Safari 27.2 fixes a narrow seven-day cookie limit

Safari 27.2 corrects a cookie-lifetime bug that could matter to stores using a CNAME-hosted website. In its 26 October release notes, WebKit says cookies set by the page navigation’s own response were being limited to seven days when the site’s hostname pointed to a different registrable domain.

The distinction is the response setting the cookie. This announcement concerns the site’s own top-level page response. It should not be read as a blanket promise that server-side tracking cookies now persist indefinitely, or that Safari has reversed other protections.

Give your developer a specific question

Our recommendation is to identify whether the affected arrangement exists before changing any analytics assumptions. Ask the person responsible for your storefront hosting to inspect the hostname configuration and the response that sets the cookie in question. A vendor saying “we use server-side tracking” does not answer either point.

For a controlled check, record the browser version, hostname, response and expected cookie expiry. Compare that with the observed result after updating, and keep other configuration changes separate. That makes a difference easier to investigate without attributing every movement in returning-customer reports to the release.

Keep the reporting claim modest

The release notes do not quantify lost orders, affected stores or an expected recovery in advertising attribution. They also do not establish that cookies already saved with a shorter lifetime will be repaired. A store-specific improvement needs store-specific evidence.

For teams preparing peak-season checks, add this as a targeted browser test alongside the cart, delivery and notification checks in our BFCM rehearsal guide. Do not change consent choices or advertising settings simply because a browser bug has been fixed.

Apple separately lists the release date and security fixes in its Safari 27.2 security notice. Those security fixes are separate from the cookie-lifetime item discussed here.