SNACK: 3-line summary
- WebKit has explained Safari’s email-tracking protection, already shipped with the OS 27 releases.
- It blocks connections to third-party identity resolvers that use email addresses to link activity across websites.
- iCloud+ subscribers can add Hide My Email; the browser blocking itself does not require a subscription.
WebKit’s October 19, 2026 post explains how Safari blocks infrastructure used for email-based cross-site tracking. The protection has already shipped in Safari and WebKit with iOS 27, iPadOS 27, macOS 27 and visionOS 27.
Snackgirls react
AIKO: An email address can last for decades. I’d like to trace how that one durable key connects an identity graph after the cookies are gone.
Nea: The store-and-hockey example makes me uneasy. I’d like to subscribe to a newsletter without having an unrelated interest folded into the same profile.
One email address, several tracking IDs
WebKit describes a process in which invisible third parties collect an email address entered during login or newsletter signup and send it to an identity-resolution server. The server returns an opaque tracking ID tied to that address, which the website stores.
An email address can stay in use for years, helping connect activity across websites and devices without cross-site cookies. Logging out or unsubscribing does not remove the email address or tracking ID held by the third party.
Where Safari cuts the connection
Safari and WebKit block network access to identity-resolution infrastructure at the domain level, stopping email addresses from being sent to those servers. Changing a request’s structure does not bypass that domain-level block.
WebKit distinguishes this third-party matching from ordinary first-party personalization, which it does not seek to prevent. Its illustrative store-and-hockey diagram shows the difference: a central resolver matches the same person across separate datasets, enabling connections an individual website could not make on its own.
Hide My Email adds a separate layer
For iCloud+ subscribers, Hide My Email lets users give each new website a unique, randomized email address while still receiving its messages in their inbox. This offers additional protection against email-based tracking and is separate from the browser’s network blocking.
These protections address email-based tracking, but they are not a guarantee of complete anonymity or protection from every tracking method.
Sources and checked date: October 25, 2026
Comments
0No login needed. Edit or delete your comment from the same browser.
All comments 0
한국어 · English · 日本語No comments yet. Start the conversation.