Safari 27 now blocks trackers that turn email addresses into ad IDs. What it means for your sign-up forms and ads

Apple’s WebKit team says Safari 27 blocks a type of advertising technology that quietly turns the email address you type into a website into a long-lasting tracking ID. If your website has a newsletter sign-up, a login or a checkout, and your ads rely on outside “identity” services, some of that tracking will stop working for visitors on Safari 27.

Apple’s WebKit team, which builds the engine behind Safari, explained the change in a blog post on 19 October 2026, signed by John Wilander, Charlie Wolfe and Matthew Finkel.

What Safari now blocks

WebKit calls the target “identity resolution”, which it describes as a “post-cookie” tracking method. According to the post, third parties that aren’t the website owner invisibly collect your email address when you log in or sign up for a newsletter, send it to their own servers, create a tracking ID permanently linked to that address and hand the ID back to the page. The ID can then be used to build a profile of your browsing or target ads at you across websites. WebKit says logging out or unsubscribing doesn’t remove the ID or the email address held by the third party, and that these companies can build up an “identity graph” over time.

In the iOS, iPadOS, macOS and visionOS 27 releases, WebKit says, Safari and WebKit block network access to this identity resolution infrastructure. The block works at the domain level, “meaning they can’t just change the structure of the network request to work around the protection”.

WebKit says it is targeting companies that “are not themselves login providers or newsletter services”. It says first-party personalisation is not tracking and is not what it is trying to prevent. But it adds that a central identity resolver is still a third party even when it only handles one company’s data.

Which companies are affected

The blog post doesn’t name any companies or publish a list of domains. A public WebKit bug report filed on 21 September 2026 does list the domains in Safari’s block list at the time, including uidapi.com, adsrvr.org, id5-sync.com, rlcdn.com, pippio.com, permutive.com and ad.gt. The person who filed the report argued that adsrvr.org is The Trade Desk’s main ad request and delivery domain rather than an identity service.

WebKit’s John Wilander replied on 5 October that a new iOS 27.2 beta had shipped for testing, and wrote “Confirmed resolved” on 9 October; the bug is now marked resolved. The bug report doesn’t say exactly what changed, so it isn’t clear from the public record which domains remain blocked. PPC Land reported that the beta appeared to unblock adsrvr.org.

Trade publication PPC Land says that for advertisers, Safari 27 sessions will no longer carry IDs from blocked resolvers, so audience segments built on those IDs may not match those users, and publishers that load these IDs through a client-side script lose them for Safari 27 visitors.

Why it matters in Australia

Safari is a large slice of the Australian web. StatCounter’s figures put Safari at 32.43% of browser use across all platforms in Australia in September 2026, behind Chrome at 50.23%. StatCounter’s figure covers all Safari versions, but on our reading, if a campaign, retargeting list or audience you buy depends on one of these identity services, a growing share of that third of Australian browsing will fall outside its reach as people update to version 27.

In our experience, small businesses rarely buy from identity resolution companies directly. These services usually arrive through programmatic advertising platforms, audience data deals or tags added to a website by an agency or a plug-in. That’s why the first job is finding out what’s on your own site.

This builds on earlier Safari changes. WebKit says Safari fully blocked cross-site cookies six years ago; its Tracking Prevention Policy sets out the wider rules. Apple also offers Hide My Email to iCloud+ subscribers, which gives each website a unique, random address that forwards to the person’s inbox. WebKit points to it as extra protection against email-based tracking, and it also means some of your Apple customers will sign up with addresses that don’t look like their real ones.

For the wider rules on handling customers’ personal information, see our guide to Privacy Act changes for small businesses.

Checklist

• List the tags on your sign-up and login pages. Open your tag manager or ask your web developer which third-party scripts load on pages where people enter an email address.
• Ask your agency or ad platform about email-based identity IDs. Find out whether any campaign, audience or retargeting list you pay for relies on a service that turns email addresses into tracking IDs, and how it performs on Safari 27.
• Compare Safari results with other browsers. In your analytics and ad reports, check conversions and audience sizes for Safari users separately, and watch for changes as visitors update to Safari 27.
• Lean on your own customer data. Build offers and personalisation from data customers give you directly on your own site, without passing it to a third-party identity service; WebKit says first-party personalisation isn’t what it’s trying to block.
• Don’t try to route around the block. WebKit says Safari 27 blocks identity resolution services at the domain level, so changing how a request is built won’t get it through.
• Expect Hide My Email addresses. Make sure your email list and customer records accept unique forwarding addresses from Apple customers who use iCloud+.