Apple's Safari blocks trackers that turn emails into IDs

Email addresses have become a stable cross-site identifier in the post-cookie era. When a user logs in or subscribes, a third-party service can receive that address, create a permanent tracking ID linked to it, and return the ID to the page. Even logging out or unsubscribing does not remove the stored link, and the ID can be used to build a profile or target ads across sites.

Apple's new safeguards, built into Safari and WebKit, block network connections to the infrastructure these identity resolution services embed in pages. The blocking happens at the domain level, so providers cannot evade it by changing request structure. WebKit says the aim is to preserve first-party personalization while stopping this covert form of tracking.

The protections are included in iOS 27, iPadOS 27, macOS 27, and visionOS 27. Users who want an extra layer can use Hide My Email with iCloud+, which generates unique randomized addresses that forward messages to the real inbox, reducing the chances a single address can be linked across sites.