Blog

Prevent Cross-Site Tracking on iPhone: Should It Be On?

A person strolls past a row of small shopfronts while a faint shadowy figure trying to follow them is stopped at a closed gate between two of the shops

Prevent Cross-Site Tracking limits the cookies trackers use to follow you across sites in Safari. Keep it on: what it breaks, and why it can be greyed out.

Marco Lee6 min read

Prevent Cross-Site Tracking is Safari’s switch for Intelligent Tracking Prevention. It limits the third-party cookies and website data that ad and analytics companies use to follow you from one site to the next. It’s on by default, I’d keep it on, and when a sign-in or embedded page breaks, there are fixes that don’t mean turning it off for good.

What does Prevent Cross-Site Tracking mean?

Many websites load content from other companies: ads, analytics, social buttons, embedded players. Apple’s wording: “A third-party content provider can track you across websites to advertise products and services.” With Prevent Cross-Site Tracking on, “tracking data is periodically deleted unless you visit the third-party content provider” (Apple Legal).

The technology behind the switch is Intelligent Tracking Prevention (ITP). Apple says it uses on-device machine learning to fight cross-site tracking and is on by default (Apple Privacy). WebKit, the engine Safari runs on, documents what it does (WebKit):

  • It blocks all third-party cookies. A company embedded in someone else’s page can only get its cookies through the Storage Access API, which asks you first, or a temporary compatibility fix for pop-ups.
  • Domains it classifies as trackers lose all their website data unless you’ve interacted with them as a site you visited, or granted them storage access, within the last 30 days of browser use.

Like, share and comment buttons are covered too. Apple says they “can be used to track you even if you don’t click them or use them,” and Safari blocks this tracking by default (Apple Privacy).

To see it at work, open a page in Safari, tap the Page Menu button, tap Privacy & Security, then Privacy Report. It summarizes the trackers Intelligent Tracking Prevention encountered and prevented on that page (iPhone User Guide).

Should Prevent Cross-Site Tracking be on or off?

On. Apple’s guide says it plainly: “Safari limits third-party cookies and data by default. Turn this option off to allow cross-site tracking” (iPhone User Guide). To check yours:

  1. Open Settings, tap Apps, then tap Safari. On iOS 17 and earlier, Safari is directly in the Settings list.
  2. Under Privacy & Security, make sure Prevent Cross-Site Tracking is on.

The switch covers Safari only (Apple Legal). Other browsers have their own settings.

What it can break, and how to fix it without turning it off

With third-party cookies blocked, anything that runs inside one site but belongs to another company, and needs its own cookies, can fail. Think of an embedded sign-in box or a comment section run by another company. WebKit calls these “authenticated embeds” and built the Storage Access API so they can get cookie access “with mandatory user control” (WebKit).

Try these in order:

  1. Watch for the prompt. Safari may ask whether to allow one site “to use cookies and website data while browsing” the site you’re on. That’s the Storage Access API asking you. Tap Allow only if you recognize both sites and you’re trying to use that embedded feature.
  2. No prompt? Visit the other site directly first. Open the company that runs the sign-in or widget in its own tab, sign in there, then go back, reload and try again. Safari’s cookie policy only lets a company use cookies as a third party once it has set them as a site you visited yourself (WebKit).
  3. Turn it off only for the task. If nothing else works, switch it off in Settings > Apps > Safari, finish what you were doing, then switch it straight back on. I’d only do this for a sign-in I trust.

If a site still misbehaves, clearing its website data is the next step. The steps are in how to clear cache on iPhone.

Why is Prevent Cross-Site Tracking greyed out?

The documented reason is device management. Apple’s restrictions for managed devices include a cookie setting. Depending on the value an organization picks, it “Enables Prevent Cross-Site Tracking, and the user can’t disable it,” or turns on Block All Cookies as well so you can’t disable either (Apple Developer). Every value of that restriction keeps the switch on, so if a profile is the cause, the switch is locked in the protective position.

To see whether your iPhone is managed, go to Settings > General > VPN & Device Management. Deleting a profile also deletes all the settings, apps and data that came with it (iPhone User Guide). On a work or school phone, I’d ask whoever manages it rather than remove anything.

Apple doesn’t name Screen Time as a reason this switch goes gray. It does say Screen Time’s web content restrictions can gray out Safari’s clear-history buttons (Apple Support), so on a child’s iPhone, ask whoever set up Screen Time.

How it differs from other iPhone tracking settings

Setting Where What it does
Prevent Cross-Site Tracking Settings > Apps > Safari Limits third-party cookies and data in Safari
Block All Cookies Settings > Apps > Safari > Advanced Blocks every cookie, including from the site you’re on
Hide IP Address Settings > Apps > Safari Hides your IP address from known trackers; from websites too with iCloud+
Advanced Tracking and Fingerprinting Protection Settings > Apps > Safari > Advanced Blocks known trackers from loading and adds fingerprinting defenses
Allow Apps to Request to Track Settings > Privacy & Security > Tracking Controls tracking by apps, not websites

Block All Cookies goes much further. Apple warns that with it on, you “will likely not be able to sign in to a site, even when using your correct username and password,” and turning it on removes all existing cookies and website data (Apple Support). I’d leave it off.

Hide IP Address deals with a different identifier. Safari “automatically protects your IP address from known trackers,” and for eligible iCloud+ subscribers it also hides it from websites (iPhone User Guide). Prevent Cross-Site Tracking doesn’t touch your IP address. The full comparison is in how to hide your IP address on iPhone.

Advanced Tracking and Fingerprinting Protection is the extra layer. Private Browsing already “blocks known trackers, removes tracking used to identify individual users from URLs, and adds protections against advanced fingerprinting techniques” (Apple Support). To get the same in normal tabs, go to Settings > Apps > Safari > Advanced > Advanced Tracking and Fingerprinting Protection and choose All Browsing. WebKit admits some parts of some sites may not work, so Safari lets you reduce these protections for one site, remembered only while you browse that site (WebKit). On iOS 27 that option is called Reload with Reduced Protections.

Allow Apps to Request to Track is App Tracking Transparency, and it’s about apps. Apps must ask before tracking you across other companies’ apps and websites. If you tap Ask App Not to Track, the app can’t access the advertising identifier (IDFA) and isn’t permitted to track you with other details that identify you, like your email address (Apple Support). Safari’s switch does nothing for apps; this is the one for them.

Does Prevent Cross-Site Tracking block ads?

No. It limits what trackers can store and read across sites, but the ads and tracker scripts still load. WebKit draws the line itself: ITP “has long blocked all third party cookies,” while blocking trackers’ network requests is one of the newer advanced protections (WebKit). To stop the ads themselves in Safari, you need a content blocker, turned on in Settings > Apps > Safari > Extensions (Apple Support).

Run our ad blocker test in Safari to see which ad and tracker servers it can still reach. Prevent Cross-Site Tracking on its own won’t shorten that list; a content blocker can.

What Mistero can and can’t do here

Mistero can’t change, unlock or replace this Safari setting. If the switch is gray, that’s controlled by whoever manages your iPhone, and I’d keep Prevent Cross-Site Tracking on whether or not you use Mistero.

What it adds is the request side. Mistero Adblock is a Safari content blocker that comes with the Mistero VPN app. The App Store listing says it can “Reduce ads, pop-ups, and common tracking content in Safari” and lets you “Choose regional filter lists and manage trusted websites” (App Store listing, read Nov 2, 2026). Tracker blocking is a separate switch in the app, called Tracker Blocking. Like any content blocker, it works in Safari only. More on Mistero Adblock.

Sources

Pricing New subscribers can start a 3-day free trial. After the trial, the subscription renews automatically at $12.99 per week unless you cancel at least 24 hours before the trial ends, in Settings > [your name] > Subscriptions (Apple Support). There's also a one-time Lifetime purchase for $99.99. These are US App Store prices as of October 2026; the purchase screen shows the current price before you confirm.

Frequently asked questions

Should Prevent Cross-Site Tracking be on or off?

On. It's on by default and limits the third-party cookies and data that trackers use to follow you between websites in Safari. If one site breaks, allow its cookie prompt or sign in to the other site directly first. Turn the switch off only to finish that task, then turn it back on.

Why is Prevent Cross-Site Tracking greyed out?

The reason Apple documents is device management: a work or school profile controls it. Apple's managed-device restriction for cookies keeps Prevent Cross-Site Tracking on and can stop you from turning it off. Check Settings > General > VPN & Device Management and ask whoever manages the iPhone.

Does Prevent Cross-Site Tracking block ads?

No. Ads and the trackers inside them still load. The setting limits what those trackers can store and read across sites. To block ads in Safari, install a content blocker and turn it on in Settings > Apps > Safari > Extensions.

Does Prevent Cross-Site Tracking hide my IP address?

No. That's a separate Safari setting, Hide IP Address, which hides your IP address from known trackers. Hiding it from the websites you visit needs iCloud Private Relay (part of iCloud+) in Safari, or a VPN for every app.
View All Blogs
Adblock5 min read30 Oct, 2026Ad Blocker for iPhone Chrome: What Actually WorksSafari ad blockers don't work in Chrome on iPhone, and Chrome there takes no extensions. See what Chrome can block, and the two options that do work.Adblock6 min read30 Oct, 2026Ad Blocker for iPhone Games and Apps: What WorksNo App Store ad blocker can remove ads inside other iPhone apps or games. What helps: paying to remove ads, playing offline, tracking settings and DNS filters.Adblock4 min read30 Oct, 2026YouTube Ad Blocker for iPhone: What It Can and Can't DoNo Safari ad blocker can reach the YouTube app, and results on youtube.com vary. What a blocker can do for YouTube on iPhone, and the tweaked apps to avoid.