Cross-site cookies have been blocked for six years, so tracking moved to identity resolution: invisible third parties collect your email at signup, turn it into an opaque ID, and match your browsing across sites and devices. On October 19 WebKit announced that Safari's OS 27 releases block network access to that infrastructure outright.
How the scheme worked
You log in or join a newsletter. A script sends the address to a shared matching server; the server returns a tracking ID the website stores; from then on the third party holds a cross-site, cross-device profile built on an address you gave for one stated purpose. Logging out or unsubscribing does not remove it.
What the block changes
- Blocking is domain-level: changing the shape of the request does not get around it.
- First-party personalization is untouched; only the third-party matching infrastructure loses access.
- Hide My Email keeps starving the scheme earlier still: one unique address per site defeats email matching by itself.
If your product pipes signup emails to a matching vendor, test the flow in Safari 27 before your next audit: those network calls now fail, and some integrations surface that failure to the user. It is also a preview of where other engines will probably go.