Safari 27 Blocks Identity Resolution Tracking Across Websites

Blocking third-party cookies no longer addresses every way a company can follow someone across websites. Apple says Safari and WebKit will also block network access to identity resolution services in its iOS, iPadOS, macOS, and visionOS 27 releases. The change targets a system that can turn an email address supplied to one website into a persistent identifier used to connect activity across other sites and devices.

The practical distinction is where the information goes. A site can use information a person provides to personalize that person’s experience on its own service. Identity resolution adds an outside service that receives personal information, links it to data from other sources, and returns an identifier that can support broader tracking. Apple’s stated aim is to block that third-party path while preserving first-party personalization.

How identity resolution links activity

In the model Apple describes, an identity resolution provider is embedded in or otherwise active on websites where people log in or submit forms. When someone enters an email address, the provider sends it to its own servers and associates it with a persistent tracking ID. That ID is returned to the website and stored there. A different site can submit the same email address and receive another site-specific ID, while the service behind them can recognize that both belong to the same person.

That connection can outlast the interaction that supplied the address. Logging out or unsubscribing from a newsletter does not, by itself, erase the identifier held by the service, according to Apple’s description. As people provide more information on participating sites, the provider may connect those details into an identity graph: a profile linking identifiers, personal data, and activity from multiple sources.

Email addresses and phone numbers can be especially useful for this kind of matching because people may keep them for years and use them across services. That makes the resulting link potentially cross-device as well as cross-site. Someone who supplies an address to access an account or receive a newsletter may not expect that information to reach an outside company for longer-term profiling or ad targeting.

Apple draws a line between a company using information to personalize its own service and an outside resolver that can match records across companies. Even when each site’s own use is limited to its customers, the resolver may hold information spanning multiple sites and provide matching or targeting capabilities. That shared infrastructure gives a single site access to connections it could not establish from its own records alone.

What Safari’s block changes

Apple says Safari and WebKit will block network access to identity resolution infrastructure at the domain level. In effect, the service’s domain is prevented from receiving the request that could carry an email address. Blocking the destination itself also makes it harder to evade the protection simply by changing how a request is structured.

If the request is stopped before the provider receives the address, the provider cannot create or update its link through that exchange. That cuts off the first step in the chain Apple describes: collecting an identifier, returning a tracking ID, and using the connection for activity across sites. The change is aimed at third-party infrastructure that may appear on many pages without being the service a person is directly using to log in or subscribe.

The scope matters. Apple describes this as a way to prevent covert, cross-site tracking, not as a ban on a site using customer information for its own personalization. The distinction rests on whether a third party can pool or match information across different services. For teams operating websites, the change may affect integrations that depend on sending sign-up or login details to an identity resolution provider; the source does not specify how individual integrations will behave when their requests are blocked.

Hide My Email and remaining questions

Apple also points to Hide My Email, available to iCloud+ subscribers. It lets people use a distinct randomized email address for each new website while still receiving messages in their inbox. Separate addresses can make it harder to link activity by matching the same email across services, though they do not replace Safari’s network blocking.

The change follows Apple’s earlier move to block cross-site cookies in Safari. That step limited one common tracking mechanism, but identity resolution uses information people enter into forms and account fields instead. The new protection is aimed at that different route, and its reach depends on which services Safari identifies as identity resolution infrastructure and how those services are used by websites.

Apple says it plans to keep preventing covert, cross-site tracking by default while allowing first-party personalization. For site operators, the immediate practical question is whether an outside identity service is part of their sign-up or login flow. For users, the key change is that Safari will block the described network requests in its version 27 releases, while unique email aliases offer another way to limit cross-site matching.

Apple’s WebKit Tracking Prevention Policy describes its broader approach to web tracking. The next measure of this update will be how the domain-level blocks work across real site integrations and whether services adjust their methods in response.

Subscribers can learn more about Hide My Email.