Safari blocks third-party identity resolution, and ad tech's answer is to move tracking server-side

Apple's WebKit team has started blocking Safari's network access to third-party identity resolution services, the infrastructure that turns an email address typed into a login or newsletter form into a persistent ID that follows a person across sites and devices. The change arrived with iOS, iPadOS, macOS and visionOS 27, which began reaching users on September 14, and WebKit explained its reasoning in a blog post on October 19. Ad tech vendors are now racing to move the same tracking functions onto their own servers, where Safari's rules don't reach.

What Safari now blocks

Identity resolution works by collecting an email address at login or newsletter signup, then assigning that address a tracking ID that outlives the purpose it was collected for. WebKit's engineers, John Wilander, Charlie Wolfe and Matthew Finkel, wrote that the companies providing this infrastructure often stay invisible on the page — not login providers or newsletter tools themselves, just there to watch. First-party use of an email address isn't affected; WebKit says plainly that first-party personalization is not what it's trying to stop.

"Logging out or unsubscribing from that newsletter does not remove the tracking ID." WebKit blog, October 19

WebKit's own framing of the stakes is blunt: for most users, it says, an email address is a unique identifier people keep for years or decades, which is exactly why it makes such a durable tracking key. The block works at the network and domain level, so changing the shape of a request doesn't get around it, and Apple's policy makes no exceptions for specific vendors or use cases. Digiday's live tests during the week of October 19 found the restriction already hitting five identity vendors: ID5, LiveRamp, Audigent (an Experian company), Permutive and The Trade Desk. A column in the trade newsletter ADOTAT, reported by PPC Land, traces the technical trigger further back, to a WebKit code change merged in February and a bug report The Trade Desk's engineers filed in September after their own ad-serving domain stopped resolving. Apple has not published a list of affected domains, and it did not respond to Digiday's questions about which companies are targeted or why.

Who it hits

The immediate casualties are the identity vendors themselves, several of which sell directly into B2B and SaaS marketing stacks for cross-device attribution, retargeting and customer data platform matching, not just consumer ad tech. The bigger exposure sits one layer up, with any software company that buys programmatic or retargeting media, stitches its CRM to an identity graph, or leans on a vendor's "universal ID" to measure what a campaign did on Safari traffic. ID5 CEO Mathieu Roche told Digiday the company is moving more of its infrastructure server-side and already testing revised integrations with select publishers — work he said larger organizations can finish in days rather than months, while smaller teams that outsource ad operations will find it harder.

• Reported conversions from Safari traffic will likely drop, even where underlying sales didn't change.
• Attribution will tilt toward last-click and toward platforms that run their own logins, such as Google and Meta.
• Retargeting pools built on Safari traffic will shrink as the identifiers behind them stop resolving.
• Vendor "match rate" numbers that marketing teams use to judge identity providers will need re-checking against Safari segments specifically, not blended totals.

A study of 600,000 websites over 41 months, cited by trade outlet TechRound, found nearly 84% had already added alternative identifiers by May 2025 — evidence the industry saw this coming well before WebKit's post made it explicit. IAB Tech Lab's Trusted Server Framework, introduced in March 2025, is the main response: it moves ad requests, bidding and ad stitching onto publisher- or vendor-controlled servers instead of the browser. TeqBlaze CEO Anastasia-Nikita Bansal, who sits on the framework's working group, told Digiday that no server-side solution is guaranteed to last, and warned vendors against using the migration as cover to charge publishers more. IAB Australia's Amy Jansen-Flynn raised a separate concern: restricting addressability for independent publishers while Apple, Google and Meta keep their own concentrates ad spend further into the walled gardens that software vendors still have to buy into.

What to do now

WebKit's policy explicitly reserves the right to add restrictions without notice, which leaves software marketers with less certainty, not more: the vendors racing to rebuild on servers today could still find themselves back on a blocklist if Apple decides server-side resolution raises the same objection it already made about the browser. Apple does offer one narrow workaround for users, not marketers — Hide My Email, an iCloud+ feature that forwards mail sent to a randomized address, which quietly reduces the supply of real email addresses available for resolution in the first place.