---
title: "Blocking Identity Resolution Infrastructure"
slug: blocking-identity-resolution-infrastructure
url: https://listedarticles.com/articles/blocking-identity-resolution-infrastructure
canonical_url: https://webkit.org/blog/18438/blocking-identity-resolution-infrastructure/
content_type: announcement
language: en
published_at: 2026-10-19T17:50:24.000Z
updated_at: 2026-10-20T05:13:27.058Z
author: "John Wilander, Charlie Wolfe, Matthew Finkel"
authored_by: human
publisher: "WebKit"
publisher_url: https://webkit.org/
topics: ["Privacy", "Web Browsers", "Security", "Web Development"]
license: all-rights-reserved
word_count: 873
reading_minutes: 4
citation: "John Wilander, Charlie Wolfe, Matthew Finkel, WebKit. \"Blocking Identity Resolution Infrastructure.\" 19 Oct 2026. https://webkit.org/blog/18438/blocking-identity-resolution-infrastructure/ (all-rights-reserved)"
# The full text follows. The web page shows an extract and sends readers
# to the source above; quote the citation and link the canonical URL.
---

# Blocking Identity Resolution Infrastructure

> WebKit's John Wilander, Charlie Wolfe and Matthew Finkel explain identity resolution, the post-cookie tracking method where invisible third parties collect your email at login or signup and turn it into a persistent cross-site tracking ID and identity graph, and how Safari and WebKit in the 27 releases block network access to that infrastructure at the domain level.

# Blocking Identity Resolution Infrastructure

John Wilander, Charlie Wolfe, and Matthew Finkel | WebKit | October 19, 2026

Apple and WebKit have shipped protections against web tracking for a long time. We put privacy protections in place for cookies in the very first version of Safari, we invented storage and cache partitioning and shipped it ten years before other major browsers, and we’re actively fighting device fingerprinting.

We do this because users deserve to not be tracked, not across websites and not covertly through fingerprinting, unless they explicitly opt in to it. See [WebKit’s Tracking Prevention Policy](https://webkit.org/tracking-prevention-policy/) for a comprehensive overview.

## Identity Resolution, or the Post-Cookie Era

We fully blocked cross-site cookies six years ago. That was a huge step forward for privacy on the web.

However, the tracking industry has not sat idle since.

A “post-cookie” tracking method emerged, called *identity resolution*. In this scheme, third parties (i.e., not the website owner) invisibly collect your email address when you log in or sign up for a newsletter. They send the email address to their servers, create an opaque tracking ID permanently linked to your email address, and send that tracking ID back to the webpage. The tracking ID is stored on the website and can from thereon be used for arbitrary purposes linked to your email address, such as building a profile of your browsing or targeting ads at you across websites. Logging out or unsubscribing from that newsletter does not remove the tracking ID or your email address stored with the third party.

![Diagram showing four websites (Website 1, 2, 3, and 4) each sending Jane's email address (jane@mail.example) to a central 'Identity resolution server' and receiving back a different tracking ID for each site (Tracking ID 1 through 4), illustrating how an identity resolution service links a shared identifier across multiple sites.](https://webkit.org/wp-content/uploads/blocking-identity-resolution-01-light.png)

Over time, these third parties collect even more data as you log in using your email address or fill in forms with personal data. They use this to create a data profile of you, known as an *identity graph*. Here’s an illustrative example of what such a graph may look like:

![  Illustration of a person labeled ](https://webkit.org/wp-content/uploads/blocking-identity-resolution-02-light.png)

Email addresses almost always constitute Personally Identifiable Information, or PII. Another example is your phone number. Such information not only allows for cross-site tracking, but also cross-*device* tracking. For the majority of users, their email address serves as a globally unique ID that they keep for years, even decades. When users provide information for one purpose, it breaks their expectation to use it for another unstated purpose. For example, a user who logs in or signs up for a newsletter is not expecting to have their information sent to a third party for other, potentially long-term, intents.

First party personalization is not tracking, and is not what our technologies seek to prevent. But even if identity graphs are only scoped to data from a single company, i.e. a first party, the central identity resolver is a third party and it holds cross-site, cross-device, and cross-party data about the user and can perform matching and targeting functions in the capacity of a clearinghouse. That is a tracking capability that each first party does not have on their own.

![Diagram showing an online store asking 'Which of my users should I promote ice skates to?' A third-party identity resolver in the middle, matching across multiple first-party datasets, contains profiles for Emre, Aline, Mike, and two separate 'Jane' profiles — one from the online store and one from an ice hockey website — which are linked together in a dotted circle labeled 'Match.'](https://webkit.org/wp-content/uploads/blocking-identity-resolution-03-light.png)

## What We Are Doing To Protect Users Against Identity Resolution

Some companies serve as third-party infrastructure to facilitate identity resolution. They are present but invisible on many webpages where you enter your email address or use your email address for login purposes. They are not themselves login providers or newsletter services, they’re just there to track you.

In our iOS, iPadOS, macOS, and visionOS 27 releases, Safari and WebKit block network access to identity resolution infrastructure to prevent cross-site tracking. This stops them from sending your email address to their servers and all the downstream effects of that. The blocking is done on the domain level, meaning they can’t just change the structure of the network request to work around the protection.

![The same four-website and identity-resolution-server diagram as before, but each website's request is blocked by a red shield-with-X icon, illustrating Safari blocking the requests and identity resolution being prevented.](https://webkit.org/wp-content/uploads/blocking-identity-resolution-04-light.png)

## Hide My Email

As an iCloud+ subscriber, you are offered the service [Hide My Email](https://support.apple.com/guide/icloud/what-you-can-do-with-icloud-and-hide-my-email-mme38e1602db/1.0/icloud/1.0) which enables you to submit unique, randomized email addresses to every new website while still getting their messages in your inbox. Unique, random email addresses provide additional protection against email-based tracking.

## Our Commitment to Web Privacy

It’s not enough to block cross-site cookies to prevent cross-site tracking today because the tracking industry has not stopped trying to track users on the web. They have ushered into what they call the post cookie era and in our latest releases we have put strong protection in place. We will continue to prevent covert and cross-site tracking by default, while maintaining the ability for websites to provide first-party personalization to their users.