Safari iOS 12 Cross-Site Tracking Protections

With the release of iOS 12, Apple introduced significant privacy enhancements to Safari aimed at eliminating cross-site tracking and safeguarding user identity. This update targeted the pervasive methods third parties use to monitor web activity by upgrading Intelligent Tracking Prevention (ITP 2.0), actively blocking social media tracking widgets, and implementing robust defenses against browser fingerprinting.

Intelligent Tracking Prevention 2.0

Safari in iOS 12 upgraded to Intelligent Tracking Prevention 2.0 (ITP 2.0), dramatically restricting how third-party cookies operate. In previous versions, trackers had a 24-hour window where their cookies could still be used across sites if the user had interacted with the domain directly. ITP 2.0 completely removed this grace period.

Under the updated system, cookies classified as having tracking capabilities are immediately partitioned and prevented from tracking users across different domains. Furthermore, ITP 2.0 introduced Tracker Collusion Detection, identifying domains that do not serve content directly to users but merely redirect traffic to pass tracking data between domains.

Social Widget and Embedded Content Blocking

Before iOS 12, embedded social media elements—such as "Like" buttons, "Share" buttons, and third-party comment sections—could track users across the web even if the user never clicked or interacted with them.

Safari in iOS 12 eliminated this passive tracking by default. When an embedded widget attempts to access cross-site data or set cookies, Safari automatically blocks the request. If the user intentionally decides to interact with the widget, Safari displays a permission prompt asking whether the user wants to allow the third-party service to access their data.

Browser Fingerprinting Protections

As cookie-based tracking became more restricted, advertisers increasingly turned to "device fingerprinting," a method of profiling users based on their specific hardware, software, installed fonts, and browser plugins.

To counter this, Safari in iOS 12 standardized the profile it presents to web servers:

  • Built-In Fonts Only: Safari presents only a standard set of system fonts to web pages, preventing trackers from using unique custom font installations to single out an individual.
  • Generic Configuration: Safari shares a simplified, standard system configuration with websites. Instead of revealing precise device details, millions of iOS devices appear identical to web servers, making it functionally impossible to construct a unique fingerprint.