Safari 27 blocks the third parties that turn an email address into a tracking ID
Apple said on October 19, 2026, that Safari and WebKit in the 27 releases of iOS, iPadOS, macOS, and visionOS block network access to identity resolution services. According to Apple, those services collect the email address people enter to log in or subscribe and convert it into a lasting tracking ID. Personalization a site does with its own data is not affected.
Safari now cuts off hidden third-party services that collect the email address a visitor types into a site. In a WebKit blog post published October 19, 2026, Apple engineers John Wilander, Charlie Wolfe, and Matthew Finkel wrote that the 27 releases of iOS, iPadOS, macOS, and visionOS block network access to identity resolution infrastructure. Identity resolution is a tracking method that does not depend on cookies, and Apple describes it as what the tracking industry turned to after cookies were blocked.
How email-based tracking works
As Apple describes it, a third-party script quietly picks up the email address when someone logs in or signs up for a newsletter. It sends the address to its own servers, creates an opaque ID permanently tied to that address, and hands the ID back to the page. From then on the site can use the ID to build a profile of the person's browsing or to target ads across sites.
Logging out or unsubscribing does not delete the ID or the address stored with the third party, Apple says. Over time these services merge data from many logins and forms into an identity graph, a profile of one person. Because most people keep the same email address for years, Apple argues, it allows tracking across both sites and devices.
What is blocked and what is not
Safari and WebKit block requests to these services, so the address never reaches their servers. The block works at the domain level, which Apple says means the services cannot get around it by restructuring their requests. Apple has not published the list of blocked domains or companies.
The target is not login providers or newsletter services but third parties that are present on a page only to track. Apple says personalization a site performs with data it collected itself is not tracking and is not what the protection prevents. iCloud+ subscribers can also use Hide My Email, which gives each new site a unique random address while messages still arrive in the same inbox.
Related
Anyone could compute the keys of eight eMudhra intermediate certificates, so tools outside browsers need updates
The private keys of eight intermediate certificates from the certificate authority eMudhra were small numbers that anyone could compute. Firefox, Chrome, Apple, and Microsoft blocked the certificates within three days, and Mozilla and Chrome are now removing trust in the root above them. Software with its own copy of the certificate list, from Python's certifi to Go, needs an update.
Mozillaverified
Safari 27.0 ships an MCP server, so a coding agent can drive the browser itself
WebKit published the feature list on September 17, 2026, and it is the longest the team has written: 83 features, up from 58 at the first beta in June, and 844 quality fixes against the 525 announced at WWDC. The headline for anyone who builds with a coding agent is the Safari MCP server, which hands the agent the DOM, network requests, screenshots and console output from a real Safari window. Customizable Select turns the real select element into something you can fully restyle, and scroll anchoring stops the page from jumping when content loads in above what you are reading.
WebKit Blogverified
Safari Technology Preview 252 adds named-feature() and lets SVG reach a filter in another file
The preview build came out on September 11, 2026 and covers WebKit changes between 319252@main and 320112@main. Eleven features are new, and two of them extend the same job: how a stylesheet, and then a script, finds out what the engine underneath can do. The named-feature() function asks about a behavior that has no syntax of its own, and the registry behind it holds exactly two entries today. SVG also gained external resources, so the url() reference can finally point at a filter, mask or gradient stored in another document.
WebKitverified