What changed
On October 19, 2026, WebKit publicly described a protection already shipping in Safari and WebKit on iOS, iPadOS, macOS and visionOS 27: the browser blocks network access to third-party identity-resolution infrastructure. These services can receive an email address entered at login or newsletter signup, associate it with a persistent cross-site and cross-device ID, and return an opaque identifier to a publisher's page. WebKit says blocking occurs at the domain level, rather than by matching one particular request payload. The announcement distinguishes these resolvers from legitimate first-party personalisation and does not publish a complete blocked-domain list.
Why it matters
Developers embedding marketing, CRM, ad-identity or audience tools may discover that an email-keyed identifier no longer returns in Safari 27, even though their own login, newsletter or checkout continues to work. Campaign reach, audience matching and attribution could change for workflows dependent on third-party identity graphs. The precise effect depends on the stack and share of updated Safari visitors; WebKit provides no vendor-by-vendor measurements. For site owners, the practical action is to inventory scripts on sensitive forms and test Safari 27 traffic rather than assuming all conversion tracking or server-side integrations have failed.
The browser blocks the resolver, not the form
WebKit describes identity resolvers as third parties that capture a user's email address and turn it into an opaque ID linked across properties and devices. Safari blocks network access to their domains on OS 27. A site's own user account, direct authentication and first-party personalisation are not the intended targets; a central third-party resolver may still be considered tracking even if it operates for a single first party.
What to inspect in a real website
Review scripts and network requests on login, signup, newsletter and checkout pages, including tags inserted by a tag manager. Compare requests and responses on Safari 27 with another browser, and identify which audience or conversion workflows require the returned identity key. Do not assume a missing ID is solely responsible for a drop in conversion or ROAS without a controlled comparison.
The scope of impact is not yet measurable from the announcement
WebKit names no affected companies or full domain list. Independent ecommerce-operations analysis suggests segmenting Safari by OS version and auditing email-based identity dependencies, but its commercial implications are reasoned possibilities rather than measured platform-wide losses. The announcement does not establish that ordinary first-party analytics, consented server-side conversion uploads or authentication stop working.