How identity resolution tracks you by email address instead of cookies, what Safari 27 now blocks, and why partitioning and anti-fingerprinting don't help.
In its iOS, iPadOS, macOS and visionOS 27 releases, Safari and WebKit now block network access to a class of tracking infrastructure called identity resolution. WebKit announced it in Blocking Identity Resolution Infrastructure on October 19, 2026. The news is Safari-specific, but the technique is not: it tracks you by the email address you type into a login or signup form, so it needs no cookie and no fingerprint. This article explains how it works, why the usual defences miss it, and what you can do about it in any browser.
Key Takeaways
- Identity resolution keys tracking on your email address. Per WebKit, a third-party script invisibly collects the email you enter when you log in or sign up for a newsletter, sends it to its own server, and gets back an opaque tracking ID tied to that address.
- The ID outlives your actions. WebKit states that logging out or unsubscribing does not remove the tracking ID or the email address held by the third party.
- It links sites and devices. Combining emails and phone numbers builds an "identity graph" that supports cross-site and cross-device tracking.
- Cookie and fingerprint defences don't touch it. An email is a deterministic identifier you typed yourself. Storage partitioning has nothing to partition, and anti-fingerprinting noise has nothing to blur.
- Safari 27's answer is blocking at the domain level. WebKit says this stops the request that carries your email to the resolver, and that changing the shape of the request does not get around it.
How Identity Resolution Works
WebKit describes the scheme in four steps, and the structure is worth seeing plainly:
- Capture. You type your email address into a login form or newsletter box on a website. A script from a third party (not the site owner) is present on that page and collects the address without any visible sign.
- Send. The script sends the address to the third party's servers.
- Assign. The server creates an opaque tracking ID permanently linked to that email address and sends it back to the page.
- Reuse. The ID is stored on the website and can then be used for arbitrary purposes tied to your email, such as profiling your browsing or targeting ads at you across websites.
The important part is what happens over time. Each time you log in with that address or fill in a form with personal data on another participating site, the same third party learns a bit more. The accumulated record is the identity graph. Email addresses and phone numbers are usually personally identifiable information, and for most people an email address is a globally unique ID kept for years, sometimes decades. That is why the graph can follow you across sites and across devices, not just within one browser.
Why This Is "Post-Cookie" Tracking
WebKit frames identity resolution as the industry's answer to cross-site cookie blocking, which Safari completed years ago (see Safari's ITP, mechanism by mechanism). If a tracker can no longer recognise you by a cookie it sets in your browser, it can recognise you by something you hand over voluntarily.
Compare the three families of cross-site tracking:
| Family | What carries the identity | What a browser defence removes |
|---|---|---|
| Cookies and storage | A value stored in your browser | Block, partition or expire the storage |
| Fingerprinting | Traits computed from your browser and device | Reduce or randomise the signals |
| Identity resolution | The email address you type | Block the network request that sends it |
Storage-based tracking is covered in storage partitioning and bounce tracking. Signal-based tracking is the subject of persistent visitor IDs and the browser fingerprinting guide. Identity resolution sits beside both and is immune to the defences built for them.
Why Partitioning and Anti-Fingerprinting Don't Help
Partitioning works by giving each site its own separate copy of storage, so an identifier written on one site cannot be read on another. But an email address is not read from storage. You type it fresh into each site, and the resolver receives it each time. Whatever isolation the browser applies, the same string arrives.
Anti-fingerprinting works by shrinking how distinctive your browser looks. Your email address is not a browser trait. Making your canvas output noisy or your font list shorter changes nothing about an address you typed yourself.
Both defences protect against inferred or stored identity. Identity resolution relies on declared identity. That is the real shift, and it is why WebKit's response is a different kind of defence: not a storage rule, but blocking the network path to the resolver.
What WebKit Says It Does, and What It Doesn't
From the announcement:
- It blocks network access to identity resolution infrastructure in the 27 releases of iOS, iPadOS, macOS and visionOS. Blocking at the domain level means the resolver cannot dodge it by restructuring the request.
- It targets third-party resolvers specifically. WebKit describes these companies as present but invisible on many pages where you enter an email address. They are not the login provider or newsletter service, "just there to track you."
- It does not target first-party personalization. WebKit says explicitly that first-party personalization "is not tracking, and is not what our technologies seek to prevent." A shop remembering your own order history is outside the scope.
- The central resolver is the problem even when each site is honest. Even if every site's graph covers only its own data, WebKit notes that a central resolver holds cross-site, cross-device and cross-party data and can act as a clearinghouse. That is a capability no single first party has alone.
The announcement does not list the blocked domains, so this article doesn't either.
What You Can Do in Any Browser
Browser-level blocking only helps people whose browser ships it. The underlying fix is on the input side: the address you give out.
- Use a unique address per site. If the email you type differs on every site, there is nothing to join. Some email providers offer aliases for this. WebKit itself points to Apple's Hide My Email for iCloud+ subscribers, which creates unique, random addresses for each new website while still delivering messages to your inbox.
- Keep a separate address for newsletters and marketing sign-ups. It limits what one address can connect.
- Be aware that unsubscribing is not erasure. Per WebKit, unsubscribing does not remove the ID or the address held by a third party.
- Don't expect privacy settings alone to cover it. Strict anti-fingerprinting, clearing cookies or using a VPN does not change the email you submit.
Where Your Browser Fingerprint Fits In
BrowserInsight's fingerprint check shows what a site can learn about you without you typing anything: your canvas output, fonts, screen and so on. Email-based matching needs none of that list. That is why the two defences differ. A fingerprint is reduced by making your browser look like many others; an email-keyed ID is reduced by changing what you submit, or by a browser that cuts the request off. We don't claim any BrowserInsight tool detects identity-resolution scripts. The fingerprint check covers the other half of the picture.
Identity resolution also has company in the broader category of trackers hiding inside what looks like normal site behaviour. See cross-site login detection and CNAME cloaking for two other cases where a third party sits inside a first-party flow.
Frequently Asked Questions
Is identity resolution the same as logging in with Google or Facebook?
No. WebKit separates the two: the resolver is not a login provider or newsletter service. It is a third party present on the page to collect your address for tracking.
Does Safari 27 block it only in Private Browsing?
The WebKit announcement describes the blocking as part of the 27 releases and does not mention Private Browsing at all. It presents no such limit, but it also doesn't spell out the scope in more detail, so check Apple's own release notes if this matters to you.
If I never log in anywhere, am I safe?
The scheme depends on you entering an email address or other personal data into a form. Not entering one gives it nothing to capture, but the other tracking families, such as cookies and fingerprinting, still apply.
Does clearing cookies remove my tracking ID?
Not the part that matters. The ID is tied to your email address on the third party's servers. WebKit says logging out or unsubscribing does not remove it.
Conclusion
Identity resolution is tracking that asks you for the identifier instead of taking it from your browser. That is why storage partitioning and anti-fingerprinting, both aimed at identifiers a browser holds or exposes, leave it untouched, and why Safari 27 answers it by blocking the resolvers' network access outright. If your browser doesn't, the practical lever is the address you submit: a different one per site leaves the resolver nothing to join.
Recommended Reading:
- Safari's Intelligent Tracking Prevention, Mechanism by Mechanism
- Persistent Visitor IDs: Surviving Incognito, VPNs & Cache Clears
- Storage Partitioning: How Browsers Double-Key Your State
- Bounce Tracking Explained: Redirects That Track Without Cookies
- Browser Fingerprinting Explained: How to Protect Your Privacy
