Apple blocks e-mail-to-tracking-ID conversion in Safari 27

Apple’s Safari and WebKit block connections to identity resolution services that turn email addresses into persistent tracking identifiers, a protection WebKit confirmed on Oct. 19, 2026, in iOS 27, iPadOS 27, macOS 27 and visionOS 27.

A third party collects a user’s e-mail address at login or newsletter signup. The provider sends it to its servers, creates a tracking ID permanently linked to the address, and returns the identifier to the webpage, where the webpage stores it. The ID can build a browsing profile or target ads across websites.

Logging out or unsubscribing does not remove the tracking identifier or the e-mail address held by the third party. Identity graphs can contain names, phone numbers, home and e-mail addresses, IP addresses, website accounts and first-party cookies. Providers combine information from many websites, devices and companies, and people often keep the same e-mail address for years or decades.

Apple targets third-party infrastructure firms that handle identity resolution, not first-party websites or services handling standard user authentication. WebKit says the protections preserve first-party personalization, and Apple says first-party personalization is not tracking. Apple also describes e-mail addresses as almost always a form of personally identifiable information, like a phone number.

Safari and WebKit block network access to that infrastructure, preventing webpages from sending email addresses to providers’ servers. The block operates at the domain level, so changing the structure of a network request cannot bypass it. If email addresses cannot reach identity resolution infrastructure, a profile cannot be made or checked.

Cross-site cookies have been blocked for six years, and the WebKit team said identity resolution shows continued tracking-industry efforts to follow users after that change. Apple published an Oct. 19, 2026 post to WebKit’s blog explaining efforts to minimize data collection and tracking.

Users can further limit e-mail-based tracking with Hide My Email, available with iCloud+, which creates unique randomized addresses for individual websites and forwards messages to the user’s inbox. It lets people share a random address instead of their real one.

In early October, Apple blocked an ad agency in its entirety, classifying it as a blockable data broker. The agency complained to Apple and will not see a resolution until iOS 27.2 ships.

The Trade Desk says its ads are being blocked by mistake in Safari on iOS 27 and has asked Apple to rectify the situation. Ian Meyers filed a bug report with Apple’s WebKit team about a week after iOS 27 launched in September, saying the adsrvr.org domain was on Safari’s block list. Meyers called it “core ad request and delivery domain, not identity.”

Apple employee John Wilander, who handles WebKit privacy and ad tech, said on Sept. 22 that Apple was investigating. On Oct. 4, Wilander asked Meyers to test a new iOS 27.2 beta. The bug’s status still reads NEW, and iOS 27.2 remains in beta.

Researcher James Hercher reported that Apple’s bigger Safari ad block list covers hundreds of ad tech, data and identity companies, including Unified ID 2.0, ID5, Audigent, LiveRamp and Permutive. Apple can update that list remotely without releasing a new iOS version.

Ad fraud researcher Dr. Augustine Fou argued advertisers may be losing less useful targeting data than they assume, but called that his own interpretation.