Safari 27 Blocks Firms That Turn Your Email Into a Tracking ID

What changed in Safari 27

People worried about being watched online often assume the threat is a hacker or malware on their device. The tracking method Apple has now moved against involves neither. Your email address gets passed along in the background every time you type it into a login box or a newsletter form.

On October 19, 2026, Apple's WebKit team published a post called "Blocking Identity Resolution Infrastructure," signed by John Wilander, Charlie Wolfe and Matthew Finkel. It says Safari and WebKit in the iOS, iPadOS, macOS and visionOS 27 releases block network access to third parties that collect email addresses at login or sign-up and turn them into persistent tracking IDs.12 iOS 27 began rolling out on September 14, so anyone who has updated an iPhone since then is already covered.14

The post didn't come out of nowhere. Advertising-industry reporters spotted the block weeks earlier, after ads from The Trade Desk stopped showing up in Safari. A bug report filed on September 21 listed nine blocked domains, most of them linked to identity services such as Unified ID 2.0, ID5, LiveRamp, Permutive and Audigent.12 Apple's post names none of these companies and publishes no list.17

How your email becomes a tracking ID

This matters for anyone asking "is someone tracking me?" because of how quietly the system works. According to WebKit's description, a company that isn't the website owner collects your address without any visible sign. It sends the address to its own servers, creates an opaque ID permanently tied to it, and returns that ID to the page, where it's stored.1119 From then on, the ID can be used to build a profile of your browsing or to target ads at you across sites.11

The key detail is that different websites may receive different IDs. The resolver can still link them all because it holds the email address underneath.15 WebKit's diagrams reportedly show this as an "identity graph": one person connected to a phone number, home address, name, household, IP address, website accounts and cookies.12

Unsubscribing doesn't undo any of this. The WebKit authors say that logging out or leaving a newsletter list leaves both the tracking ID and the email address with the third party.1415 Apple's argument is that information you gave for one narrow purpose, such as receiving a newsletter, is being reused for long-term profiling by a company you never knowingly dealt with.7

Apple says email is uniquely suited to this. WebKit notes that email addresses almost always count as personally identifiable information, and that most people keep the same address "for years, even decades," which effectively makes it a global ID.1217 Because people use the same address on phones, laptops and tablets, it also allows tracking across devices, not just across websites.12

Tracking is not hacking, but it can still expose you

To be clear about what this is and isn't: nothing in the reporting describes a security breach or a compromised device. These scripts run on legitimate pages, often added by the site's own marketing setup. That is why the people affected rarely notice anything. WebKit calls these companies "present but invisible" on pages where you enter an email, and adds that they are "not themselves login providers or newsletter services, they're just there to track you."12 One analysis points out that because visitors can't see this code, even the site owner may never have reviewed it.19

In practice, the tracking can feel like surveillance even though nobody broke in. If an ad seems to follow you from a shopping site to a news site after you signed up for something, matching your email address is one plausible way that link was made. Apple's own policy treats this as seriously as an attack. WebKit's Tracking Prevention Policy says attempts to get around its protections are handled "with the same seriousness as exploitation of security vulnerabilities," and that new restrictions can be added without warning.17

Why the block is hard to dodge

Two design choices make this more than a symbolic change. First, the block works at the network level, so your address never reaches the resolver and no ID is created.12 Second, it works on whole domains. WebKit says vendors "can't just change the structure of the network request to work around the protection."1114 The policy also grants no exceptions to specific companies. Its reasoning is that the browser usually can't tell legitimate uses from tracking, and can't know what the data will be used for later.1217

For Safari users, this extends protections built up over several years. Apple says it fully blocked cross-site cookies in 2020, and it frames email-based identity resolution as the industry's response to that.1517 Safari 26 then made Advanced Fingerprinting Protection the default. This feature adds random noise to the data that fingerprinting scripts collect from Canvas, WebGL and audio, so a device looks different from one session to the next.6 It also blocks known fingerprinting scripts from reading URL query parameters or setting long-lived storage.45 Blocking email-based resolvers closes off one of the main routes that remained.

What the coverage agrees on, and where it doesn't

The reporting agrees on the basics: which platforms are covered, that the block is at domain level, that no vendors are named, and that first-party personalization by the website itself is not the target.17 Earlier reporting had confirmed only iPhone and iPad. Apple has now confirmed Macs and Vision Pro headsets as well.12

The gaps are significant, and they matter for anyone trying to judge how private they actually are:

• Hashed emails. Much of the identity industry argues that scrambling an address with a hash makes it private. WebKit's post neither exempts hashed addresses nor addresses them.1317 US regulators have previously warned that hashed data isn't anonymous.12
• Server-side routes. The post doesn't explain how it treats addresses that a website's own server forwards to a third party, such as Meta's Conversions API or Google's enhanced conversions.14 Safari can only block what passes through the browser. If a site sends your email to a partner from its own back end, browser-level protection may not reach it. That is an inference from how the block is described, not something Apple has said.
• Scope of the list. AdExchanger reported a remotely updated list covering hundreds of companies, but Apple hasn't confirmed it.12 Earlier reporting connected the block to The Trade Desk until an iOS 27.2 beta, and Apple's post doesn't mention the company's ad domain.1217

Coverage of Safari's other defaults is also inconsistent, which could lead users to overestimate their protection. Some marketing write-ups claim that Link Tracking Protection, which strips click IDs like gclid and fbclid from links, now applies to all Safari browsing by default.610 More careful sources disagree. Apple's documentation limits it by default to Private Browsing and links shared in Mail and Messages, and vendor tests show click IDs still arriving in normal tabs unless you change a setting.45 Those more cautious accounts have the stronger case, because they're based on Apple's release notes and on direct testing.

Independent comparisons also suggest that Safari still allows more third-party trackers than some rival browsers.9 Even a supportive summary of the new block notes that it doesn't stop every kind of tracking.16

What you can actually do

If you want to cut down how much others can learn about you, there are a few practical steps:

1. Update to version 27 on your iPhone, iPad or Mac. The identity-resolver block is automatic, with no setting to turn on.12
2. Turn on the stronger protection setting. "Advanced Tracking and Fingerprinting Protection" covers only Private Browsing by default. On iPhone, go to Settings, Apps, Safari, Advanced and choose All Browsing. On a Mac, it's under Safari's Advanced settings.4 This setting blocks connections to known data-collection companies and removes known tracking codes from links.2 Apple notes that some website features may not work properly with it on.4
3. Stop reusing one address everywhere. WebKit itself points iCloud+ subscribers to Hide My Email, which creates a unique random address for each site and forwards messages to your real inbox.1417 Commenters note that a separate alias per service protects you outside Safari too, in apps and other browsers where Apple's block doesn't apply.16

The bigger picture

The ad industry sees this as a serious hit. ID5's chief executive called it an attack on the web's business model, and a publisher executive has linked Apple's privacy moves to its commercial interests.12 Critics also point out that Apple is growing its own advertising business; eMarketer puts Apple's US ad sales at $8.85 billion.18 Those concerns about motive are fair to raise, but they don't change what the block does for an ordinary user. A tracker that never receives your address can't create an ID from it.

The overall verdict is that this is real progress, not complete privacy. The block cuts off an invisible, browser-based way of turning your email into a long-term tracking ID. It doesn't cover your address once it reaches a company's own servers, and Apple hasn't published which firms are on its list. For anyone worried about being watched online, the best protection is still to share your real email address as rarely as possible.