As third-party cookies crumbled, advertisers quickly seized on email addresses as their shiny new workaround. That party looks to be ending though, as Apple’s WebKit team announced on 19 October that Safari is shutting the door on third parties trying that trick.
Identity resolution is the practice of taking an email address entered at login or newsletter sign-up, turning it into a persistent tracking ID and returning that ID to the page, so the same person can be matched across sites and devices. It gave advertisers a direct line to target groups and measure ad performance, using nothing more than the personal info users gave up voluntarily.
According to the WebKit team’s post, “Blocking Identity Resolution Infrastructure”, Safari and WebKit in iOS, iPadOS, macOS and visionOS 27 now block network access to third-party identity resolution systems. iOS 27 was released on 14 September, so the change is already on its way to users’ devices.
The post doesn’t name companies and doesn’t provide a list of blocked domains, so exactly who is affected isn’t set out.
Why The Email Address Became The New Cookie
As browsers began ditching third-party cookies, an email address became the stand-in.
People enter it when signing up or logging in, and it follows them across different devices. A large study published in September analysed 600,000 websites over 41 months and found that nearly 84% were already relying on these alternative identifiers by May 2025.
The WebKit team points out that “email addresses almost always constitute Personally Identifiable Information”, which is why it treats them as a permanent identifier that can follow users across sites.
Apple is drawing a clear line between first-party and third-party activity. WebKit has no issue with first-party personalisation, but it maintains that a central identity resolver is still a third party even when handling data for one company.
The block also works at network and domain level, so changing the format of a request doesn’t avoid it. WebKit’s tracking prevention policy says it grants no exceptions to specific parties, whether they’re ad tech startups or established players, and that it may add restrictions without prior notice.
We asked experts: what changes for advertisers who use email-based identity to target and measure campaigns, and what does it mean for the startups that build on identity resolution or rely on it?
More from Business
- Flutterwave Becomes First African Company To Partner With Techdollar On Employee Share-Backed Loans
- Singapore’s MAS Has Finalised AI Guidelines For Finance – Is It A Good Approach For Other Countries?
- Facebook’s New AI Feed Controls: What Small Business Marketers Need to Know
- Are Companies Mistaking Employee Burnout For Poor Performance?
- EU Inc Backers Say The Startup Reform “No Longer Exists” – What Has Been Taken Out?
- Instagram, X And The Art Of Changing Minds: Facebook Was Testing The Theory 14 Years Ago
- How Denmark Encourages Businesses To Set Up Shop
- 7 Lessons Businesses Can Learn From F1
Our Experts
- Mateusz Ruminski, VP Product, PrimeAudience
- Maor Sadra, CEO and Co-Founder, INCRMNTAL
- Rich Pleeth, Co-Founder and CEO of Finmile
- Nikhil Rai, Growth and Partnerships Consultant
- Amaury Allard, Founder of Elyseum Influence
- Hasan Hassoun, Head of Growth and AI at ThePayStubs
- Scott Neve, Founder of Ops Intel
- James Ensor, Global Lead, Server-Side, Didomi
- Heath Squier, Chief Growth Officer, Joyrise Health
Mateusz Ruminski, VP Product, PrimeAudience
“Apple’s latest move is consistent with the direction it has taken for years. From blocking third-party cookies in Safari to introducing App Tracking Transparency (ATT), iCloud Private Relay and Hide My Email, Apple has steadily tightened restrictions on tracking. Rather than a change in policy, efforts to restrict identity resolution providers further reinforce a long-standing direction.
“For advertisers, they should prioritise rethinking how much they rely on identity resolution. The fact that a provider works in Safari today does not guarantee it will continue to do so. Building targeting strategies around cross-site identity matching creates a dependency that could affect campaign reach and effectiveness. Advertisers should be exploring alternatives now, rather than waiting until their existing methods become less effective.
“This presents challenges for startups built around identity matching, but also opportunities for those developing alternative approaches. Semantic intelligence, for example, allows advertisers to understand audience interests and intent through the content people consume, without needing to resolve identities across websites.”
Maor Sadra, CEO and Co-Founder, INCRMNTAL
“Apple sold privacy long before it sold ads. Search Ads began as a way for developers to get found inside the App Store, and if Apple wanted to be an advertising company, it could have bought one of the many large ad networks, attribution companies or agencies – in a heartbeat. It didn’t. Apple does monetise its assets, but it is far from an ad company.
“The Safari move was only a matter of time. It’s one of the reasons I use an iPhone; I like that Apple controls the OS and uses that control to protect its users.
“The obsession with user-level data is one of adtech’s real sins. Track everything about an individual, and you still won’t know why they bought whatever they bought. Advertising never had the right to collect that much data on users to begin with, and measurement was never supposed to be about clicks. It’s about value. For advertisers and startups relying on third-party identity resolution, this means rethinking how they target audiences and measure effectiveness without tracking individuals across websites.
“Safari did what users wanted and the users of other browsers undoubtedly want the same, but not every browser maker is free to act on that when its own business depends on the data.”
Rich Pleeth, Co-Founder and CEO, Finmile
“The awkward bit for advertisers is separating lost measurement from lost customers. If reported return on ad spend falls after an identity link disappears, that doesn’t automatically mean the advertising stopped working. Before cutting a channel, compare actual sales and repeat purchases, and use holdout tests where practical to see what the advertising adds.
“For startups, this is a reminder that access to somebody else’s browser is a dependency you don’t control. A customer-acquisition plan needs alternatives if one provider loses that access.
“Apple says first-party personalisation isn’t the target. There’s still value in making your own site useful, giving customers a reason to return and earning permission to contact them directly. Contextual advertising is another option. None of that recreates every lost tracking signal, but it gives a business more ways to find and retain customers.”
Nikhil Rai, Growth and Partnerships Consultant
“For performance advertisers, this breaks measurement before it breaks targeting. Many lead-gen and ecommerce teams match a hashed email from a form fill to an ad click days later. In Safari, that bridge to third-party ID providers is gone, so reported conversions will drop and attribution will drift toward last-click and the platforms that own their own logins.
“For startups, a business built purely on turning emails into cross-site IDs just lost the Apple audience. Tools that help a brand use its own data on its own site are in a better spot.
“The practical response is boring but works: capture consent clearly in your own forms, tag every inbound link so the source is recorded at sign-up, send conversions server-side from your own systems, and judge channels on CRM outcomes, not platform-reported matches.”
Amaury Allard, Founder, Elyseum Influence
“The first thing I would expect clients to notice is retargeting. A lot of startups rely on email matching to reach people again after sign-up, and on Safari that audience now drops out. Attribution suffers too, so expect some uncomfortable conversations about which campaigns actually drove sales.
“The budget will move towards channels that work without tracking anyone. Search, Reddit communities, press coverage: people find you there because they are already looking for an answer. Those channels were undervalued because they were hard to measure. They now look far more reliable.
“Apple made this call on its own and announced it in a blog post. That says a lot about who sets the rules in advertising now. Google could do the same with Chrome whenever it suits them, so I tell founders to keep some of their growth in channels they control, like their email list, online communities and press coverage.”
Hasan Hassoun, Head of Growth and AI, ThePayStubs
“Most of the worry I’ve read assumes email-based identity was doing real work. In our case it wasn’t. ThePayStubs sells to people who already know they need the document, usually in a hurry, and the whole decision happens inside one session. A hashed email following someone across sites never told me anything my own funnel wasn’t already showing.
“So my advice to advertisers is to stop trying to rebuild the graph somewhere else and instead instrument their own site properly. Server-side events you actually own, and holdout tests when you want to know what a channel is worth. Contextual placement deserves a second look too, and it works better than most buyers remember. Clean rooms are fine if you spend at that scale; for everyone else they’re an expensive way to answer what a geo holdout answers for free.
“The companies in real trouble are the ones whose product was the resolution layer itself. I’d be careful predicting how that settles, since I’m on the buy side and not building adtech. On the power question, Safari has been tightening this since ITP [Intelligent Tracking Prevention] shipped, so it feels less like a new balance than the continuation of an old one.”
Scott Neve, Founder, Ops Intel
“Apple blocking third-party identity resolution in Safari shifts the ground for marketers, but the compliance headache starts well before the ad hits the screen. When ad tech relies on turning login emails into cross-site tracking IDs, businesses face immediate questions about consent and data use under laws such as the EU AI Act, UK GDPR and US state privacy rules.
“If your startup builds on or relies on these resolution tools, you need to check your current setup. Start with the basics. You should have a clear AI policy in writing that sets out what data your marketing tools can and cannot touch. Keep a straightforward record of every vendor you use, which staff members access them, and what customer data flows into them.
“Do not wait for an incident. Check your supplier contracts to see who carries the risk when a platform changes its rules overnight. Make sure your team has basic training on what constitutes personal data, and put a simple incident plan in place so you know what to do if a tool breaks or falls foul of regulators. Relying on first-party options like contextual targeting or clean rooms is safer, but only if your internal documentation matches what you are actually doing on the ground.”
James Ensor, Global Lead, Server-Side, Didomi
“Apple’s move was predictable. Large platform owners continue to set the terms of data exchange on the client side, where advertisers and publishers have the least control. Advertisers who rely on email-based identity will find Safari much harder to target and measure, and the startups built on that model have some hard thinking to do. This exposes how much leverage a single platform owner has over everyone else’s data strategy.
“The answer is to move server-side. By collecting data and enforcing consent in a first-party context, within their own environment, advertisers and publishers regain control and independence, whatever the next platform decides. The industry is already moving this way. The IAB Tech Lab is building server-side alternatives, including for consent.”
Heath Squier, Chief Growth Officer, Joyrise Health
“Audit which vendors receive email addresses and which targeting or measurement functions depend on those connections. Apple distinguishes first-party personalisation from third-party resolution; owning an email list is not permission to turn it into a cross-site identifier.
“For an adtech startup, the question is whether the product still creates value when the browser refuses the identity connection. A clean room is not an automatic exemption. Build the business case around permitted data and demonstrable outcomes, rather than a workaround that another platform change can remove.”
Kuber Sharma, Senior Director, Product Marketing, UiPath
“Enterprise marketing teams built their attribution models on a broken assumption: cross-device identity signals would always be there. Apple’s Safari block is the latest reminder that they won’t.
“Measurement gets harder before it gets better. First-party behavioural data, contextual AI and clean room partnerships aren’t new options. They’re what’s left. For startups built on identity resolution, this isn’t a feature gap to engineer around. It’s a structural shift.
“And the platform power question matters: Apple just made a unilateral call that changes how digital advertising works globally. No industry process, no consortium vote. One product team’s privacy decision is now ad market policy.”
