Summary
Apple's Safari 27 releases now block third-party vendors that collect email addresses on websites and turn them into persistent tracking IDs. The block hit identity vendors such as UID2, ID5, LiveRamp, Permutive, and Audigent. Visual Visitor works differently. The Visual Visitor tag doesn't read form fields or capture email addresses, and identification happens on the Visual Visitor side instead of in the browser. So the Safari identity resolution block isn't aimed at how Visual Visitor works, and there's been no Safari match-rate drop tied to it. Visual Visitor is still checking match rates daily and auditing its data partners. You should keep watching your own Safari traffic as the industry moves toward server-side fixes.
Apple just made another move against cross-site tracking. This one has a lot of marketers asking the same question. Does it affect my website visitor data?
With the iOS, iPadOS, macOS, and visionOS 27 releases, Safari and WebKit now block network access to what Apple calls "identity resolution infrastructure." The Safari identity resolution block is aimed at a specific tracking pattern. That pattern doesn't match how Visual Visitor identifies visitors.
Here's what Apple announced, which vendors were hit, how it relates to Visual Visitor, and what you should keep an eye on.
What Apple Announced About Identity Resolution
On October 19, Apple's WebKit team published a post explaining the block. It says Safari and WebKit in the 27 releases block network access to identity resolution infrastructure to prevent cross-site tracking.
The Tracking Pattern Apple is Targeting
Apple describes this as a "post-cookie" tracking method. It works in a few steps. Here's the flow Apple is shutting down:
- A third party (not the site owner) quietly collects your email address when you log in or sign up for a newsletter.
- That third party sends the email to its own servers.
- It creates an opaque tracking ID that's permanently tied to the email.
- It returns that ID to the page, where it can be used for cross-site profiling and ad targeting.
Over time, these vendors build an "identity graph" with name, address, phone, and IP. That enables tracking across sites and devices. Apple also points out that logging out or unsubscribing doesn't remove the stored ID.
Why the Block is Hard to Work Around
Apple enforces the block at the domain level. Vendors can't just restructure their requests to slip past it. The email never leaves the browser to reach those servers.
Where Apple Drew the Line
Apple was clear about a few boundaries. They matter for anyone running marketing technology on their site.
The key points from the post:
- "First party personalization is not tracking." Sites can still personalize for their own users.
- A central identity resolver counts as a third party, even if it only handles one company's data. Apple's reasoning is that it holds cross-site, cross-device data and can act as a matching "clearinghouse."
- Apple also promotes Hide My Email as an extra defense against email-based tracking.
Which Vendors Were Affected
Apple's post doesn't name any companies. It doesn't publish a list. It also says nothing about how domains get chosen or whether vendors can appeal.
A public WebKit bug report from September filled in some of the gaps. It listed the domains that were blocked at the time. The domains in that report included:
- uidapi.com (UID2)
- adsrvr.org (The Trade Desk)
- id5-sync.com (ID5)
- rlcdn.com and pippio.com (LiveRamp)
- permutive.com (Permutive)
- ad.gt (Audigent)
The Trade Desk's ad-serving domain, adsrvr.org, appears to have been restored in an iOS 27.2 beta. The identity vendors stayed blocked.
Timing added to the confusion. Apple's post arrived about a month after the blocking actually started in September. Publishers and vendors were left scrambling to figure out what had changed.
How the Safari Identity Resolution Block Relates to Visual Visitor
Short answer: Based on what Apple has described, Visual Visitor's infrastructure isn't the target.
The WebKit post goes after third parties that "invisibly collect your email address when you log in or sign up for a newsletter." Those vendors send the email to their servers and return a persistent ID to the page. That's the round trip Safari now blocks.
No Email-to-ID Round Trip in the Browser
The Visual Visitor tag doesn't read form fields. It doesn't capture email addresses from your pages. Identification happens on the Visual Visitor side, by matching anonymous session signals against the Visual Visitor identity graph.
So there's no email-to-ID exchange happening in the browser for Safari to block. The pattern Apple describes and the way WebID works are different by design.
What Safari Match Rates Look Like
Have Safari or iOS match rates dropped? Not in a way Visual Visitor can attribute to this change.
Safari has been the hardest browser to resolve for years. Two features drive that:
- Intelligent Tracking Prevention (ITP), Apple's long-running set of tracking limits in Safari.
- iCloud Private Relay, which masks IP addresses for iCloud+ subscribers.
Because of those, Safari match rates were already lower than Chrome well before September. That gap is the main metric the Visual Visitor team tracks. There hasn't been a step change since the 27 releases rolled out.
What Visual Visitor Is Doing to Stay Ahead
Not being the target doesn't mean sitting still. Browser privacy rules keep shifting, and the details of this block are still coming out.
Visual Visitor is taking two steps right now:
- Monitoring match rates daily. Any movement shows up within a day instead of at month end.
- Auditing every third-party domain in the collection and resolution path. That includes confirming none of Visual Visitor's data partners rely on browser-side email capture, the exact pattern Apple is blocking.
What You Should Do on Your Side
The best move is to keep monitoring. The fixes across the industry are still changing.
Ad tech's main response so far is to move identity resolution server-side. A few efforts are worth watching. Here's where things stand:
- ID5 is moving more of its identity infrastructure server-side and testing with selected publishers.
- IAB Tech Lab is promoting its Trusted Server framework. It sends identity calls from the publisher's own domain, out of the browser's view.
There are still doubts about whether server-side approaches will hold up long term. Apple has already shown it's willing to act first and explain later. So don't assume today's workaround is permanent.
A Quick Checklist for Your Team
If you run marketing or sales tech on your site, a few practical checks will help.
Start with these:
- Know which vendors run on your pages. Look for any tool that reads email fields at login or newsletter sign-up.
- Watch Safari and iOS traffic separately. Compare it against Chrome so you can spot changes early.
- Lean on first-party relationships. Apple explicitly says first-party personalization isn't tracking.
- Ask your vendors direct questions. Find out whether they capture email in the browser and how they'd respond to a block.
The Bigger Picture for Visitor Identification
This isn't Apple's first privacy move, and it won't be the last. ITP and Private Relay already shaped how Safari traffic behaves. The identity resolution block adds one more layer.
The takeaway for B2B marketers is simple. How a vendor identifies visitors matters as much as how many it identifies. Tools that depend on capturing emails in the browser are now exposed. Tools that resolve identity on their own side, without that browser round trip, are in a different position.
That's why Visual Visitor keeps a close eye on Safari match rates and its own data path. When rules change, you should hear about it from your vendor first, not from a surprise drop in your reports.
Talk With a Product Specialist
Want to see how Visual Visitor identifies your visitors, and what your own Safari match rates look like? Schedule a meeting with a product specialist. You'll get a walkthrough of how identification works, how it lines up with Apple's latest changes, and how to put that data to work in Person-Level Advertising and outreach.
