Safari holds 19-27% of global browser market share. Every WooCommerce customer using Safari who took more than 7 days from first click to purchase is completely invisible to your attribution model. Not misattributed. Invisible. Your paid ad gets zero credit and that sale appears as Direct or Organic traffic.

This is Intelligent Tracking Prevention (ITP) — Apple’s browser privacy technology — and it’s been silently eating your ad attribution since 2020. Most WooCommerce store owners have no idea it’s happening.

What ITP Does to Your WooCommerce Cookies

When a visitor clicks your Google or Facebook ad and lands on your WooCommerce store, your analytics tools set a cookie in their browser. That cookie is what connects the click to the eventual purchase. Standard attribution windows are 7, 14, 28, or 30 days — because customers often research before buying.

ITP caps JavaScript-set cookies at 7 days. Full stop. On day 8, the cookie is deleted. Safari has no memory that the customer ever clicked your ad. When they come back to buy, the sale registers as Direct traffic — as if they typed your URL from memory.

Your best-researched customers, the ones who compared options and came back — those are the ones ITP erases.

Every browser-based tracking tool is affected: GA4’s measurement tag, Facebook Pixel, Google Ads tag, and any analytics plugin that writes cookies via JavaScript. None of them can set cookies that survive ITP’s 7-day hard cap.

You may be interested in: Cross-Device Attribution Gap in WooCommerce

How Big Is the Attribution Gap?

Let’s put numbers on this. Safari’s global market share sits between 19 and 27% — call it roughly 1 in 4 visitors. Browser restrictions already prevent 20-40% of events from reaching Meta or Google. ITP compounds that specifically for Safari sessions.

Consider your typical WooCommerce customer journey. Someone discovers your store via a Facebook ad, browses, leaves, compares alternatives, reads reviews, and returns 10 days later to buy. That’s a normal considered purchase. Under ITP: Facebook gets no conversion signal. Google Ads gets no conversion signal. Your GA4 revenue report credits Direct traffic.

Over 65% of purchase journeys span more than one device before checkout, according to WooCommerce reporting data. When those journeys include Safari — and they do — cross-device attribution becomes doubly broken: ITP deletes the cookie, and the device switch makes re-identification impossible.

For stores running paid traffic to audiences with typical 10-30 day consideration periods — furniture, electronics, fashion, B2B software — the ITP gap is not marginal. It is structural. Your ROAS reports are understated. Your organic and direct numbers are overstated. Budget decisions are being made on corrupted data.

Why Standard Fixes Don’t Work

The instinctive responses to ITP don’t solve it:

• Extending attribution windows in GA4: GA4 can look back 30, 60, or 90 days — but only if the original cookie still exists. If ITP deleted it on day 8, there is nothing to look back at.
• Using UTM parameters: UTMs survive in the URL, but once the visitor leaves and returns organically, the UTM is gone. ITP doesn’t affect UTMs — the return journey does.
• Consent Mode: Consent Mode handles consent, not browser storage restrictions. ITP operates independently of what users consent to.
• WordPress cookie plugins: Any plugin that sets cookies via JavaScript is subject to ITP’s 7-day cap. The language doesn’t matter. The mechanism does.

The root cause is where the cookie is being set. JavaScript-set cookies are what ITP targets. That’s not a configuration problem. It’s an architectural one.

You may be interested in: WooCommerce Attribution Is Just Last-Touch — Why Multi-Channel Marketing Can’t Be Measured Natively

The Fix: First-Party Server-Side Cookies

ITP’s 7-day cap applies specifically to cookies set by JavaScript. It does not apply to cookies set via HTTP Set-Cookie headers from a server on your own subdomain.

This is the architectural distinction that matters:

• JavaScript cookie (ITP-affected): Your page loads, a script runs, a cookie is written. Safari sees this as cross-site tracking behaviour and caps it at 7 days.
• Server-side first-party cookie (ITP-exempt): A request goes to your own subdomain (e.g., data.yourstore.com), your server responds with a Set-Cookie header. Safari treats this as a genuine first-party interaction. Full cookie lifespan. No 7-day cap.

First-party cookies set server-side via HTTP headers on your own subdomain are outside ITP’s scope entirely.

This is how Transmute Engine™ handles attribution persistence. Events from your WooCommerce store pass through a first-party Node.js server running on your own subdomain. The server sets persistent identifiers via HTTP headers — not JavaScript. Those identifiers survive Safari’s ITP restrictions with no 7-day limit.

The result: a Safari visitor who clicked a paid ad 14 days ago and returns to purchase today gets correctly attributed. Your Facebook CAPI, Google Ads Enhanced Conversions, and GA4 all receive the accurate conversion signal.

What Accurate Safari Attribution Actually Changes

When ITP-immune attribution is in place, a few things shift:

Your paid channel ROAS improves — not because performance changed, but because you’re now counting conversions that were always happening but previously invisible. Campaigns that looked marginal may reveal themselves as strong performers when 10+ day Safari conversions are included.

Direct traffic drops. That inflated direct number shrinks as Safari conversions find their correct channel home. If your direct traffic is unusually high, ITP is likely a contributor.

75% of marketers use multi-touch attribution models, but those models only work if the touchpoint data survives long enough to be connected. Server-side first-party cookies make multi-touch attribution factually viable for Safari — which is to say, for roughly 1 in 4 of your visitors.

Attribution accuracy is not an analytics hygiene concern. It’s a budget allocation concern. When your data is wrong, your channel mix decisions are wrong. Fixing ITP attribution is fixing the foundation your marketing strategy stands on.

Key Takeaways

• ITP caps JavaScript cookies at 7 days — any WooCommerce customer who takes longer than a week to convert in Safari is invisible to browser-based tracking.
• Safari affects 19-27% of your visitors — this is not an edge case. It is a structural attribution gap.
• UTM parameters, consent mode, and cookie plugins do not fix ITP — they do not address the mechanism ITP targets.
• Server-side first-party cookies set via HTTP headers on your own subdomain are ITP-exempt — full lifespan, no browser interference.
• Transmute Engine sets identifiers this way by default — your WooCommerce attribution data survives Safari from day one.

Safari is not going to relax ITP. Apple’s direction has been consistent and the restrictions have only tightened since 2020. The question is not whether ITP will affect your WooCommerce store — it already does. The question is whether your attribution data will ever reflect the purchases that are actually happening. Server-side first-party tracking is the only fix that works at the browser level.