- Apr 12, 2001
Cookies for cross-site resources are blocked by default in the new versions of Safari, introducing significant privacy improvements because it further cuts down on cross-site tracking functionality.
The new cookie blocking feature makes sure there's no Intelligent Tracking Prevention state that can be detected through cookie blocking behavior as it removes statefulness, and it also prevents an attacker from seeing ITP status.It might seem like a bigger change than it is. But we've added so many restrictions to ITP since its initial release in 2017 that we are now at a place where most third-party cookies are already blocked in Safari. To keep supporting cross-site integration, we shipped the Storage Access API two years ago to provide the means for authenticated embeds to get cookie access with mandatory user control. It is going through the standards process in the W3C Privacy Community Group right now.
Thus, the absence of cookies in a third-party request outside the attacker's control is not proof that the third-party domain is classified by ITP.
More info on the changes implemented in Safari for iOS, iPadOS, and macOS today can be found in the full blog post.
Article Link: Safari in New Versions of iOS and macOS Includes Full Third-Party Cookie Blocking