Safari blocks third-party identity resolution tracking
WebKit blocked network access to the invisible third-party services that turn a login email into a permanent, cross-site tracking ID, live now in iOS, iPadOS, macOS and visionOS 27.
Safari and WebKit now block network requests to identity resolution infrastructure, the invisible third parties that turn an email address typed into a login or signup form into a permanent tracking ID. WebKit engineers John Wilander, Charlie Wolfe and Matthew Finkel explained the change in a blog post on 19 October. It is already live in the current iOS, iPadOS, macOS and visionOS 27 releases, not a future beta.
The mechanism it targets: a third-party script invisibly captures the email you enter, sends it to the vendor’s servers, and gets back an opaque ID linked to that address for years, then uses it to stitch your activity together across sites and devices. WebKit blocks that network traffic at the domain level.
Why it matters: if your analytics, CDP or marketing stack leans on an email-based identity resolution or “identity graph” vendor, those calls now silently fail for anyone on Safari, which is most of iOS traffic. First-party personalisation using your own visitors’ emails is unaffected. This is specifically about third-party infrastructure you probably didn’t choose yourself.
The caveat: WebKit names no specific vendors in the post, so there is no public list of exactly which services get blocked, only the pattern of behaviour that triggers it.