Your Tracking Never Breaks — Even in Safari and Firefox

Why ClickStream Tracking Survives Every Browser

Browsers increasingly restrict cookies set by JavaScript while fully supporting cookies set by server responses from first-party domains. ClickStream's platform architecture takes advantage of this distinction automatically.

How the Platform Sets It Up

1. DNS Setup (guided in dashboard): During onboarding, you add a CNAME record pointing a subdomain (e.g., t.yoursite.com) to feynman.clickstream.com. The dashboard walks you through this step-by-step with provider-specific instructions.
2. SSL Certificate (automatic): ClickStream provisions an SSL certificate for your subdomain automatically. No manual certificate management needed.
3. SDK Loads (automatic): The ClickStream SDK on your page creates a hidden iframe pointing to your first-party subdomain
4. Cookie Set (automatic): The iframe response sets a first-party cookie on your root domain via Set-Cookie header
5. Cookie Persists: Because the cookie comes from a first-party subdomain via HTTP response, it survives ITP, ETP, and all current browser restrictions

# DNS Configuration (added during onboarding)
t.yoursite.com.  CNAME  feynman.clickstream.com.

# The resulting Set-Cookie header (set automatically by the platform)
Set-Cookie: _cs_id=v_lq8x2f3k_abc123def;
    Domain=.yoursite.com;
    Path=/;
    Max-Age=31536000;
    SameSite=Lax;
    Secure;
    HttpOnly

Why This Works When Other Tools Don't

The key distinction is between JavaScript-set cookies and server-set cookies:

* Safari has added CNAME cloaking detection in recent ITP updates. If the CNAME resolves to a known tracking domain, Safari may cap the cookie to 7 days. ClickStream mitigates this by using customer-specific edge deployments that don't resolve to a single shared tracking domain.

Set-Cookie Attributes Explained

Every attribute on the Set-Cookie header matters for persistence and security. Here's what each one does and why ClickStream sets it the way we do:

Domain=.example.com

The leading dot makes the cookie available on all subdomains of example.com. This is essential because the cookie needs to be readable from www.example.com, app.example.com, and t.example.com. Without the domain attribute, the cookie would only be accessible on the exact subdomain that set it.

Path=/

Makes the cookie available on all paths. Setting a specific path would limit cookie visibility to only that path prefix, breaking tracking across the site.

Max-Age=31536000

365 days in seconds. This is the cookie's expiration. We use Max-Age instead of Expires because Max-Age takes precedence when both are present and is relative (not dependent on server/client clock synchronization).

SameSite=Lax

The cookie is sent with top-level navigations and GET requests from external sites, but not with cross-site POST requests or embedded resources (iframes, images). Lax is the right choice because:

• None requires Secure and allows cross-site requests -- unnecessary for first-party cookies and raises privacy flags
• Strict wouldn't send the cookie when the user clicks a link to your site from Google search results -- you'd lose the referrer attribution
• Lax sends the cookie on the initial navigation from search/social while blocking cross-site embedded requests

Secure

Cookie is only sent over HTTPS connections. Required for SameSite=None and strongly recommended for all cookies. Since ClickStream requires HTTPS on the CNAME subdomain, this is always set.

HttpOnly

The cookie is not accessible via document.cookie in JavaScript. This prevents XSS attacks from stealing the cookie value. The ClickStream SDK reads the cookie indirectly through the iframe's postMessage communication, never by directly accessing document.cookie.

ITP Survival: What Safari Blocks and What It Doesn't

Safari's Intelligent Tracking Prevention (ITP) is the most aggressive browser-based cookie restriction. Understanding exactly what ITP targets is essential for building a persistence architecture.

What ITP Blocks

What ITP Does NOT Block

• Server-set first-party cookies via Set-Cookie header from the site's own domain or subdomains
• First-party localStorage and sessionStorage
• First-party IndexedDB
• HTTP response headers from first-party CNAME'd subdomains (with mitigations for cloaking detection)

ETP Survival: Firefox's Enhanced Tracking Protection

Firefox's ETP is less aggressive than ITP for first-party cookies but blocks third-party trackers comprehensively:

ClickStream's first-party architecture is fundamentally compatible with ETP because we don't appear on any tracker lists and all data storage happens on the customer's own domain.

The Fallback Path

When first-party cookies are blocked (consent rejection, extreme browser settings, or Tor/incognito), ClickStream falls back through a degradation hierarchy:

Tier 1: First-Party Cookie (Primary)

// Set via Set-Cookie header from CNAME'd subdomain
// Persistence: 365 days
// Accuracy: Highest tier visitor recognition
Set-Cookie: _cs_id=v_lq8x2f3k_abc123def;
    Domain=.example.com; Max-Age=31536000;
    SameSite=Lax; Secure; HttpOnly

Tier 2: localStorage + sessionStorage (Fallback)

// If cookies are blocked, fall back to Web Storage API
// Persistence: Until cleared (localStorage) or session end (sessionStorage)
// Accuracy: 70-80% (cleared by "Clear browsing data")

// localStorage for cross-session persistence
localStorage.setItem('_cs_id', 'v_lq8x2f3k_abc123def');
localStorage.setItem('_cs_scores', JSON.stringify(behavioralScores));

// sessionStorage as session-level backup
sessionStorage.setItem('_cs_session', sessionId);

Tier 3: Probabilistic signature (Last Resort)

// If all storage is blocked, generate a probabilistic signature
// Persistence: Session only (regenerated each visit)
// Accuracy: 40-65% (many collisions, changes with updates)

function generateSignature() {
    const signals = [
        navigator.userAgent,
        screen.width + 'x' + screen.height,
        screen.colorDepth,
        Intl.DateTimeFormat().resolvedOptions().timeZone,
        navigator.language,
        navigator.hardwareConcurrency,
        navigator.deviceMemory,
        // Canvas device signature (opt-in only)
        // WebGL renderer string
    ];
    return hashSignals(signals);
}

The Accuracy Gap: Quantified

Here's the measured accuracy difference across identity tiers:

Cookie Consent Rates by Region

Understanding consent rates is essential for sizing the fallback population. These numbers reflect actual opt-in rates for analytics cookies when a compliant consent banner is shown:

Implementation Checklist

For engineering teams implementing the proxy iframe architecture:

DNS and SSL Setup

• Create CNAME record: t.yourdomain.com → edge.clickstream.com
• Verify CNAME propagation: dig t.yourdomain.com CNAME
• Confirm SSL certificate provisioned (automatic via Cloudflare for SaaS, typically 15 minutes)
• Test HTTPS: curl -I https://t.yourdomain.com/health

SDK Integration

• Add ClickStream SDK script tag to <head> or before </body>
• Configure SDK with your site ID and CNAME subdomain
• Verify iframe creation in DevTools (Elements panel, look for cs-frame)
• Confirm cookie set: DevTools → Application → Cookies → check for _cs_id

Cookie Verification

• Verify Domain attribute matches .yourdomain.com
• Verify SameSite=Lax is set
• Verify Secure flag is present
• Verify HttpOnly flag is present
• Verify Max-Age is 31536000 (365 days)
• Test in Safari (ITP): confirm cookie persists beyond 7 days
• Test in Firefox (ETP): confirm cookie is not blocked
• Test in Brave: confirm cookie is set (may require shields configuration)

Fallback Verification

• Block cookies in browser settings and verify localStorage fallback activates
• Block all storage and verify device signature fallback generates a session ID
• Verify fallback tier is reported in the tracking payload

Consent Integration

• Integrate with your CMP (Consent Management Platform)
• Verify SDK waits for consent before setting cookies (required in EU/UK)
• Verify SDK falls back to session-only mode when consent is denied
• Test consent withdrawal: cookie should be deleted immediately

// Example: CMP integration
window.addEventListener('CookieConsent', function(event) {
    if (event.detail.analytics === true) {
        // Consent granted: initialize with full persistence
        ClickStream.init({
            siteId: 'your-site-id',
            cname: 't.yourdomain.com',
            persistence: 'full'  // Cookie + localStorage
        });
    } else {
        // Consent denied: session-only mode
        ClickStream.init({
            siteId: 'your-site-id',
            persistence: 'session'  // No cookies, no localStorage
        });
    }
});

Summary

First-party cookie persistence isn't about tricks or workarounds. It's about using the web platform as designed: setting cookies from your own domain via server responses. The proxy iframe architecture with CNAME subdomain is the most robust approach because it:

• Survives Safari ITP (server-set first-party cookies are not capped)
• Survives Firefox ETP (first-party domain is not on tracker lists)
• Works in all browsers including Brave and Edge
• Provides 365-day persistence for cross-session identity
• Falls back gracefully to localStorage and then device recognition
• Integrates with consent management platforms for privacy compliance

The best cookie architecture is one that doesn't fight browsers. It works with them, using first-party cookies as they were intended.