Server-side tracking on a first-party subdomain can still lose cookie lifetime in Safari when the subnet does not match.

October 16, 2026 · 13 min read

Trade coverage on October 16, 2026 returned to a failure mode server-side tagging was supposed to fix. PPC Land summarized an analysis of Safari capping server-set cookies at seven days when a tracking subdomain shares your registrable domain but not your network. The headline lands the same week Italy's email-pixel deadline and Safari 27 domain blocks are still in ad ops inboxes. This story is quieter than a blocklist, but it hits the collector identity your CAPI worker assumes is stable.

The industry pitch for server-side Google Tag Manager and hosted containers is durability: move the tag off the browser, set first-party cookies in the HTTP response, and stop losing client ids to script-writable caps. WebKit's published tracking prevention text already says Intelligent Tracking Prevention detects third-party CNAME cloaking and third-party IP address cloaking requests and caps the expiry of any cookies set in the HTTP response to seven days. That sentence is not new. What keeps breaking production is the gap between same-site branding and same-network serving.

Same-site is not same-origin. Your storefront at https://shop.example.com and your collector at https://sst.example.com share example.com, so marketers call both first party. Safari still treats them as different hosts. When the collector's resolved address is mostly different from the main document's address, the Set-Cookie on the tracking response can inherit a seven-day ceiling even if you configured a one-year Max-Age in the container. Eight days later the returning buyer looks like a stranger to GA4, Meta, and any platform that keys off the cookie your server wrote.

What WebKit actually caps

WebKit defines third-party CNAME cloaking as a first-party subresource that resolves through a CNAME that differs from the first-party domain and differs from the top frame host's CNAME, if one exists. The documentation includes a scenario table: when the first-party host has no cloaking but a first-party subdomain points at tracker.example, capped cookie expiry applies. That is the shape of many sGTM deployments: a dedicated subdomain aimed at a vendor or hosting region, not at the same CDN front door as www.

Safari 16.4 extended the seven-day rule to cookies set through HTTP responses when cloaking is detected, closing the workaround where server-set cookies escaped script caps. WebKit pull request 5347, filed for bug 246477, explains why IP comparison exists: sites can use direct A or AAAA records instead of CNAME mapping to cloak third-party requests as first party. The mitigation compares the response IP to the main resource IP using matching subnet mask length. The patch notes the minimum matching subnet mask length chosen as half the address length: 16 for IPv4 and 64 for IPv6.

Those numbers are WebKit engineering text, not a marketing blog chart. They matter because a storefront on one CDN PoP and an sGTM container on another provider's anycast range often share fewer than sixteen leading IPv4 bits. The cookie is still first-party by name. The network story is third party. ITP applies the same seven-day cap you thought you avoided by turning off client-side document.cookie for the identity.

Why server-side GTM did not fix Safari checkout

A typical migration leaves the page tag pointed at sst.example.com. The browser POSTs a small event payload. The container responds with Set-Cookie for _ga, FPID, or a server-managed session id, then forwards to Meta, Google, or Pinterest endpoints. In Chrome the architecture looks clean. In Safari the identity cookie may expire on day seven of browser use regardless of the Max-Age header your container emits.

The failure shows up as attribution drift, not as a 4xx from the vendor. Meta Events Manager still receives CAPI events, but external_id and fbp matching degrade when _fbc or the browser id cookie aged out. Google Ads enhanced conversions may still hash email while click-through paths that depended on gclid stored in a first-party cookie lose the join. OpenAI's measurement pixel documents connect-src to bzr.openai.com and oppref capture in first-party storage; a seven-day cap on that storage breaks the same click-to-order_created chain ChatGPT ads posts describe.

This is not Safari 27 blocking adsrvr.org on the sync path, which rtblint.org covered as a bidstream identity loss. It is the collector on your own subdomain losing permission to hold long-lived state. Blocklists and cloaking caps stack. A site can pass a CMP audit while Safari silently rewrites cookie lifetime on the server response from sst.

Two hosts, one registrable domain

Same registrable domain, different subnets. The container log shows 200; Safari still caps expiry.

Document:  https://www.example.com/product
           (IPv4 network A from CDN edge)

Collector: https://sst.example.com/g/collect
           (IPv4 network B from tag host)

WebKit: matchingNetMaskLength(A, B) < 16  →  third-party IP cloaking
HTTP response Set-Cookie: Max-Age=31536000  →  capped to 7 days in Safari

Before you paste container debug output into a ticket, reproduce in Safari Web Inspector storage. Find the cookie written by the collector response. If expiry lands roughly one week out while your template specifies a year, you are in cloaking mitigation, not a misconfigured tag priority.

Moving the public route to a path on the primary host, for example https://www.example.com/metrics, changes the origin the browser uses for the fetch. Google documents tag gateway and same-origin serving paths for similar reasons. The fix is routing architecture, not a new hashing algorithm on the CAPI body. Reverse proxies must forward Set-Cookie intact; breaking attributes during rewrite recreates a different class of bug.

Vendor blogs selling Cloudflare Workers for same-origin tracking describe the same WebKit rules PPC Land cited on October 16. Treat product posts as implementation hints, not as the primary. The cap rule is Apple's published ITP behavior plus the WebKit patch history.

What breaks on the CAPI and pixel wire

Browser pixels and server CAPI are often deduped on event_id and a browser identifier. When the browser identifier expires, deduplication splits. You may double count or under-attribute depending on which side arrives first. Server-only pipelines that never persisted click ids in your database still fail when the pixel side lost oppref or gclid in cookie storage before checkout.

Consent strings from the CMP do not travel with server-set cookies. A denied ad_storage state does not explain a granted cookie that Safari capped. Teams debugging Italian email pixel opt-outs this week should still run this Safari check on web collectors; ESP consent and browser cookie caps are separate wires, as the October 15 pixellint.org Italy post argued.

Hybrid ChatGPT measurement depends on pixel plus Conversions API with shared ids. A seven-day collector cookie does not stop bzr.openai.com from accepting POSTs. It stops click references from surviving a considered purchase cycle longer than a week. Platform click windows and cookie caps are different knobs; conflating them sends engineers to tune attribution windows when the host routing is wrong.

Checklist for measurement engineers

Map every collector hostname: sGTM subdomain, tag gateway path, pixel CDN host, and compare DNS A/AAAA to the main storefront.
In Safari, inspect cookie expiry on the identity set by the collector HTTP response, not only document cookies from JavaScript.
Trace one paid click through day eight: does returning traffic still send the same client id to GA4 and Meta?
If subnets differ, prototype same-origin path routing on the primary host before rewriting CAPI hashing.
Confirm reverse proxies forward Set-Cookie without stripping Domain or Max-Age.
Separate tickets for Safari 27 domain blocks (sync) versus cloaking caps (collector cookies).
Validate production CAPI JSON after routing changes; shape lint does not prove cookie lifetime.

ITP detects third-party CNAME cloaking and third-party IP address cloaking requests and caps the expiry of any cookies set in the HTTP response to 7 days.

WebKit Tracking Prevention

What to do before the next platform migration

Run a two-host inventory workshop with whoever owns DNS and whoever owns the GTM container. Most stacks know the www certificate; fewer document where sst points after a re-platform. Cloudflare in front of marketing while the container lives on a specialist host is exactly the split WebKit's IP heuristic targets.

Pixellint is not affiliated with Apple or Google. Use the CNAME cloaking doc to reason about hostname patterns, then validate collector payloads after you change routes. Passing lint on a Meta or Google body does not extend Safari cookie caps.

October browser news will keep stacking: domain blocks, email pixel law, AI surface measurement. This cap predates Safari 27 and still explains silent new-user inflation on iOS web. Fix the public collector origin first, then reopen match-quality and Event Coverage tickets.

If same-origin routing is not yet in production, document the seven-day assumption in your test plans so finance does not treat Safari iOS web as comparable to Chrome desktop when reviewing ROAS.

Sources

Contract pages

The dated argument is above. These pages are the field lists.

Read the CNAME cloaking guide Docs