Safari now blocks identity resolution services, third parties that collect a visitor's email address when they log in or sign up and return a persistent tracking ID. WebKit announced the change on October 19, 2026 for the iOS, iPadOS, macOS and visionOS 27 releases. If your site sends email addresses to such a service, those calls will fail for Safari users.
Most small business sites will not notice. Sites that run ad, audience or data-partner scripts on login and newsletter forms should check what those scripts do. This article explains what WebKit announced, what is and is not affected, and the steps worth taking.
Key takeaways
- WebKit said on October 19, 2026 that Safari blocks network access to identity resolution infrastructure in the iOS, iPadOS, macOS and visionOS 27 releases.
- Identity resolution services collect an email address at login or signup and return a persistent tracking ID used for cross-site profiling and ad targeting.
- Blocking is done at the domain level, and WebKit says first-party personalization is not the target.
- Site owners should list third-party scripts that receive email addresses, check Safari data in reports, and lean on first-party, consented data.
What happened
In a WebKit blog post titled Blocking Identity Resolution Infrastructure, dated October 19, 2026, John Wilander, Charlie Wolfe and Matthew Finkel wrote: "Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking."
The post describes the technique like this:
- A visitor logs in or signs up for a newsletter, typing their email address.
- A third party, not the website owner, invisibly collects that email address.
- The third party creates an opaque tracking ID tied to the email and returns it to the site, where it can be used for cross-site profiling and ad targeting.
- The post's example shows four websites sending the same address to one identity resolution server and each getting back a different ID, which the server can link together.
WebKit calls identity resolution a post-cookie tracking method and points out that the ID survives the visitor's own choices: "Logging out or unsubscribing from that newsletter does not remove the tracking ID."
How the blocking works
The key line for site owners is: "The blocking is done on the domain level." WebKit says this stops the email address from reaching the provider's servers at all, and that providers cannot get around it by restructuring their requests.
| Detail | What WebKit said |
|---|---|
| Announced | October 19, 2026 |
| Platforms | Safari and WebKit in iOS, iPadOS, macOS and visionOS 27 releases |
| What is blocked | Network access to identity resolution infrastructure |
| Method | Domain-level blocking |
| Browsing mode | Not limited to Private Browsing in the post |
| Not the target | "First party personalization is not tracking, and is not what our technologies seek to prevent." |
| Named providers | None |
The post does not name any companies or list the blocked domains, and it does not mention hashed email addresses. We do not speculate here about which vendors are affected.
Why WebKit is doing it
WebKit's tracking prevention policy defines cross-site tracking as "tracking across multiple first party websites; tracking between websites and apps." It also says WebKit treats "circumvention of shipping anti-tracking measures with the same seriousness" as security exploitation, and may "add additional restrictions without prior notice." The identity resolution post ends with a commitment: "We will continue to prevent covert and cross-site tracking by default."
The post also points iCloud+ subscribers to Hide My Email, which creates unique random addresses for new sites so one email address cannot act as a shared identifier.
Who this affects
- Ecommerce stores and publishers that use audience, data-partner or ad-tech scripts on signup, login or checkout forms.
- Businesses buying audience-based advertising where reach or match rates depend on email-based IDs collected on their own site.
- Agencies that install tag manager containers with many third-party tags for clients.
- Most brochure and local service sites, which typically just send form entries to their own inbox or CRM, are unlikely to be affected. WebKit says first-party personalization is not the target.
The reach depends on your audience. Safari is the default browser on Apple devices, so sites with many iPhone and Mac visitors have more Safari traffic to think about. Check your own analytics rather than assuming a share.
What to do now
- List every third party that touches your forms. Open your tag manager and site code and note which scripts run on login, signup, newsletter and checkout pages. Our website technology checker gives a quick first look at what a page loads.
- Ask each vendor a direct question. For any ad, audience or data tool, ask: does this script send visitors' email addresses to your servers, and how does it behave in Safari 27? Ask for the answer in writing.
- Keep sign-ups first party. Make sure newsletter and login forms send data to your own systems or your email platform first, so a blocked third-party call never breaks the form. Test each form in current Safari on an iPhone and a Mac after any change.
- Compare Safari with other browsers in your reports. If audience sizes, match rates or attributed conversions drop for Safari but not Chrome after Apple's 27 updates, a blocked script is a likely cause worth investigating with the vendor.
- Measure campaigns with tools that do not need cross-site IDs. Clean UTM tags on email and social links still tell you which campaign brought a visit. Our UTM builder and UTM parameters guide cover the basics.
- Review your privacy notice and consent setup. If you share email addresses with third parties, your privacy notice should say so. The rules differ by jurisdiction: in California, the California Privacy Protection Agency oversees the CCPA, and other US states have their own laws; in the UK and EU, GDPR and cookie rules apply. Our privacy policy generator can give you a starting draft, and our posts on cookie consent under the Data (Use and Access) Act and ICO cookie enforcement cover UK rules. Get legal advice for anything specific to your business.
- Invest in data people choose to give you. Email lists, accounts and loyalty programs built on clear consent are first-party relationships, which WebKit explicitly says it is not trying to stop.
You can also check your response headers with our HTTP headers checker while you audit scripts. The free tools at /tools need a free account.
Frequently asked questions
What is identity resolution in marketing?
In WebKit's description, identity resolution is when a third party collects a visitor's email address at login or signup, creates a tracking ID tied to it, and returns that ID to the website. Because people use the same email address on many sites and devices, the ID can link their activity across them for profiling and ad targeting.
Does Safari block all email collection on websites?
No. WebKit's post says the blocking targets identity resolution infrastructure and that "first party personalization is not tracking." Your own signup forms, login systems and email lists are not the target, as long as the email address is not sent to a blocked third-party service.
Which Safari versions block identity resolution?
WebKit says the blocking is in Safari and WebKit in the iOS, iPadOS, macOS and visionOS 27 releases. The post does not give a specific point version. Safari 27.2 was released on October 26, 2026, so make sure test devices run the latest 27.x update.
Which identity resolution companies does Safari block?
WebKit does not name any companies or publish the list of blocked domains in its post. If you use an audience or data-partner tool, ask the vendor directly whether its scripts send email addresses to its servers and how they behave in Safari 27.
Will this affect my Google Analytics or email marketing?
The WebKit post does not name analytics or email marketing platforms. Sending sign-ups to your own email platform is a first-party relationship, which WebKit says it does not seek to prevent. If you see unexpected drops in Safari data after the 27 updates, check which third-party scripts run on your forms.
What is Hide My Email?
Hide My Email is an iCloud+ feature that, as WebKit describes it, lets subscribers create unique, random email addresses for new sites. WebKit mentions it as extra protection against email-based tracking, since each site gets a different address. Treat these addresses like any other subscriber address on your list.
Sources
More guides for your industry
Free checklist (PDF)
Free e-commerce brands website checklist
30 practical checks for e-commerce brands: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
