Why is my first-party cookie not being set?
A cookie fails to persist for one of four reasons: it's scoped to the wrong domain so it isn't sent back on subsequent requests, it's missing the Secure or SameSite attributes a modern browser now requires, consent is blocking it, or it's being written by JavaScript in Safari where Intelligent Tracking Prevention caps its life at seven days regardless of the expiry you set. That last one is the case most people misdiagnose, because the cookie is set correctly and simply disappears later.
Free30 minutesNo obligation
First-party cookie not being set · what breaks
What this looks like when it's happening to you — First-party cookie not being set
- 01
Attribution lost for returning visitors
Anyone whose consideration period exceeds a week.
- 02
Cookie present on set, gone on return
The signature of the ITP cap.
- 03
Works in Chrome, fails in Safari
Which narrows it to ITP immediately.
First-party cookie not being set · the fix
What changes once it's fixed — First-party cookie not being set
Attribution survives the consideration period
Rather than expiring before the purchase.
Consistent behaviour across browsers
Safari stops being a blind spot.
Returning visitors recognised
Which is what makes multi-visit attribution possible at all.
First-party cookie not being set · architecture
Why your conversion data was wrong in the first place
Fixing this specific fault is worth doing. But it is worth understanding why it happened, because the same underlying weakness produces a different symptom every few months — and the reason your conversion data is wrong is almost never the tag itself.
- 1
Your conversion depends on a browser that is being restricted on purpose
A browser-side tag has to survive the page loading, the visitor staying, the script executing and the request leaving. Every one of those is now contested. The order in your database is certain; the browser event reporting it is not, and that gap is where wrong numbers come from.
- 2
Safari caps the cookie your attribution depends on
Intelligent Tracking Prevention limits cookies written by JavaScript to seven days, whatever expiry you set. Any customer who takes longer than a week to decide comes back as a stranger, so the sale is recorded and credited to nobody. A cookie your own server writes in an HTTP response is not subject to that cap — which is the single largest practical difference between browser-side and first-party server-side tracking.
- 3
Ad blockers remove the tag before it can run
A blocked pixel does not error, retry or warn anyone. The visitor buys, the order lands in your store, and no platform ever hears about it. First-party events sent from your own subdomain aren't filtered the same way, because they are not a third-party request.
- 4
Consent banners stop tags, sometimes when they didn't need to
Where consent is genuinely required, losing the event is correct. What is not correct — and what we find repeatedly on US-majority accounts — is an EU-style prior-consent banner applied to every visitor, discarding conversions no law asked you to discard. A server container enforces the real decision at the container rather than hoping each vendor script honours a flag.
- 5
The checkout can end somewhere your tag isn't
Wallets and hosted payment pages can be abandoned after the money moves. The customer paid; the confirmation page never rendered; the browser event never fired. Sending the purchase from the order record instead means the conversion arrives whether or not anyone came back to your site.
- 6
What that adds up to
Each of these is a separate route to first-party cookie not being set, and they compound. First-party server-side tracking doesn't patch them one at a time — it moves the money event off the browser entirely, so the order in your backend is what gets reported. That is why we reconcile against your own order records and put 95%+ accuracy in writing: with the event sourced from the order, the number is checkable rather than hopeful.
First-party cookie not being set · normal or broken
Some of this is supposed to happen — First-party cookie not being set
Half the time nothing is broken and the number is being read wrong. Knowing which is which stops you paying to fix something that was never a fault.
Normal, not a fault
Cookies expiring in Safari after seven days
If they're JavaScript-set, that is ITP working as designed — not a bug in your setup.
No cookie where consent is denied
Correct behaviour.
Actually broken
ITP capping JavaScript-set cookies at seven days
In Safari. The expiry you set is ignored.
Wrong domain scope
Set on a subdomain and not sent back on the apex, or the reverse.
Missing Secure or SameSite attributes
Modern browsers reject cookies that don't declare them correctly.
Consent blocking it
Correct behaviour where required, and worth confirming before treating it as a fault.
First-party cookie not being set · diagnose
How we find out why is my first-party cookie not being set
Always in this order. Each step eliminates a class of cause, so by the last one there is usually a single explanation standing.
- 01
Check whether the cookie appears at all on set
Absent immediately and absent later are different problems.
- 02
Return after eight days in Safari specifically
This is the check that identifies the ITP cap.
- 03
Inspect domain, path, Secure and SameSite
A wrong scope looks identical to a missing cookie.
- 04
Test with consent denied and granted
To separate a compliance behaviour from a fault.
- 05
Compare Safari against Chrome
A browser-specific failure narrows the cause immediately.
First-party cookie not being set · prove
How we prove it's actually fixed — First-party cookie not being set
The tag firing again proves the tag fires. These prove the numbers are right.
Source of truth
The cookie's presence on a real return visit, per browser
- Cookie confirmed persisting beyond seven days in Safari on a real device.
- Domain scope confirmed covering every subdomain in the journey.
- Secure and SameSite attributes set correctly.
- Absence under denied consent confirmed as intended behaviour.
- Reconciled against the cookie's presence on a real return visit, per browser for a fully closed window, matched on ID rather than on totals.
- No record counted twice, checked across the whole window rather than spot-checked.
- The same check repeated 30 days later, because a fix that holds once and drifts is the harder failure to catch.
First-party cookie not being set · free audit
What we check in the free audit
- Check whether the cookie appears at all on set
- Return after eight days in Safari specifically
- Inspect domain, path, Secure and SameSite
- Test with consent denied and granted
- Compare Safari against Chrome
Checked against
The cookie's presence on a real return visit, per browser
Free30 minutesNo obligation
First-party cookie not being set · when not to buy
When you don't need us for this — First-party cookie not being set
Most of these you can do yourself, and we would rather you did.
- Your median visit-to-purchase interval is under seven days, where the cap costs you little.
- You can check domain scope and attributes in the browser's storage panel yourself.
- Almost none of your traffic is Safari, where this is largely an academic problem.
First-party cookie not being set · what we deliver
What we do about it — First-party cookie not being set
Cookie set in an HTTP response, server-side
Not subject to the seven-day cap that applies to JavaScript-set cookies.
Correct attributes
Secure, SameSite, and a domain scope that covers the subdomains you actually use.
Consent respected properly
So it's blocked where required and set where it isn't.
Pricing
Pick the package that fits your ad spend
Browser-side starter
$400One-time fee · lifetime ownership
We fix the fault in your existing browser-side setup and verify it on a live transaction. Honest disclosure: this repairs what you have, it does not make it durable. If you spend $1K+/month on paid media, the fault will recur the next time Safari, a consent banner or a checkout change moves under you — the server-side tier is what stops that.
- Root cause found and fixed, not worked around
- Verified on a live transaction, not in preview
- Reconciled against your own order records
- Written handover documenting what changed and why
1st-party server-side
Recommended$800One-time fee · most popular
The tier that removes the whole class of failure rather than this instance of it. Your money events stop depending on the browser: they are sent from your order records through a first-party server container on your own subdomain, so iOS, ad blockers, consent banners and interrupted payment redirects can no longer take them away. Built in 2–4 days. You own the stack outright — no monthly SaaS.
- First-party server container on your own subdomain
- Purchases sent from your order records, not the browser
- Meta, Google, TikTok, Microsoft and LinkedIn all fed server-side
- Deduplicated on a shared event ID, verified at every destination
- First-party cookies beyond Safari's 7-day cap on JavaScript-set cookies
- 95%+ conversion accuracy and 8+ Meta EMQ, guaranteed in writing
Full 1st-party stack
$1,800One-time fee · lifetime ownership
Every paid-media channel server-side, end to end, plus the offline loop. For advertisers whose spend makes an attribution leak more expensive than the build. Pay once, own everything.
- Everything in 1st-party server-side
- Pinterest, Snapchat, Reddit and LinkedIn CAPI
- CRM and offline conversion loop, so closed revenue reaches bidding
- Refunds and cancellations reversed at every destination
- Klaviyo identity stitching, BigQuery and Looker Studio
- Monitoring, so the next break surfaces in days rather than a quarter
FAQ
First-party cookie not being set questions, answered
Intelligent Tracking Prevention caps the lifetime of cookies written by JavaScript at seven days, regardless of the expiry set. Cookies written by your own server in an HTTP response are not subject to that cap.
At least as long as your median visit-to-purchase interval. 400 days is the maximum browsers now honour.
Yes. A SameSite=None cookie without Secure is rejected outright.
It fixes the ITP cap specifically, because the cookie is then set in an HTTP response. It doesn't change consent or domain-scope problems.
Free · 30 min
Get first-party cookie not being set diagnosed properly
Free30 minutesNo obligation
