Safari in iOS 27 now blocks email-based tracking: how it works

Key facts

Safari and WebKit in iOS 27, iPadOS 27, macOS 27 and visionOS 27 block network access to identity resolution infrastructure.

These third parties collect email addresses on login and newsletter forms and turn them into permanent tracking IDs.

The block works at domain level, so trackers cannot bypass it by restructuring requests; first-party personalisation is unaffected.

Apple has explained how Safari and WebKit in iOS 27, iPadOS 27, macOS 27 and visionOS 27 block a newer form of cross-site tracking built on users’ email addresses. In a WebKit blog post published on 19 October, the team says the browsers now cut off network access to so-called identity resolution infrastructure.

What identity resolution is

Safari fully blocked cross-site cookies six years ago, but Apple says the tracking industry has moved on to what it calls the “post-cookie era”. In this scheme, third parties that are not the website owner invisibly collect your email address when you log in or sign up for a newsletter, send it to their own servers and return an opaque tracking ID that stays permanently linked to that address.

That ID can then be used to build a profile of your browsing or to target ads at you across websites. Apple notes that logging out or unsubscribing does not remove the tracking ID or the email address held by the third party. Over time these firms combine logins and form data into an “identity graph” that can follow a person across sites and devices.

How Safari blocks it

Apple says the companies behind this infrastructure sit invisibly on pages where you enter an email address, without being login providers or newsletter services themselves. In the 27 releases, Safari and WebKit block their network requests, so your email address is never sent to their servers. The block works at domain level, which means trackers cannot get around it simply by changing the structure of the request.

Apple stresses that first-party personalisation, where a website uses information you have given it, is not tracking and is not affected. The target is the third-party resolver that holds cross-site, cross-device data and acts as a clearinghouse.

Hide My Email adds another layer

iCloud+ subscribers can also use Hide My Email, which creates a unique, random address for each website while still forwarding messages to your inbox. Apple says this gives additional protection against email-based tracking, because the addresses cannot be matched across sites.

The protection is part of the current 27 releases, including the upcoming iOS 27.2 update.