Practical Guide: Bypassing ITP with First-Party Server Cookies

Safari's ITP caps JavaScript-set cookies at 7 days. This means document.cookie = '_ga=...; max-age=63072000' gets silently capped to 7 days regardless of the max-age value. After 7 days without a visit, the user appears as 'new' in your analytics.

Server-side GTM solves this by setting cookies via Set-Cookie HTTP response headers from your first-party domain. When the browser receives Set-Cookie from collect.yourdomain.com (your first-party subdomain), Safari treats this as a genuine first-party cookie — because it is.

In your sGTM container, add a cookie-setting tag (a Community Template Gallery template, or your own template using the setCookie API) that fires on every GA4 event. Configure it: cookie name = '_ga_server', value = the client_id from the incoming request, domain = '.yourdomain.com', path = '/', SameSite = Lax, Secure = true, HttpOnly = false (needs JS read access), Max-Age = 34560000 (400 days).

The critical technical requirement: your collection endpoint must be on the same registrable domain as your site. A subdomain (collect.yourdomain.com) works. A separate domain (yourdomain-analytics.com) does not. Use an A record, not a CNAME, if your DNS provider supports it, because some ITP versions have treated CNAME-cloaked third-party domains differently. Since Safari 16.4, ITP also caps server-set cookies at 7 days when the endpoint's IP address does not match the first half of the website's own IP address, so in practice the endpoint should be served from the same infrastructure as the site — for example, through the same load balancer or CDN.

On the client side, modify your GA4 config to read this server-set cookie as the client_id instead of generating a new one. Result: returning visitor recognition on Safari goes from 7 days to 400 days.

Implementations of this technique typically show a 12-20% improvement in returning visitor identification. Verify it by checking the cookie expiry dates in Safari's Web Inspector (Storage tab).