Apple Says Safari Now Blocks Email-Based Ad Tracking, Naming No Companies in Its Explanation

A month after Safari started cutting off ad-identity companies, Apple has explained itself. Engineers on the WebKit team published a blog post late Monday, Oct. 19, laying out the rationale for the blocks.

The target is what the industry calls "identity resolution." Adtech companies stitch together data points such as email addresses, phone numbers, IP addresses, browsing history and device details to recognize the same person across sites and devices.

How the tracking works, per Apple

When someone types an email address into a site to log in or sign up for a newsletter, a company working with that site can receive it and turn it into an ID. That ID lets advertisers recognize the person across other sites without cookies.

Apple's post argues that email has taken the place of the cookie. Safari began blocking cross-site cookies six years ago. "It's not enough to block cross-site cookies to prevent cross-site tracking today because the tracking industry has not stopped trying to track users on the web," Apple wrote. "They have ushered into what they call the post cookie era and in our latest releases we have put strong protection in place."

Apple also argues the new method is harder for users to escape. Most people keep one email address for years and use it on every device, so the tracking follows them everywhere. Logging out of a site or unsubscribing from a newsletter does nothing, Apple wrote, because the third party keeps the tracking code and the address either way. Each login or form adds detail to what the company calls an identity graph.

Apple's core point is about expectations. A person might hand over an email to get a newsletter, but, in Apple's words, wouldn't expect it to be shared with other companies for invisible tracking.

What got blocked

The blocks arrived with Apple's latest software update and came to light earlier this month, without warning to the companies involved. The blocked domains included those run by The Trade Desk, LiveRamp, ID5, Permutive and Audigent.

The first rollout also stopped The Trade Desk from serving ads at all in Apple-operated browsers. Apple issued a fix a few days later that restored the company's ad-serving domain. Its Unified ID 2.0 identifier stayed blocked.

Apple's post says the protection covers more than iPhones and iPads. It extends to Macs and the Vision Pro headset. Once a user updates, Safari stops communicating with the targeted companies entirely.

The blocking works at the domain level. Apple says that is deliberate: if Safari shuts out the whole web address, a company cannot get around the restriction by changing how it formats or sends a request.

The industry's objection

The ad industry says it is bracing for the effect as more users move to iOS 27. Ad professionals previously told Business Insider's CMO Insider that the change will make it harder for advertisers to identify and reach people across the open web.

Industry insiders told the outlet that shrinking the pool of users advertisers can target cuts into both targeting and the measurement of whether campaigns work. Those are the functions identity providers sell.

Apple's own advertising business adds a complication. Digiday reports that Apple's growing ads operation puts the Safari blocklist under scrutiny. Apple's post does not address that question, and the company has not been shown to have exempted its own ad products.

What Apple left open

Apple's post draws one line it says it is not enforcing against. A business personalizing things for its own customers is not tracking, Apple said, and is not what the block is for.

What that means for a publisher is murkier. A publisher using email data it collected itself, on its own site, appears to fall on the permitted side of Apple's description. A publisher that passes those emails to an outside identity vendor to monetize its audience appears to fall on the other. Apple's post does not spell out where specific publisher setups land.

That gap matters for publishers that rely on logged-in readers to fetch higher ad prices. The identity firms Apple blocked are the ones that service that market.

The core dispute is simple to state. Apple says it is protecting users from hidden profiling they never agreed to. The ad industry says it is losing legitimate tools for reaching customers and proving its ads work, and it was given no notice before the blocks took effect.

Apple controls the browser, so its rules apply to every site and advertiser that wants Safari users. A company that sells ads has no vote on those rules.

It is not yet clear how many people will update to iOS 27, or how fast. Each update widens the share of Safari traffic where the blocked identifiers stop working. Apple has not said whether more companies will be added to the blocklist.