Full Answer

The cap keys off how a cookie is written, not who owns the domain. Anything your browser sets through document.cookie is client-side by definition, so Safari treats the result as tracking whether it feeds GA4, Meta, or your own database. Seven days after the last visit the identifier is gone, and the shopper who comes back on day eight is counted as a brand-new visitor with no history attached.

That timer sits underneath every measurement window longer than a week. Meta's default 7-day click window survives it by a hair; Google Ads' 30-day window, subscription renewals, considered purchases and any repeat-buy cycle beyond seven days do not. The data is not delayed or sampled, it is deleted, so no reporting change or attribution model recovers it afterwards.

What survives is a cookie the server sets in an HTTP response, because ITP 2.1 exempted Set-Cookie headers from the client-side cap. The exemption is architectural rather than cosmetic: Safari 16.4 added CNAME-cloaking detection, so a tracking subdomain that resolves to a vendor's IP range is pushed back to the seven-day cap even though the header came from the server. Genuine first-party infrastructure keeps the full lifetime; a rented subdomain pointed at someone else's servers does not, which is why plenty of 'server-side' setups still decay in a week.