Full Answer

Safari's ITP was designed to prevent cross-site tracking, but its implementation affects all JavaScript-set cookies equally because the technical mechanism for analytics and advertising tracking is identical.

GA4's tracking tag executes JavaScript in the browser, creates a unique client identifier, and stores it using document.cookie. Meta Pixel does the same with _fbp. A hypothetical advertising tracker doing cross-site surveillance would use the exact same mechanism. Safari cannot inspect the cookie's purpose — it can only observe the method of creation and the behavior pattern of the domain that set it.

This is why the restriction applies to analytics cookies that are not involved in cross-site tracking. The GA4 _ga cookie is a first-party cookie that only tracks behavior on your own site. It does not enable cross-site tracking. But it is set by JavaScript, which is the same mechanism that cross-site trackers use, so it receives the same seven-day restriction.

The distinction between harmless analytics and invasive tracking is a policy judgment that Safari deliberately chose not to make at the cookie level. Apple's position is that the browser should not be in the business of evaluating whether each individual cookie serves a legitimate purpose — instead, it restricts the mechanism that enables tracking and leaves it to site operators to adopt server-side alternatives for legitimate measurement.

The practical solution is the same regardless of whether the cookie serves analytics or advertising: set it from the server via HTTP headers instead of from JavaScript. Server-set first-party cookies retain their full configured lifespan because they are created through a mechanism that third-party scripts cannot exploit for cross-site tracking.