TLDR
Safari now blocks network requests to identity resolution domains across iOS, iPadOS, macOS and visionOS 27, enforcing the block at the domain level so providers cannot route around it. With Safari holding 50.01% of Australian mobile browsing in September 2026, about half of local mobile web traffic stops feeding email-based IDs once devices update.
KEY TAKEAWAYS
What Apple blocked and why
Apple's WebKit team confirmed on 19 October 2026 that Safari and WebKit in iOS, iPadOS, macOS and visionOS 27 "block network access to identity resolution infrastructure to prevent cross-site tracking".[1] The post, by WebKit engineers John Wilander, Charlie Wolfe and Matthew Finkel, is aimed at third parties that take the email address people type in at a login or newsletter sign-up and turn it into a persistent ID that follows them from site to site. "Email addresses almost always constitute Personally Identifiable Information, or PII," it says.[2]
"The blocking is done on the domain level," the post says, so a provider can't get around it by changing how its requests are built.[1] WebKit also drew a line around what it isn't stopping: "First party personalization is not tracking, and is not what our technologies seek to prevent."[2] A publisher can still use its own logged-in readers' data on its own site. Apple named no companies and hasn't published its list of blocked domains.[1]
The domains named before Apple spoke
iOS 27 began rolling out on 14 September, and the block was first spotted in a WebKit bug report filed on 21 September by The Trade Desk's Ian Meyers.[2] The domains it listed included uidapi.com, which carries Unified ID 2.0; ID5's id5-sync.com; LiveRamp's rlcdn.com and pippio.com; Permutive; Audigent; and The Trade Desk's own adsrvr.org, which delivers ads rather than resolving identity. An iOS 27.2 beta reportedly restored adsrvr.org while the identity domains stayed blocked.[2]
The identity firms aren't taking it quietly. ID5 chief executive Mathieu Roche called the block an attack on the web's business model and argued regulators should look at it, while the IAB Tech Lab's Rowena Lam urged the industry towards server-side advertising.[2]
Why it matters in Australia
Safari had 50.01% of Australian mobile browsing in September, ahead of Chrome on 42.1%, so once iPhones move to iOS 27 about half of local mobile web traffic stops feeding email-based IDs from the browser.[3]
Mobile browser share in Australia, September 2026
That lands on the industry's main plan for life after third-party cookies, which Safari already blocked six years ago.[2] Australian publishers that have built login walls and newsletter sign-ups to collect email addresses can still use that data on their own sites, but the browser-side handshake that turned it into an ID buyers could target across the open web is now cut on Apple devices. The likely response is the one the IAB Tech Lab is already pushing: more matching done server-side, inside clean rooms and retail media networks, where the publisher, not the browser, decides what gets shared.[2]
SOURCES & CITATIONS
Xaviery Malinao writes for Prompt the Market on how brands and agencies are adapting to answer engines, drawing on Bushnote's work with clients across search, AI search and content.
