Apple’s WebKit team has introduced a stronger defense against modern cross-site trackers in its latest releases. With the launch of iOS, iPadOS, macOS, and visionOS 27, Safari now stops third-party identity resolution infrastructure from gathering users’ email addresses or turning login and newsletter signup info into persistent identifiers. This prevents firms from stitching together users’ activity across different sites.
What identity resolution means—and why it matters
Years ago, ads and trackers relied mostly on third-party cookies to follow users around the web. But as those have been blocked, advertisers have adopted a newer method called identity resolution. This involves using someone’s email (or other personal identifiers like phone numbers) gathered during login or from newsletter signups—and converting them into tracking IDs. These IDs allow tracking firms, often invisibly present on many websites, to build detailed cross-site and cross-device profiles. Even actions like logging out or unsubscribing won’t erase the underlying identifier or stop the linking.
What Safari does now
In the 27-series updates of iOS, iPadOS, macOS, and visionOS, Safari and WebKit stop network requests to domains identified as hosting identity resolution infrastructure. The blocking happens at the entire domain (eTLD+1) level, which means subdomains won’t be able to skirt the protections by tweaking request formats or endpoints. As a result, if a login form or newsletter includes a third-party service that transforms your email into a tracking ID, the browser won’t allow that connection to go through.
The change isn’t just about cookies—it’s about cutting off the data supply chain. Without network access, those trackers circulating user email addresses can’t create new identifiers, match profiles, or pass data downstream. Safari’s built-in protections only allow first-party personalization, excluding third-party data aggregation.
For users participating in Apple’s iCloud+ program, there’s an added layer: Hide My Email generates random, unique email addresses for each new website, helping thwart efforts to track by email even more thoroughly. This feature ensures messages still arrive in the user’s real inbox while limiting how much identifying data is exposed.
The policy comes alongside Apple’s broader Tracking Prevention policy, which defines terms like “cross-site tracking,” “first party vs. third party,” and the responsibilities of identity resolvers. Apple also makes clear no exceptions are being made for businesses, and that domain blocks are updated only through OS releases—not via remote lists.
Technical details: the blocking occurs at the network layer. Safari refuses to send the user’s email to those identity-resolving domains. The policy applies to both raw and hashed email addresses. It’s enforced by checking registrable domains (eTLD+1), so subdomains can’t bypass the ban by altering the request’s structure.
Some identity companies publicly associated with affected domains include LiveRamp, ID5, Permutive, Audigent, and The Trade Desk—with the latter still blocked in current versions of Safari until fixes roll out in iOS 27.2. However, Apple hasn’t published the list officially or confirmed coverage on other OS versions like watchOS or tvOS.
Where this fits in Apple’s privacy timeline: cross-site cookies were fully blocked six years ago. Since then, trackers have employed email-based linking and other tactics. Safari’s latest move targets those when they try to act like third-party cookies—all without giving users an easy escape or obvious workaround.
What this means for developers: sites using external vendors for login, forms, or newsletters should audit which third-party scripts run when email fields are present. If their functionality depends on identity resolution, it likely won’t work under the new protections. Site owners should anticipate disruptions and redesign workflows to either rely on first-party data or aligned APIs for attribution.
The user impact
Most users won’t notice a visible change—forms still work, newsletters still arrive, login tools behave as normal—unless a service is heavily reliant on identity resolution providers. For privacy-conscious users, this is a major win: their email addresses are no longer silently processed or shared for tracking. Advertisers and data brokers will see constraints on data aggregation, targeting precision, and cross-site ad matching.
This protection is embedded by default. Users don’t need to toggle settings or enable privacy-features. Safari is stepping up so that the browser itself enforces the block.
This update becomes part of Safari with OS 27, which began rolling out on September 14, 2026. Any future changes to the blocked domain list would require OS updates—not just remote configuration.
Analysis: This move shows how browser makers are taking control of tracking infrastructure—not just cookies, but entire identity resolution pipelines. It tightens the privacy envelope around user email, a long-persistent identifier. As adtech struggles to catch up, look for shifts toward first-party identity solutions and Apple’s influence on web API design. Developers should start building without relying on hidden third-party resolvers, and privacy advocates will be watching whether Apple follows through on transparent policy enforcement and domain list management.
