Safari 27 Blocks Email Address Tracking Across Websites

• Safari 27 blocks network access used by hidden trackers that turn email addresses into cross-site tracking IDs.
• Apple says the protection applies across iOS, iPadOS, macOS and visionOS 27 releases.
• Domain-level blocking makes it harder for trackers to bypass the protection by changing network request structures.

Safari 27 is adding a privacy protection designed to stop hidden trackers from using email addresses as identifiers across different websites. Apple’s WebKit team says Safari and WebKit block network access to identity resolution infrastructure in the iOS, iPadOS, macOS and visionOS 27 releases.

The technique, known as identity resolution, can turn an email address into an ID that follows a person across websites. Apple’s stated approach targets the behind-the-scenes network infrastructure used for this matching. It is a privacy improvement for Safari users on iPhone, iPad, Mac and Vision Pro, although it does not block every form of tracking.

How Email Address Tracking Works

Some companies can take an email address and convert it into an identifier. That identifier can then be used to recognise the same person across different websites. This process is called identity resolution.

The matching can happen behind the scenes through network services that help connect an email-based ID with activity across sites. A person may not see this process while browsing, which is why blocking access to the infrastructure is relevant to privacy.

What Safari 27 Changes

Apple’s WebKit team says that in the iOS, iPadOS, macOS and visionOS 27 releases, “Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking.” In practical terms, Safari cuts off access to the behind-the-scenes networks used to match identifiers across websites.

This protection is aimed at the infrastructure involved in identity resolution rather than relying only on what a tracking request looks like. The change is intended to make this type of cross-site tracking harder to carry out through Safari and WebKit.

Why Domain-Level Blocking Matters

Apple also says, “the blocking is done on the domain level, meaning they can’t just change the structure of the network request to work around the protection.” This means the restriction is applied to the relevant domain, not just a particular format of request.

As a result, changing how a network request is structured should not be enough on its own to bypass the block. Domain-level enforcement is an important part of the protection described by Apple’s WebKit team.

What Safari 27 Does Not Block

The change does not mean that Safari blocks every kind of tracking. It specifically targets network access to identity resolution infrastructure used for cross-site tracking. Other tracking methods are not automatically covered by this particular protection.

The update is therefore best understood as a focused privacy improvement, rather than a guarantee of complete anonymity while browsing. Safari users can benefit from the added restriction, but the feature should not be treated as a universal tracking blocker.

For more Apple software coverage, see our report on the iOS 27.2 Release Candidate and the iOS 27.0.1 update.

Conclusion

Safari 27 adds a focused privacy measure by blocking network access to identity resolution infrastructure across Apple’s iOS, iPadOS, macOS and visionOS 27 releases. Domain-level blocking is designed to make this type of cross-site email tracking harder to bypass, though it does not prevent every form of tracking.

Frequently Asked Questions

Apple Hub