WebKit Says Safari and WebKit 27 Block Network Access to Identity Resolution Infrastructure, Targeting Email-Based Tracking
In its iOS, iPadOS, macOS and visionOS 27 releases, WebKit blocks network access to identity resolution services at the domain level, so they cannot receive users' email addresses.
Overview
The WebKit team has described a new tracking protection in its iOS, iPadOS, macOS and visionOS 27 releases. In a WebKit blog post dated October 19, 2026 and written by John Wilander, Charlie Wolfe and Matthew Finkel, the team states: “In our iOS, iPadOS, macOS, and visionOS 27 releases, Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking.” The change targets a technique the authors describe as a “post-cookie” tracking method.
What We Know
How identity resolution works
According to WebKit, identity resolution is a scheme in which third parties, meaning parties other than the website owner, “invisibly collect your email address when you log in or sign up for a newsletter.” The post says they send the address to their servers, create an opaque tracking ID permanently linked to it, and send that ID back to the webpage. The ID is then stored on the website and can be used for purposes linked to the email address, such as building a profile of browsing or targeting ads across websites.
The post adds that logging out or unsubscribing from a newsletter does not remove the tracking ID or the email address stored with the third party. Over time, WebKit writes, these third parties collect more data as users log in or fill in forms, and use it to create a data profile known as an identity graph. The authors write that email addresses “almost always constitute Personally Identifiable Information, or PII,” and that such information allows for cross-device as well as cross-site tracking, per the same WebKit post.
What Safari now does
The post says the targeted companies are third-party infrastructure that is present but invisible on many pages where users enter an email address or log in. In WebKit’s words, they are “not themselves login providers or newsletter services.” By blocking network access to them, Safari stops them from receiving the email address and, in the authors’ phrasing, “all the downstream effects of that.”
WebKit says the blocking is done at the domain level, “meaning they can’t just change the structure of the network request to work around the protection.” The post does not name the domains or companies that are blocked, and it does not describe how the blocked set is chosen or updated.
Limits of the protection
The authors draw a line around what the feature is meant to stop. “First party personalization is not tracking, and is not what our technologies seek to prevent,” the post states. They argue, however, that even when an identity graph is scoped to a single company, “the central identity resolver is a third party” that holds cross-site, cross-device and cross-party data and can act as a clearinghouse, a capability the individual first parties do not have on their own.
The post also points to Hide My Email, which it says offers iCloud+ subscribers the ability to submit unique, randomized email addresses to each new website while still receiving messages in their inbox.
Context
The post says WebKit “fully blocked cross-site cookies six years ago.” WebKit’s separate tracking prevention documentation states that its default cookie policy on Apple platforms is to disallow a third party from setting new cookies unless it already has cookies, and that third-party LocalStorage and IndexedDB are partitioned per first-party website. The identity resolution block addresses a method that the post describes as emerging after cross-site cookies were blocked.
The Machine Herald previously reported on the Safari 27 release, which focused on developer-facing features.
What We Don’t Know
- Which identity resolution providers are blocked, and how many.
- How the blocking might affect legitimate login or newsletter flows on sites that integrate with such services; the post does not discuss this.
- Whether other browser engines plan comparable protections; the post does not address it.
The WebKit team closes the post by saying it will “continue to prevent covert and cross-site tracking by default, while maintaining the ability for websites to provide first-party personalization to their users.”