a need to persist partitioned cookies across browsing sessions.

Cookies Blocked If They Will Be Purged Anyway

ITP’s purging of cookies and other website data happens once an hour for performance reasons. In between purges, ITP 1.0 would partition cookies for domains with a pending purge to make sure there were no gaps where cross-site tracking could happen. This caused a situation where cookies were purged shortly after being created, potentially confusing servers.

With ITP 1.1, domains with a pending purge will not be able to set new cookies and their existing cookies are not sent in requests. This makes the transition from partitioned cookies to purged cookies distinct and easier to handle for developers.

Feedback

These updates to Intelligent Tracking Prevention are available in Safari 11.1 on iOS 11.3 beta and macOS High Sierra 10.13.4 beta, as well as in Safari Technology Preview. Please report bugs through bugs.webkit.org, or send feedback on Twitter to the team @webkit, or our evangelist @jonathandavis. If you have technical questions about these changes, you can find me on Twitter @johnwilander.