Your 90-day click window rests on a cookie that may last 7

A 90-day attribution window sounds like a promise: click today, buy in three months, the ad still gets the credit. It is only a limit on what the platform will accept. Your site has to remember the click for that long, and that memory is a cookie with its own expiry.

LinkedIn’s default click window is 90 days. LinkedIn’s own click cookie, li_fat_id, is listed at 30. It is the only platform of five we checked whose default window outlives its own cookie in every browser. On Safari the gap gets wider for everyone. A cookie created in JavaScript lasts 7 days without a visit, and 24 hours when Safari detects a tracking click ID added to the landing URL. Every window longer than that relies on something other than the cookie.

The windows and the cookies, from each vendor’s own pages

Checked on 19 October 2026. Every cell is in facts above with its source.

Platform	Click window	Click ID cookie	Documented lifetime
Google Ads	30 days by default, 1 to 90 days	_gcl_aw	90 days
Meta	1 or 7 days	_fbc	90 days (Meta’s recommended expiry when your server sets it)
Microsoft Advertising	up to 90 days (API maximum)	_uetmsclkid	90 days (Microsoft’s suggested name and expiry)
LinkedIn	90 days by default, 1/7/30/90; 180 or 365 for some CAPI and CSV conversions	li_fat_id	30 days
TikTok	1, 7, 14 or 28 days	ttclid	13 months from last use

Pinterest and Reddit are not in the table. We found no page of their own that states how long their click cookie lives, and a cookie database’s guess is not a source.

The two numbers answer different questions. The window is how long the platform will credit a click. The cookie window is how long your site can still say which click it was. A conversion needs both. Read the table that way and three cases appear:

• The cookie outlives the window. Meta (7 days against 90) and TikTok (28 days against 13 months). The window, not the cookie’s expiry, is the binding limit.
• They match. Google and Microsoft both allow 90 days and document a 90-day cookie. On paper, no gap.
• The window outlives the cookie. LinkedIn: from day 31 to day 90 the window is open and the first-party click cookie is gone.

What Safari does to every row

Three limits on WebKit’s tracking prevention page bear on a click cookie:

1. Cookies created in JavaScript, and all other script-writeable storage, are deleted after 7 days of no user interaction with the website. A return visit resets the clock. A buyer who clicks and then waits 10 days does not.
2. When ITP detects a click ID added to a link and read by JavaScript on the landing page, it caps those cookies at 24 hours. That is the exact pattern a pixel uses to store a click ID.
3. Cookies set in an HTTP response are capped at 7 days when the request goes through third-party CNAME or IP address cloaking. A cookie your own server sets, without cloaking, is in none of the three.

So the “documented lifetime” column is the most a cookie gets. On Safari, a cookie that a tag writes in the page lasts 7 days at most, and possibly 24 hours, whatever the column says. Google’s 30-day default and LinkedIn’s 90 days then depend on another way to match the buyer, not on the cookie.

Meta’s documentation already points at the fix. It asks you to set _fbc “as HTTP cookie in the HTTP response headers”, from your server, rather than leave it to the Pixel’s JavaScript.

Microsoft’s own example never stores the cookie

Microsoft’s help page for UET without JavaScript tells you to store MSCLKID in a first-party cookie named _uetmsclkid for 90 days, and gives a script to do it. We ran that script unchanged in Chromium on the URL forms from Microsoft’s own auto-tagging test page.

Page	URL	_uetmsclkid cookie
Microsoft’s example, as published	?msclkid=Example-123	none
Microsoft’s example, as published	?a=b&msclkid=Example-123#xyz	none
Microsoft’s example, as published	?_uetmsclkid%20=Example-123	none
One argument changed to "msclkid"	?msclkid=Example-123	Example-123, expires in 90 days
One argument changed to "msclkid"	?a=b&msclkid=Example-123#xyz	Example-123, expires in 90 days

The script calls getParam("_uetmsclkid "). That is the cookie’s name, with a trailing space, used as the URL parameter name. Auto-tagging adds msclkid, and it is on by default. The regular expression looks for _uetmsclkid = in the query string, and a browser sends a space in a URL as %20, so it matches nothing. A site that copied the example has no MSCLKID cookie at all. Fix the argument and Chromium stores the click ID for 90 days. It still writes the cookie with document.cookie, so on Safari the 7-day and 24-hour limits above apply.

What the gap does to one sale

• LinkedIn, Chrome. A buyer clicks a LinkedIn ad on day 0. LinkedIn stores li_fat_id on your domain for 30 days. They come back directly on day 45 and convert. The 90-day window covers day 45, but the cookie that identified the click expired on day 30. Unless LinkedIn can match the buyer some other way, the conversion has no click to attach to.
• Google, Safari. A buyer clicks a Google ad. A tag writes _gcl_aw in JavaScript with a 90-day expiry. They come back on day 10. The default 30-day window covers day 10. Safari deleted the cookie on day 7, because nobody visited in between. If ITP flagged the landing URL, it was gone after 24 hours.

In both cases the report blames the window or the platform. The cause is the storage.

What to do differently

1. Write the cookie next to the window. “LinkedIn: 90-day click, li_fat_id 30 days” tells you where the gap is. A window longer than the cookie that carries the click is credit you may never see.
2. Store the click ID on your side when the visitor lands. Read it from the URL on your server and keep it with the session or the lead. Then send it with the conversion, as Meta’s _fbc advice already suggests. A cookie your own server sets is in none of the three WebKit limits above. A server-side tagging setup does this, if it is not cloaked through a third-party CNAME.
3. Send another identifier with the conversion. A hashed email through the platform’s conversions API does not expire with a cookie. LinkedIn’s window page already points there: Conversions API and CSV conversions can use a 180- or 365-day window for some categories.
4. If you copied Microsoft’s IMG-tag script, change one word. getParam("_uetmsclkid ") becomes getParam("msclkid"). Then run Microsoft’s own test: load your page with ?msclkid=Example-123 and look for the cookie.

Keeping the click ID alive is half the job. The other half is sending it back to each platform in the field that platform expects, with the dedup key and deadline it wants. Eight platforms disagree on all three, and that is what to test in a tracker trial.