Safari and iOS Privacy

Apple’s platforms are privacy-forward by default, but the strongest options are off until you turn them on.

Safari (macOS and iOS)

Safari’s Intelligent Tracking Prevention (ITP) blocks third-party cookies entirely and caps how long scripts can store identifiers — client-side cookies set via JavaScript are limited to 7 days (24 hours in some link-decoration cases), which kills most persistent cross-site tracking. ITP is on by default.

• Safari → Settings → Privacy: keep “Prevent cross-site tracking” on, and turn on “Hide IP address from trackers” (routes known-tracker connections through Apple’s relay so they can’t see your real IP).
• iCloud Private Relay (Settings → your name → iCloud → Private Relay), available with iCloud+, hides your IP and DNS lookups from both your network provider and the sites you visit for Safari traffic. It is not a full VPN, but it removes IP-based tracking for browsing.
• Safari strips some tracking parameters from links automatically and offers link tracking protection in Mail and Messages.

iOS app tracking

The web is only half the story on a phone. App Tracking Transparency (ATT) requires every app to ask before tracking you across other apps and sites using your advertising identifier.

• Settings → Privacy & Security → Tracking: turn off “Allow Apps to Request to Track” to auto-deny every app. This zeroes out your advertising identifier (IDFA) for cross-app tracking.
• Settings → Privacy & Security → Apple Advertising: turn off Personalized Ads.
• Review Location Services per-app and set anything that doesn’t need precise location to “While Using” + Precise Location off.

Lockdown Mode

For high-risk users (journalists, activists, targeted individuals), Lockdown Mode (Settings → Privacy & Security) sharply restricts web technologies, link previews, and attachment types that are common attack and tracking vectors. It breaks some sites and features by design; it is a security tool, not an everyday setting for most people.

Safari + ITP + ATT denial + Private Relay covers the typical Apple user well. The gap is the same as everywhere: server-side collection a site performs after you load it is invisible to the device.