Two Years Requested, Seven Days Granted

A cookie header is a request, not an instruction. Max-Age=63072000 asks for two years, and what the browser grants depends on something the header does not mention: how the cookie came into being. The same line produces two years in one case and seven days in another, and nothing in the response says which.

The difference matters beyond tidiness. A returning visitor is only returning as long as the cookie that recognises them exists; once it is gone they are counted as new, and every window longer than the cookie’s life is arithmetic on data that no longer exists.

The Three Caps

Safari caps every cookie written through document.cookie at seven days. That is the rule with the largest practical effect, because most measurement cookies are written exactly that way – by a tag that runs in the page.

Safari applies the same seven days to cookies that arrive in an HTTP response from a host that resolves elsewhere through a CNAME. The intention is to catch the arrangement where a subdomain of the site points at a measurement provider; the effect is that a first-party cookie set the correct way is treated like a third-party one.

Chrome and Firefox cap at 400 days. That number rarely hurts – it is above every reasonable measurement window – but it does quietly end the two-year cookie that has been in the tag template since 2018.

Why the Route Decides, Not the Attribute

Two cookies with identical attributes can have different lifetimes, and the only difference is who wrote them. A cookie set by a script in the page is capped; the same cookie set in the response of one’s own server is not.

That is why moving the cookie into the response is the single most effective change available: it costs one endpoint on one’s own domain, and it is the difference between recognising a visitor for a week and recognising them for a year. The tag then reads the cookie rather than writing it.

The move has a second effect that is worth stating: a cookie written in a response can carry HttpOnly, and a cookie with HttpOnly cannot be read by any script on the page – including the ones nobody put there deliberately.

What a CNAME Changes

A subdomain pointing at a provider looks first-party in the address bar and is transparent to the browser: the resolution chain is visible, and the browser can see that the host ends up somewhere else. That is what the cloaking defence keys on.

The consequence is worth planning for rather than discovering: an arrangement built to escape third-party restrictions inherits the seven-day cap in Safari and gains, in return, a subdomain whose failure takes the whole measurement with it. Where the endpoint runs on one’s own infrastructure, neither applies.

The Attributes a Cookie Fails On

All of these fail the same way: the response is fine, the cookie is simply not there afterwards. The only reliable check is to look at what the browser stored rather than at what was sent.

What Follows for the Measurement

A seven-day cookie makes a visitor who returns after eight days a new one. In a report that shows up as a share of returning visitors that is lower on Safari than everywhere else, and as conversion paths that are shorter than the sales cycle – not because the journey was short, but because the earlier part is no longer connected to it.

Where the cookie cannot be extended, the honest response is to shorten the window rather than to keep reporting one the data cannot support. A thirty-day attribution window over a seven-day cookie describes a period the browser has no memory of, and every figure derived from it inherits that gap.