Full Answer

Safari's tracking protection operates across three interlocking layers — Intelligent Tracking Prevention for cookies and storage, Advanced Tracking and Fingerprinting Protection for URL parameter stripping and network blocking, and Advanced Fingerprinting Protection for JavaScript API restrictions — and each layer is specifically engineered to prevent websites from detecting its presence.

The detection signals that do exist are coarse. A third-party cookie test reveals whether cookies are blocked in cross-site context, but since Safari 13.1 blocks them universally, the test only confirms the browser is Safari — not which protections are active. The Storage Access API behaves differently in Safari than in Chrome, which leaks browser identity but not protection configuration. ITP Debug Mode exists on macOS for developers testing their own sites, but it is unavailable programmatically and irrelevant in production.

What remains invisible is the most consequential layer. Safari's on-device machine learning classifier decides which first-party domains receive reduced cookie lifetimes — from 7 days down to 24 hours — based on cross-site tracking behaviour patterns. No API exposes this classification. Advanced Fingerprinting Protection, which ships as default-on in Safari 26, blocks known fingerprinting scripts from accessing high-entropy APIs like Canvas readback and WebGL parameters. The website receives data that looks normal but carries zero identifying information.

For WooCommerce stores, the practical conclusion is straightforward: assume every Safari session operates under full protection and build tracking that works regardless. Server-side event capture on a first-party subdomain bypasses the detection problem entirely because it operates at the HTTP request layer before any client-side restriction applies.