Cookie lifespan reference
The expiry you set on a cookie is a request, not an instruction. Safari's Intelligent Tracking Prevention caps cookies set through JavaScript at seven days; all major browsers now cap any cookie at 400 days under RFC 6265bis; and third-party cookies are blocked outright in Safari and Firefox. The practical consequence is that a cookie set with a two-year expiry in your tag configuration may live seven days in the browser where a third of your traffic sits, and nothing anywhere reports that.
Free30 minutesNo obligation
Cookie lifespans · what breaks
Where teams get this wrong — Cookie lifespans
- 01
Believing the expiry you set
It's a request. The browser decides, and Safari decides differently from Chrome.
- 02
Testing only in Chrome
Chrome doesn't apply the seven-day cap. The problem is invisible there.
- 03
Assuming a long expiry means long attribution
It means nothing if the browser truncated it.
Cookie lifespans · the fix
What a correct implementation looks like — Cookie lifespans
Cookies set in an HTTP response
From your own subdomain, where the JavaScript cap doesn't apply.
Lifetimes inside 400 days
Requesting longer is silently truncated.
Persistence tested in Safari
On a real device, after a real gap.
No dependence on third-party cookies
They're blocked or going.
Cookie lifespans · architecture
What caps what — Cookie lifespans
Browser behaviour changes without much notice. Everything here is accurate as we last verified it and should be re-checked before you build on it.
- 1
Safari, JavaScript-set cookies
Capped at 7 days by ITP. The constraint that breaks most attribution on longer consideration windows.
- 2
Safari, link-decorated cross-site navigation
Can be capped more aggressively still. Cross-domain journeys are hit hardest.
- 3
Safari and Firefox, third-party cookies
Blocked by default. Not something to build on.
- 4
All major browsers, any cookie
Capped at 400 days under RFC 6265bis. Requesting longer is truncated.
- 5
Server-set first-party cookies
Set in an HTTP response from your own subdomain. Not subject to the JavaScript cap.
- 6
Analytics and platform cookies
Each vendor sets its own default lifetime, and all of them are subject to the browser caps above regardless.
Cookie lifespans · diagnose
Common mistakes and how to validate each — Cookie lifespans
Ordered by how often we find them. Each one has a specific check rather than a general instruction to be careful.
- 01
Configuration read instead of the browser
Open developer tools and read the actual expiry. They differ.
- 02
Chrome-only testing
Repeat in Safari on a real device.
- 03
No elapsed-time test
Wait eight days and check again. Almost nobody does this, and it's the only proof.
- 04
Assuming first-party means unlimited
The 400-day cap applies to everything.
- 05
Cookies set before consent
Check what exists on first load with consent denied.
Cookie lifespans · prove
How to prove your implementation is right — Cookie lifespans
Against your own records and a live payload, not against a preview screen.
Source of truth
the actual cookie expiry read in the browser, on a real device
- Actual expiry read in Safari, not the configured value.
- Persistence confirmed more than seven days after being set.
- Cookies confirmed set via Set-Cookie where server-side was used.
- Nothing set when consent is denied.
- Checked on a live conversion, not in preview mode.
- Reconciled over a fully closed window, matched per record.
- Re-checked 30 days later.
Cookie lifespans · free audit
What we check in the free audit
- Configuration read instead of the browser
- Chrome-only testing
- No elapsed-time test
- Assuming first-party means unlimited
- Cookies set before consent
Checked against
the actual cookie expiry read in the browser, on a real device
Free30 minutesNo obligation
Cookie lifespans · when not to buy
What this reference deliberately leaves out — Cookie lifespans
Stated openly, because a reference that's silent about its own gaps is the dangerous kind.
- Browser tracking-prevention rules change frequently and without much announcement. Re-verify before relying on any of this.
- The exact conditions triggering Safari's more aggressive caps aren't fully documented publicly, so we've described the general behaviour rather than guessing at thresholds.
- Individual vendor cookie defaults are published by those vendors and change; we've deliberately not reproduced a table of them.
- Vendor documentation is the authority, not this page. Where the two disagree, the vendor is right and we'd like to know so we can correct it.
- Parameter names and behaviour change. Anything here is accurate as we last verified it; verify against the current documentation before you rely on it for a build.
Cookie lifespans · what we deliver
The checklist — Cookie lifespans
Read the actual expiry in the browser
Not the value in your configuration.
Test in Safari specifically
Chrome will not show you the problem.
Wait more than seven days and re-check
The only test that proves anything.
Confirm cookies are set via Set-Cookie
Rather than document.cookie, where it matters.
Check nothing is set before consent
Lifetime is irrelevant if it shouldn't exist.
Pricing
Pick the package that fits your ad spend
Browser-side starter
$400One-time fee · lifetime ownership
Repairs and verifies your existing browser-side setup against this reference, on a live conversion.
- Implementation checked against the spec
- Verified on a live conversion
- Reconciled against your own records
- Written handover
1st-party server-side
Recommended$800One-time fee · most popular
Money events sent from your own records through a first-party container on your subdomain, built to this specification.
- First-party server container on your own subdomain
- Events from your records, not the browser
- Deduplicated on a shared event ID at every destination
- First-party cookies beyond Safari's 7-day cap
- 95%+ accuracy and 8+ Meta EMQ, guaranteed in writing
Full 1st-party stack
$1,800One-time fee · lifetime ownership
Every paid channel server-side plus the offline loop, documented to this standard.
- Everything in 1st-party server-side
- Pinterest, Snapchat, Reddit and LinkedIn CAPI
- CRM and offline conversion loop
- Refunds and cancellations corrected wherever each platform allows it
- Monitoring so the next break surfaces in days
FAQ
Cookie lifespans questions, answered
Safari's ITP caps cookies set through JavaScript at seven days regardless of what you requested. It's the most common cause of lost attribution on longer consideration windows.
400 days, under the limit browsers apply per RFC 6265bis. Anything longer is silently truncated.
The seven-day JavaScript cap, yes, because they're set differently. The 400-day maximum still applies.
Set the cookie, wait more than seven days, and check it in Safari on a real device. Chrome won't reproduce the problem.
Free · 30 min
Find out how long your cookies really last
WhatsAppFree30 minutesNo obligation
