The change freeze date is on the calendar, and whatever collection setup is live that morning records Black Friday. A Safari shopper clicks a link in the retailer's promotional email on November 10 and comes back to buy on Cyber Monday, November 30, without visiting in between. If the visitor ID that recorded her visit sat in a cookie written in JavaScript, Safari deleted it on November 17, after 7 days with no user interaction (WebKit), and the sale lands with no campaign behind it. That happens in the five days Adobe expects to carry $47.5 billion in US online spend (Adobe 2026 forecast).

Whether she is recognized was decided weeks earlier, in the hostname. If the collection subdomain is a CNAME to a hostname the storefront does not share, Safari caps the server's cookies at the same 7 days. Moving a tag onto a server also leaves the consent duty in place. Running the endpoint in the retailer's own cloud keeps the raw events and the consent record in infrastructure the retailer controls. The hostname, the consent routing, the bot rules and the tags left on the page are all settled before the freeze, and a parallel run through peak is how a team finds out whether they were settled right.

This page collects the primary-source figures behind that position: WebKit's published tracking prevention rules, regulator and Google statements on consent, Adobe's holiday forecasts and results, bot-traffic data from two security vendors, and MetaRouter's own customer results. It was last updated on September 30, 2026.

Key server-side tracking and Safari ITP statistics

• $275.1 billion in US online holiday sales is Adobe's forecast for November 1 to December 31, 2026, up 6.7% on the year before (Adobe 2026 forecast).
• Safari caps cookies set by third-party CNAME- or IP-cloaked endpoints at 7 days, under WebKit's published tracking prevention rules (WebKit).
• "Regardless of the technique used," advertising tracking must rest on the user's informed choice (CNIL, 2021).
• Bad bots made up 43% of e-commerce traffic in the 2025 holiday season, against 46% from human shoppers (Radware, 2026).
• Bot attacks on retail sites rose 50% over the November average around Black Friday 2025, in Imperva's own network data (Imperva, 2025).
• About 700ms came off page load time at a Fortune 50 retailer after it moved most third-party tags server-side (MetaRouter customer).
• Server-side Pinterest events often ran to more than double the client-side tag's volume at a Fortune 500 grocery retailer, with match rates only slightly lower (MetaRouter customer).

Holiday ecommerce statistics for 2026 peak season

Most of the season's money arrives after the freeze, and a large share of it arrives in one week.

• US online holiday spending is forecast at $275.1 billion for November and December, a 6.7% rise year over year (Adobe 2026 forecast).
• Cyber Week, the five days from Thanksgiving through Cyber Monday, is expected to drive $47.5 billion in US online spend in 2026 (Adobe 2026 forecast).
• That would put 17.3% of the full 2026 season's online spend into those five days (Adobe 2026 forecast).
• $44.2 billion went to US online spend in Cyber Week 2025, up 7.7% year over year (Adobe Cyber Monday results, 2025).
• Smartphones carried 56.4% of online holiday transactions in the 2025 season (Adobe 2025 season results).
• On Cyber Monday 2025, mobile devices carried 57.5% of US online sales (Adobe Cyber Monday results, 2025).
• Mobile spend that day came to $8.2 billion in the US (Adobe Cyber Monday results, 2025).

Cyber Week is where attribution matters most, and it falls inside the freeze. How the site treats a returning Safari shopper on Cyber Monday is decided weeks before, and nothing done after the freeze changes it.

AI and social referral traffic in the holiday season

More holiday shoppers now arrive on a click from another platform, and each of those clicks has to be remembered until the purchase.

• Social media drove 4.6% of US online holiday revenue in 2025 (Adobe 2025 season results).
• Traffic from generative AI tools to US retail sites rose 693.4% year over year in the 2025 holiday season, though Adobe cautioned that the base of AI shopping users remains modest (Adobe 2025 season results).
• A 130% rise in AI traffic to US retail sites is forecast for the 2026 holiday season (Adobe 2026 forecast).
• Against that, paid search's share of holiday revenue is expected to rise 4% (Adobe 2026 forecast).

The traffic that is growing arrives on a link from somewhere else, and it only counts if the landing page remembers the click. Links from social platforms and other sites can carry a click ID, and ITP detects that link decoration and caps the expiry of cookies created in JavaScript on the landing page. A cookie the server sets in its own response, from a host Safari reads as first party, falls outside that rule, so the host has to be chosen while the edge team still takes changes.

Safari ITP cookie rules for server-side tracking

WebKit publishes the rules a server-side endpoint has to pass in Safari; read closely, they are a checklist for the hostname. MetaRouter has a longer explainer on how CNAME cloaking works at the DNS level; the bullets below paraphrase WebKit's published rules.

• All cookies created in JavaScript are deleted after 7 days of no user interaction with the website (WebKit).
• The same 7-day deletion covers all other script-writeable storage, which WebKit lists as IndexedDB, LocalStorage, media keys, SessionStorage, and service worker registrations and cache.
• When ITP detects third-party CNAME cloaking or third-party IP address cloaking, it caps the expiry of any cookie set in that HTTP response to 7 days (WebKit).
• Third-party CNAME cloaking, in WebKit's definition, is a first-party subresource that resolves through a CNAME differing from both the first-party domain and the top frame host's own CNAME.
• For a first-party subdomain that resolves through a first-party CNAME, or through the same CNAME as the top frame host, WebKit's scenario table applies no cap.
• Teams have had notice since at least March 2020, when WebKit's post on Safari 13.1 and iOS 13.4 described the seven-day cap on client-side cookies (WebKit blog, 2020).

To check an endpoint, open the site in Safari with Web Inspector attached and read the expiry of the identity cookie the endpoint sets. If you configured a year and Safari shows 7 days, the endpoint is classified as cloaked. Then run dig on the collection hostname: a CNAME to a vendor's or a cloud load balancer's hostname can match WebKit's definition. The usual fix is to route the hostname through the same edge as the storefront, a change to the storefront's edge configuration that the edge team has to make before its own freeze. An A record works only when it points at addresses that match the storefront's own. WebKit's tracking prevention page does not state how ITP compares IP addresses, so the Web Inspector check is how to confirm it.

The hostname, more than the server, decides what Safari keeps: first-party data collection holds in Safari only when the collection host resolves like the site itself. That is a DNS and edge decision, and the edge team stops taking those changes when the freeze starts.

Server-side tracking results from MetaRouter customers

MetaRouter's published customer results come from retailers' own deployments, and each is a single customer's measurement. Read together, they show more data arriving, with trade-offs a team has to check before calling it better data.

• A Fortune 50 retailer ran MetaRouter as a private Google Cloud deployment and moved the vast majority of its third-party tags off the page onto server-side integrations (MetaRouter customer).
• Data variability across the same retailer's third-party tools fell from an average of 35% to 1% (MetaRouter customer).
• Compared with the client-side tag, a Fortune 500 grocery retailer's server-to-server Pinterest integration often recorded more than double the event volume (MetaRouter customer).
• Match rates for those server-side events were only slightly lower than for the client-side tag, which the case reads as the server stream capturing events from users the client-side tag was not tracking.
• The grocery test ran for two days over a weekend in February on one smaller regional site, with the server stream filtered to web traffic and compared by event name.
• Running MetaRouter in its own Google Cloud environment, Allegro increased usable advertising data by 30% (MetaRouter customer).
• Conversions across Allegro's paid campaigns rose by up to 9.7%, in the same case study.
• More than $1 million in annual advertising spend was recovered, which the Allegro case credits to the deployment (MetaRouter customer).
• Sending Adobe only the events and parameters its use cases need cuts event volume and storage by 20% to 30%, in MetaRouter's own modelled estimate, which it notes is not an audited figure (MetaRouter estimate).

Expect something like the grocery pattern, more events at a slightly lower match rate. The extra volume is also where bots and duplicates would show up, so the parallel run should compare the two streams on volume, match rate and bot share and report all three together to whoever signs off on the change. None of those comparisons exists unless both streams run side by side through peak.

Consent requirements for server-side tracking

Consent follows the data onto the server, and the collection endpoint becomes the place where the shopper's choice gets enforced. A consent rule that breaks in late November stays broken through Cyber Monday unless someone gets an exception to the freeze.

• Advertising tracking based on browser or terminal information must rely on the user's informed choice, regardless of the technique used, in CNIL guidance from November 2021 (CNIL, 2021).
• Sub-domain delegation, which CNIL calls "CNAME cloaking," is named in the same guidance among the techniques used to get around browsers' third-party cookie blocking.
• Since March 2024, ad personalization features require end-user consent for users in the European Economic Area (Google Campaign Manager 360 Help).
• Advertisers who do not send consent signals lose ad personalization capabilities (Google Ads Help).
• Server-side tagging lets teams remove personal data before it passes to marketing partners (Google Tag Manager Help).
• A $1.55 million settlement, then the largest under the CCPA, followed Healthline's sharing of data with advertising partners for consumers who had opted out (California Attorney General).
• 23 US states had signed comprehensive privacy laws by September 2026, in the IAPP's state privacy legislation tracker (IAPP).

The shopper makes the choice in the consent banner, and the first-party endpoint enforces it on every request before routing, holding the advertising identity cookie for EU traffic until consent arrives. For a California opt-out, including one the browser sends as a Global Privacy Control signal, the analytics event can still be recorded while nothing goes to ad partners. Honoring that opt-out is what the California Attorney General alleged Healthline failed to do.

Bot traffic statistics for the holiday season

Bots reach the collection endpoint alongside shoppers, and their events flow to the same destinations unless something filters them first. That makes bot detection a data quality problem as much as a security one. The figures below come from two bot-mitigation vendors measuring their own networks.

• Bad bots accounted for 43% of holiday e-commerce traffic in 2025, nearly matching the 46% from human shoppers (Radware, 2026).
• A year earlier, the bad-bot share of holiday e-commerce traffic was 31% (Radware, 2026).
• Around Black Friday 2025, bot attacks on retail sites rose 50% over the November average (Imperva, 2025).
• Retail traffic overall ran 37% above November averages over Black Friday 2025 (Imperva, 2025).
• Across all web traffic in 2025, 53% was automated, up from 51% the year before (Imperva Bad Bot Report, 2026).
• Malicious bots made up 37% of all internet traffic in 2024 (Imperva Bad Bot Report, 2025).
• Retail sites drew 33% of their traffic from bad bots, in the same 2025 report (Imperva, full 2025 report).

Many bots never run a tag, so a share of traffic says little about a share of your events; measure the bot share of events in the parallel run. At the collection endpoint each request's user agent, address and event pattern are visible before routing: flag bot events there so audiences and ad platforms skip them, and keep the raw stream in the warehouse. Address rules alone can catch real shoppers behind shared relays, so flag and keep at the endpoint, and delete in the warehouse later.

Server-side tagging and page speed statistics

Every vendor pixel on a product page is a script competing with the product image and the add-to-cart button, sometimes on a congested phone network. Which pixels stay on the page through peak is one more thing the freeze locks in.

• A 0.1-second mobile speed improvement was associated with an 8.4% rise in retail conversions in "Milliseconds Make Millions," Deloitte's study for Google (Deloitte, 2020).
• The same 0.1-second improvement was associated with a 9.2% rise in average order value on retail sites (Deloitte, 2020).
• The browser sends one HTTP request per event under server-side tagging, and the server container sends the vendor-specific requests from there (Google Tag Manager Help).
• By moving most of its third-party tags server-side, the Fortune 50 retailer in MetaRouter's case study cut about 700ms from page load (MetaRouter customer).

In a parallel run the tags being compared stay on the page through Cyber Monday, so much of the speed gain waits for January. Deloitte's figures describe a correlation measured in 2020, and the Fortune 50 result is one retailer's. Move the pixels nobody is comparing before the freeze, and take the rest off after the January cutover.

Run a parallel first-party stream before code freeze

Stand up one first-party collection endpoint on one property before the freeze, pass the Safari cookie check above, and keep the client-side tags you are comparing against live beside it through Cyber Monday. Send the new stream to the warehouse, and to an ad platform only with a shared event ID so each purchase counts once. In January, compare the two streams by event name, on volume, match rate and bot share together, and the team will know whether the setup held.

MetaRouter is the customer context infrastructure that captures identity, behavior, and consent in real time, inside your own cloud, before the moment is lost. Allegro, which runs it in its own Google Cloud environment, reports 30% more usable advertising data. Teams that want that endpoint live before the freeze can start with MetaRouter on a single property and let peak traffic test it.

Methodology

Figures on this page come from primary sources: WebKit's own documentation, regulator and government pages, Google's help centers, Adobe Analytics releases and the original vendor reports from Radware and Imperva. The rest come from Deloitte's study for Google, the IAPP's state law tracker, and MetaRouter's published customer results and modelling. Each was confirmed on the publisher's page on September 29, 2026. Bot figures are vendor-measured and labelled. Figures that competing vendors publish about their own products, and figures relayed by third-party roundups, were excluded. No primary source for Safari's share of holiday traffic was available; Adobe's smartphone share covers every phone browser and is cited only as mobile context.

Last updated: September 30, 2026.