Why Safari Blocked All Third-Party Cookies in Early 2020

In March 2020, Apple updated its Safari web browser to block all third-party cookies by default, marking a major milestone in digital privacy. This article provides an overview of the primary reasons behind Apple's decision, which include halting invasive cross-site tracking, closing technical loopholes in its existing privacy systems, preventing browser fingerprinting, and reinforcing Apple's privacy-centric business model.

Preventing Cross-Site Tracking

The primary reason Safari blocked third-party cookies was to stop advertisers and data brokers from tracking users across different websites. Third-party cookies are placed on a user's browser by domains other than the website they are currently visiting. These cookies follow users around the internet, recording their browsing habits, purchases, and interests to build detailed behavioral profiles. By blocking these cookies entirely, Apple prevented companies from silently monitoring what Safari users do online.

Upgrading Intelligent Tracking Prevention (ITP)

Apple first introduced Intelligent Tracking Prevention (ITP) in 2017 to limit how cookies could be used for tracking. Initially, ITP used machine learning on the user's device to identify which third-party domains were tracking users and blocked only those specific cookies.

However, this selective approach created a cat-and-mouse game. Ad-tech companies constantly found workarounds and loopholes to bypass ITP's algorithms. By early 2020, Apple realized that selective blocking was no longer enough. Enforcing a blanket ban on all third-party cookies eliminated the loopholes and provided a definitive, predictable rule for web developers and advertisers.

Stopping "Login" and "State" Fingerprinting

Before the complete ban in 2020, the selective blocking used by ITP inadvertently created a new privacy risk. Because ITP only blocked cookies based on an individual user's browsing history, the specific combination of blocked and allowed cookies became unique to each user.

Trackers discovered they could read this unique state to identify and track users—a method similar to browser fingerprinting. Furthermore, trackers could use hidden third-party cookies to detect which websites a user was currently logged into. By blocking 100% of third-party cookies by default, Safari ensured that every user's browser behaved the exact same way, removing the unique patterns trackers used to identify individuals.

Eliminating the "Bounce Tracking" Loophole

When Apple first started restricting third-party cookies, advertisers pivoted to disguised tracking methods, such as "bounce tracking." This technique quickly redirected a user through a tracking website before landing them on their intended destination, tricking the browser into treating the tracker as a legitimate first-party website. A total ban on third-party cookies was a necessary foundational step for Apple to effectively isolate and shut down these secondary workaround techniques.

Apple’s Privacy-First Business Strategy

Unlike competitors such as Google and Meta, which generate the vast majority of their revenue through targeted digital advertising, Apple makes its money primarily by selling hardware and subscription services. Because Apple does not rely on third-party data harvesting for its profits, it was able to take an aggressive stance against the ad-tech industry. Blocking third-party cookies allowed Apple to protect its users while simultaneously using privacy as a major competitive advantage to sell more iPhones, iPads, and Macs.