Safari blocks trackers that turn your email into a tracking ID
Apple’s new anti-tracking protections in Safari and WebKit, the open-source web engine used by Safari, block connections to identity resolution services that turn email addresses into persistent tracking identifiers.
How email addresses become tracking IDs
This “post-cookie” tracking method allows a third party to collect a user’s email address when they log in to a website or sign up for a newsletter. The provider sends the address to its servers, creates a tracking ID permanently linked to it, and returns that identifier to the webpage.
“The tracking ID is stored on the website and can from thereon be used for arbitrary purposes linked to your email address, such as building a profile of your browsing or targeting ads at you across websites,” the WebKit team explained.
Logging out or unsubscribing leaves the identifier and email address stored with the third party.
Identity graph example (Source: WebKit)
Providers can build profiles known as identity graphs from information users share when visiting websites and filling in forms. These may contain names, phone numbers, home and email addresses, IP addresses, website accounts, and first-party cookies.
Email addresses and phone numbers can link a person’s activity across websites and devices. People often keep the same email address for years or decades, making it a lasting identifier. Providing it to access an account or receive a newsletter can expose users to tracking they did not expect.
Identity resolution providers can combine information from multiple websites, devices, and companies to support profiling and ad targeting. WebKit says its protections are designed to preserve first-party personalization.
How Safari and WebKit block identity resolution
These services use infrastructure embedded in webpages to collect email addresses users enter, often without any visible indication.
Safari and WebKit block network access to that infrastructure, preventing webpages from sending email addresses to the providers’ servers. The protection operates at the domain level, preventing providers from bypassing it simply by changing the structure of a network request.
Blocking network access (Source: WebKit)
Users can further limit email-based tracking through services such as Apple’s Hide My Email, available with iCloud+. It creates unique, randomized addresses for individual websites and forwards messages to the user’s inbox.
The WebKit team said identity resolution shows the tracking industry’s continued efforts to follow users after browsers blocked cross-site cookies.
The protections are included in Apple’s iOS 27, iPadOS 27, macOS 27, and visionOS 27 releases.
