Ensure Prevent Cross-site Tracking in Safari Is Enabled

LowLevel 1Automatedmacos

Description

There is a vast network of groups that collect, use, and sell user data. One method used to collect user data is pay and provide content and services for website owners. Along with that "assistance," the site owners also push tracking cookies on visitors. In many cases the help allows a content owner to keep the site up. The tracking cookies allow information brokers to track web users across visited sites. Audit: All three keys must be present: BlockStoragePolicy=2, WebKitPreferences.storageBlockingPolicy=1, WebKitStorageBlockingPolicy=1.

How it is checked

Audit method: Shell command

shell

out=$(/usr/sbin/system_profiler SPConfigurationProfileDataType 2>/dev/null | /usr/bin/tr -d ' ') || exit 1
if printf '%s\n' "$out" | /usr/bin/grep -qx 'BlockStoragePolicy=2;' && printf '%s\n' "$out" | /usr/bin/grep -qxF 'WebKitPreferences.storageBlockingPolicy=1;' && printf '%s\n' "$out" | /usr/bin/grep -qx 'WebKitStorageBlockingPolicy=1;'; then echo compliant; else echo noncompliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Profile (preferred): com.apple.Safari BlockStoragePolicy = <integer>2</integer>; com.apple.Safari WebKitPreferences.storageBlockingPolicy = <integer>1</integer>; com.apple.Safari WebKitStorageBlockingPolicy = <integer>1</integer>.

Properties

Operating systems: macos-26
Tags: macosapplications
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 6.3.4 Ensure Prevent Cross-site Tracking in Safari Is Enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos