Foundations2026-10-28 4 min read

Cookies and Tracking Prevention Explained: First-Party vs Third-Party, Safari ITP, Ad Blockers and What Still Works in 2026

A clear explanation of how cookies underpin analytics and ad attribution, what first-party and third-party actually mean, how Safari's Intelligent Tracking Prevention and other browser protections shorten or block them, and the practical measures that keep measurement working.

Written by Atiqul Islam

Tracking & analytics specialist. 278+ GTM, GA4 and server-side tracking projects for clients in the US, UK and Australia.

Rather not do this yourself? I set this up for clients every week. Free 15-minute audit, no obligation.

Book a Free Audit

Every number in your analytics and every conversion attributed to an ad depends on a small file in the visitor's browser remembering who they are between page views and between visits. Browsers have spent a decade limiting those files. This guide explains how cookies underpin measurement, what each protection actually does, and the concrete measures that keep tracking working in 2026.

GA4 sets _ga, a first-party cookie holding a random client ID, so page views from the same browser are one user and sessions can be stitched. Google Ads sets _gcl_aw holding the click ID from the ad, so a conversion days later can be matched to the click. Meta sets _fbp for the browser and _fbc for the click. Without these, every visit is a new anonymous person and no conversion has a source.

First-Party and Third-Party

The distinction is about the domain that owns the cookie relative to the site in the address bar:

First-party: set for yourdomain.com while the visitor is on yourdomain.com. Analytics and conversion cookies are first-party.
Third-party: set for adnetwork.com while the visitor is on yourdomain.com, because a script or iframe from that network loaded. Used for cross-site profiles and some ad attribution.

Third-party cookies are blocked by default in Safari and Firefox. Chrome kept them, with user-facing controls, after abandoning its phase-out. Treat them as unavailable.

Note that "first-party" refers to the cookie's domain, not who set it. A cookie set by Google's script for your domain is first-party. That is how GA4 works at all.

Safari Intelligent Tracking Prevention

ITP is the strictest mainstream protection and the one that most affects attribution:

Third-party cookies blocked entirely.
First-party cookies set by JavaScript expire after seven days of no visits.
If the visitor arrived via a link decorated with known tracking parameters, including gclid and fbclid, JavaScript-set cookies expire after 24 hours.
Cookies set by the server via HTTP Set-Cookie are not subject to the seven-day cap, provided they are set from the site's own domain rather than a CNAME that resolves to a third party.
Link decoration itself can be stripped in some private browsing modes.

The practical result: a Safari user who clicks an ad on Monday and buys on Wednesday is often unattributed if your cookies are browser-set.

Firefox, Brave, Edge and Chrome

Firefox's Enhanced Tracking Protection blocks third-party tracking cookies and known trackers. Brave blocks most third-party requests and some first-party analytics by default. Edge has balanced protection on by default. Chrome retains third-party cookies by default with user controls, and private windows block them.

Ad Blockers

Browser extensions and network-level blockers use lists that match known tracking domains and scripts: googletagmanager.com, google-analytics.com, connect.facebook.net and so on. If gtm.js is blocked, no tag loads. Filter lists also increasingly target common first-party proxy paths, so server-side setups should use non-obvious paths.

Where visitors are asked, a meaningful share decline. Tags that respect consent do not set cookies for those visitors. Consent Mode lets Google model some of what is missing. Non-Google platforms get nothing from declined visitors.

What Still Works, and How to Build for It

1. Server-set first-party cookies

Route tags through a server-side GTM container on your subdomain and let it set _ga, _gcl_aw, _fbp and _fbc as HTTP cookies. They escape the seven-day cap on Safari and survive longer across the board. The Server-Side Tracking guide on this site covers setup.

2. Enhanced Conversions and Advanced Matching

When the cookie is gone, a hashed email or phone can still match the conversion to the user. Send user-provided data on every conversion. Google and Meta both rely on this increasingly.

3. Click ID capture on arrival

Store gclid, fbclid and UTMs in a first-party cookie and in hidden form fields the moment the visitor arrives, so the lead record carries them even if the browser cookie later dies. Offline conversion uploads then work regardless.

4. Consent Mode v2

Lets Google Ads and GA4 model conversions and behaviour for visitors who declined. Required in the EU and UK for ads features and useful everywhere.

5. Google Tag Gateway or first-party script serving

Serving gtm.js and collecting Google data through your own domain reduces blocking by generic lists. It does not help non-Google platforms.

6. Shorter funnels and faster conversions

Not a tracking fix, but a business one: the longer the gap between click and conversion, the more cookies die. Retargeting via email, where you own the identifier, is immune to all of this.

7. Accept a floor of invisible traffic

Some visitors will never be measured. Design reports around trends and relative performance, and reconcile against the source of truth, such as orders or CRM leads, rather than treating analytics as a census.

Checking Your Own Setup

In Safari, open the site from a link with ?gclid=test, then check the _gcl_aw cookie's expiry in Web Inspector. One day or seven days means browser-set; longer means server-set.
In Chrome's DevTools Application tab, list cookies for your domain and confirm _ga, _gcl_aw and _fbp are present after consent.
Run the site with a popular ad blocker enabled and see which requests are blocked in the Network tab.
Compare GA4 users to server logs or CDN unique visitors for a rough measure of the invisible share.

Outcome

Cookies are shorter-lived and more often blocked than most dashboards assume. Knowing exactly which protection does what lets you choose the right countermeasures, server-set cookies, hashed identifiers, click ID capture and consent modelling, and set honest expectations for what analytics can show.

Frequently Asked Questions

Are third-party cookies dead?

Safari and Firefox block them by default. Chrome retained them after dropping its phase-out plan, with user controls instead. Build as if they are unavailable, because for a large share of your visitors they already are.

What is the difference between first-party and third-party?

A first-party cookie belongs to the site in the address bar. A third-party cookie belongs to another domain loaded on that page, such as an ad network. GA4 and Google Ads conversion cookies are first-party; cross-site ad tracking cookies are third-party.

Why does Safari limit even first-party cookies?

Intelligent Tracking Prevention caps cookies set by JavaScript to seven days, and to 24 hours when the visitor arrived from a link with tracking parameters such as gclid. Cookies set by your server through HTTP headers are not capped the same way, which is why server-side tagging extends their life.

Do ad blockers block GA4?

Most block requests to Google's analytics domains and the gtm.js script. Server-side tagging on your own subdomain reduces this, but a blocker that stops GTM loading stops everything. Expect a share of visitors to be invisible regardless.

What does this mean for attribution windows?

A 30 day click-through window in Google Ads only works if the cookie that remembers the click lasts 30 days. On Safari with browser-set cookies it lasts a day or a week. Enhanced Conversions, server-set cookies and Consent Mode modelling exist to fill that gap.

Want This Done Right the First Time?

Book a free 15-minute audit call. I'll review your setup, show you what is broken, and tell you exactly what it takes to fix it.

Book a Free Audit Message on WhatsApp

Related Guides

GA4 Cross-Domain Tracking: Keep One Session Across Your Site, Checkout, Booking and Payment Domains
How cross-domain measurement works in GA4 and Google Ads, when you need it, how to configure the domain list and the Conversion Linker, how to handle subdomains, iframes and redirects, and how to verify the linker parameter and attribution.
GA4 Key Events and Google Ads: When to Import GA4 Key Events as Conversions, When to Use Native Tags, and How to Avoid Double Counting
How key events work in GA4, how the Google Ads import works and what it is good for, the differences between imported and native Google Ads conversions in attribution, speed and Enhanced Conversions, and a decision rule for which to use for each conversion.
GA4 User ID and User Properties: Cross-Device Measurement for Logged-In Users Without Breaking Privacy
How to send a User ID and user properties to GA4 through GTM when visitors log in, what it changes in reporting identity and cross-device journeys, the rules on what the ID may and may not be, how to keep it out of URLs, and how to use it with BigQuery and audiences.