Intelligent Tracking Prevention (ITP) is the set of privacy restrictions built into WebKit, the browser engine behind Safari, and it is on by default, not something a visitor switches on. It blocks all third-party cookies with no exceptions, and it also limits first-party storage, deleting cookies and other storage written by JavaScript after seven days of browser use without interaction on the site. Those limits apply to every site Safari loads, not only to domains ITP classifies as tracking capable.
Why it matters for agencies
For an agency the loss sits in one slice of the audience and disappears into the totals. A client's Safari and iPhone traffic reads as a weaker converting audience, when the real difference is how long the browser kept the identifier that ties a return visit to the first click. The visitor worst affected is the one you are paid to measure: when someone arrives from a classified domain with a click ID in the URL, ITP reads that as link decoration and caps cookies written in JavaScript on the landing page at 24 hours. Paid traffic gets the shortest memory of anyone, so returning visitors are counted as new and the campaign that earned the conversion loses the credit.
What teams get wrong
The most common mistake is reading ITP as a third-party cookie problem that going first-party has already solved. Third-party blocking is one restriction out of several, and the seven-day rule is a separate one that acts on the site's own storage, so a client's own analytics cookie goes by the same rule as a tracker's. The second is trusting the browser column. Apple requires apps that browse the web to use WebKit, with an alternative engine allowed only under an entitlement in the EU and Japan, so sessions labelled Chrome or Firefox on an iPhone are governed by the same rules, and reading only the Safari row understates the exposure.
The third is expecting a storage workaround to hold. Moving the identifier out of a cookie and into localStorage puts it on the same clock, because ITP aligned the other script-writable storage forms with the cookie restriction in March 2020. All three fail silently. Events keep arriving, dashboards stay green, and the only trace is a rising share of new visitors and campaigns that quietly stop getting credit. At Archon Labs it is the most common finding on setups that were otherwise built correctly.
