Apple has introduced new anti-tracking protections in Safari and WebKit that block connections to identity resolution services, which turn email addresses entered on websites into persistent tracking identifiers.
The protections ship in Apple’s iOS, iPadOS, macOS, and visionOS 27 releases, targeting infrastructure used to track people across websites and devices without relying on third-party cookies.
WebKit’s team explained how these services collect personal information during ordinary activities, such as logging into a website or subscribing to a newsletter.
WebKit is the browser engine powering Safari and other applications. Apple’s latest measure extends its tracking prevention efforts beyond cross-site cookies, which Safari fully blocked six years ago.
Turning email addresses into tracking IDs
Identity resolution provides a way to recognize users even when browsers restrict cookie-based tracking.
According to WebKit, third parties embedded in webpages silently collect a visitor’s email address and transmit it to their servers. The service generates an opaque identifier permanently associated with that address and returns it to the webpage, where it is stored for subsequent use.
Although individual websites may receive different identifiers, the resolver can connect them through the underlying email address. This allows browsing activity and advertising profiles to be associated with the same person across otherwise separate sites.
Logging out of an account or unsubscribing from a newsletter does not remove either the tracking identifier or the email address held by the third party.
As people visit more websites and complete additional forms, resolvers can build profiles, known as identity graphs, by accumulating information. Email addresses and phone numbers also enable cross-device matching, extending tracking beyond a single browser.
Apple argues that this repurposes information users supplied for a specific task. For example, someone providing an address to receive a newsletter would not ordinarily expect it to become the basis for long-term profiling by another company.
Blocking connections at the domain level
The new protection blocks network access to identity resolution infrastructure at the domain level, preventing affected services from receiving email addresses through those connections.
Because the restriction applies to the destination domain, changing the structure of a network request alone will not bypass it.
Apple distinguishes these intermediaries from the login providers and newsletter services users intentionally interact with. It also says first-party personalization remains outside the protection’s intended scope.
However, the company argues that a central resolver still creates a tracking capability when it matches information across businesses, even if each participating business describes its own dataset as first-party data.
Ad fraud researcher Dr. Augustine Fou argued that advertisers may be losing less useful targeting data than they assume. He cited research showing that identity providers assigned identifiers to self-declared bots, along with a separate study highlighting inaccurate audience segments. Fou argues that reducing reliance on these identifiers could benefit advertisers and users, though that remains his interpretation rather than an outcome established by Apple’s announcement.
For additional protection, users can provide a different email alias to each website, reducing the usefulness of their address as a shared identifier. Apple points to Hide My Email, included with iCloud+, which generates randomized addresses and forwards incoming messages to the subscriber’s inbox.
Leave a Reply