On October 19, WebKit explained a new Safari 27 protection against third-party systems that use email addresses to connect a person’s activity. Safari blocks requests to domains used by that infrastructure. The protection is already part of iOS, iPadOS, macOS and visionOS 27; the explanation’s publication date is not those systems’ release date. Here is how it complements other privacy tools and what users can check.
Why blocking cookies is only part of the job
WebKit’s technical documentation describes partitioning third-party storage by website. In a simplified example, the same advertising service operates on a shop and a news site, but its local data is isolated between those contexts. That prevents this particular storage from serving as one shared browsing log. Protecting a channel does not, however, make every piece of information you enter into a website anonymous.
The WebKit policy distinguishes intentional interaction with a website from third-party tracking. Signing into your own account is different from quietly joining your activity across unrelated services. Our practical takeaway is that a protected browser does not remove the need to decide who should receive your address, name or other details. Tracking prevention should not be read as a promise to remove all advertising from the internet, either.
What to check on a Mac and an iPhone
On a Mac, open Safari settings, select Privacy and check Prevent cross-site tracking. Apple explains that this limits third-party data used for tracking; it also covers some social elements capable of gathering information without a click. This is an existing Safari setting, rather than a separate new switch called “email protection”. Keeping that distinction clear makes instructions easier to follow.
On an iPhone, go through the system Settings app to Apps, then Safari, and find Prevent Cross-Site Tracking. According to Apple’s iPhone guide, Safari normally restricts third-party cookies and data, while switching the setting off relaxes those restrictions. Labels vary with the interface language. If you cannot remember whether you changed this while troubleshooting a website, checking it is a sensible starting point.
Our troubleshooting advice is to note the site address and the exact action that fails if a form stops working after you change a setting. Avoid changing several options at once: doing so makes the cause harder to identify. A failed sign-in or payment alone does not establish that the browser’s new protection is responsible. Keep the sequence of changes clear before drawing conclusions.
How to interpret the Privacy Report
On a Mac, Safari’s Privacy Report shows trackers the browser has blocked and lets you inspect information for a particular site. It helps answer a specific question: which known tracking attempts were stopped here? The number is not a general trust score for the website, or proof that your email address has never been shared anywhere.
We suggest treating this report as extra context. A shop with many blocked trackers gives you a reason to examine its registration terms and requested information more carefully. A low count does not remove the need to assess the seller. A browser counter cannot tell you whether the order will arrive, how long the shop will keep your profile or how it handles information under its own policies.
When a separate sign-up address helps
iCloud+ subscribers have another option: Hide My Email. It creates random addresses, forwards incoming messages to the main inbox and provides controls for managing those addresses. This is an additional subscription feature, distinct from Safari’s basic settings. One useful scenario is giving a new shop its own address instead of the main email you use for important accounts.
Our recommendation is to record which address belongs to each service as soon as you sign up. A note in the relevant password manager entry works well. Before disabling an address, check whether you still need it for account recovery, receipts or warranty correspondence. Otherwise, reducing unwanted newsletters can create a different problem: essential messages keep going to an address you no longer use.
A private window has a different purpose
According to Apple’s Mac guide, private browsing avoids retaining the usual browsing history and session AutoFill information. Downloaded files still remain on the computer, however. A private window therefore does not replace removing a sensitive document from Downloads. It is also no reason to trust an unfamiliar website or give it more personal information than the transaction requires.
For everyday use, we suggest a simple routine: check the protection settings, choose addresses deliberately for new registrations and keep track of important sign-ins. In a household or small team, also agree which email handles shared purchases and who can access recovery messages. That organisational side of privacy cannot be completed by an automatic filter on an account owner’s behalf. It is especially useful when responsibilities change or the person who originally registered an account is no longer available.
Join the conversation
Stay on topic and respect other readers. Your first comment may appear after editorial review.