Safari 27 blocks third-party services that turn emails into tracking IDs

Safari 27 blocks third-party services that turn emails into tracking IDs

19 October 2026: Apple's WebKit team says Safari and WebKit in the iOS, iPadOS, macOS and visionOS 27 releases block network access to third-party "identity resolution" services, which collect a visitor's email address when they log in or sign up and return a persistent tracking ID. The block works at the domain level, so a provider cannot get round it by changing how its requests are built.

Not yet independently verified. WebKit does not name the services it blocks or give a release date beyond the 27 releases; the companies named in press coverage are not confirmed by Apple. We will update this when it can be confirmed, and remove this note.

What WebKit is blocking

In a post on 19 October, WebKit describes identity resolution as a "post-cookie" tracking method. A third party, not the website owner, invisibly picks up the email address a user types into a login or newsletter form, sends it to its own servers, creates an opaque ID permanently linked to that address and hands the ID back to the page. The ID can then be used to build a profile of the person's browsing or target ads across sites, and logging out does not break the link. Over time, WebKit says, these providers build an "identity graph" that also spans devices, because most people keep the same email address for years.

WebKit draws a line at first-party personalisation, which it says is not tracking. Even where an identity graph is scoped to one company's data, it argues, the central resolver is a third party holding cross-site, cross-device data and acting as a clearinghouse, a capability no single site has on its own. Such providers, it says, "are not themselves login providers or newsletter services, they're just there to track you." The post does not name any company.

Who feels it

The change matters to marketers, publishers and ad-tech vendors who replaced third-party cookies with email-based IDs: matching, retargeting and measurement that depend on a resolver script running in the browser will stop working for Safari users once they upgrade. First-party data a site collects and uses itself is unaffected, as are server-side uses of email lists that customers have handed over directly, although those raise their own consent questions under privacy law. WebKit also points users to Hide My Email, the iCloud+ feature that gives each site a random address.

What to check before the 27 releases spread

Marketing and web teams should list the third-party scripts on their login, checkout and newsletter forms and ask each vendor whether its domains fall within WebKit's definition, then test those flows in the current Safari previews. WebKit blocked cross-site cookies six years ago and frames this as the next step: "We will continue to prevent covert and cross-site tracking by default."

Sources

• WebKit blog: Blocking identity resolution infrastructure, 19 October 2026