Websites can still recognise a visitor long after cookies were cut off, by quietly taking the email address typed into a login box and swapping it for a permanent identifier held by a third party. Apple has moved to cut that wire in Safari.
The WebKit team, which builds the engine underneath Safari on Mac, iPhone, iPad and Vision Pro, published an explanation this week. Providers whose business is converting email addresses into identifiers are now unreachable: connection attempts to those servers are refused outright, so the address never leaves the device.
Most consumers keep a single mailbox for years, making it a near-permanent handle linking accounts, devices and shopping habits. Each time a resolver receives that address it appends detail to a profile the industry calls an identity graph, layering names, phone numbers, home addresses, network addresses and first-party cookies into one record. Leaving a site or opting out of a mailing list deletes neither the identifier nor the address held by the resolver.
Because the rule keys to the destination host rather than the shape of an individual request, a resolver cannot slip past it by reformatting its scripts. Apple frames the rule as a boundary around third parties the visitor never chose to deal with, leaving first-party personalisation alone. A resolver’s claim that its data counts as first-party because each client owns its own set does not hold up, in Cupertino’s view, once one clearinghouse matches records across unrelated businesses.
The defence arrives with iOS 27, iPadOS 27, macOS 27 and visionOS 27, so older devices stay exposed until they update. iCloud+ subscribers have a second layer in Hide My Email, which manufactures a fresh random address per site and forwards replies to the real inbox, blunting the shared handle entirely.
