https://webkit.org/blog/8613/intelligent-tracking-prevention... already limited 1st party cookies set from JS to 7d.

This post is about them extending it to all storage set from JS.

However any cookies set via HTTP, like http secureonly cookies that tend to be used for logging in, are exempt from that seven day limit.

Correct.

I expect companies will start working around this with CNAMEing and proxying, and I'm curious how Apple will handle it.

I would expect the end game of this would be advertising networks injecting content directly into the page as it's rendered on the webserver. If they want tracking, at some point they'll just ask companies to hand over their logs…

Yes. Or sites just CNAMEing entirely over to their ad network, which then proxies the page content and inserts ads. Which are then, as a side effect, are very difficult to block.

And since they can easily correlate logs server side, they can track people between sites.

Oh my, what a grim vision of the future. I'm going to stop recommending ad blockers, on the theory that I don't have to be faster than the bear...

I suspect the EU will just outlaw that kind of collaboration.

I think this is the eventual goal from tracking prevention's side.