Safari Blocks Email-to-Tracking ID Conversion
Apple's Safari and WebKit are introducing new privacy protections to block identity resolution services from converting user email addresses into persistent tracking IDs.
Apple is enhancing user privacy by implementing new protections within Safari and its underlying WebKit engine to thwart a growing post-cookie tracking method. This new feature specifically targets identity resolution services that leverage user email addresses, collected during website logins or newsletter sign-ups, to create persistent tracking identifiers.
The mechanism works by allowing third-party services to capture an email address when a user provides it on a website. This address is then sent to the provider's servers, where a unique tracking ID is generated and permanently associated with that email. The provider then returns this identifier to the webpage, enabling the tracking of user activity across different sites and devices, even after a user logs out or unsubscribes from a service.
These identity resolution providers build comprehensive "identity graphs" by aggregating data from various sources. These graphs can include a wealth of personal information such as names, phone numbers, home and email addresses, IP addresses, and website account details. Because email addresses often remain consistent over long periods, they serve as a powerful and lasting identifier, linking a user's online behavior across multiple platforms and devices.
WebKit's new protections aim to disrupt this process by blocking network access to the infrastructure that these identity resolution services use to collect email addresses. This prevents webpages from sending sensitive email information to the providers' servers. The protection operates at the domain level, making it more robust against attempts by tracking services to circumvent the measures by altering network request structures.
This development signifies the tracking industry's ongoing efforts to adapt and find new methods for user profiling and ad targeting in a landscape where traditional cross-site cookies are increasingly being phased out. By blocking the conversion of email addresses into tracking IDs, Apple is directly addressing a sophisticated privacy loophole that could have allowed for extensive user profiling without explicit consent.
The WebKit team emphasized that these new protections are designed to preserve legitimate first-party personalization while mitigating the risks associated with third-party identity resolution. Users can further bolster their privacy by utilizing services like Apple's Hide My Email, which generates unique, randomized email addresses for different websites, forwarding messages to the user's primary inbox and preventing direct tracking via their main email address.
These privacy enhancements are being rolled out across Apple's latest operating systems, including iOS 27, iPadOS 27, macOS 27, and visionOS 27. This proactive measure by Apple underscores a continued commitment to user privacy and a move towards more secure online experiences by tackling emerging tracking techniques.