Apple just explained why Safari has been quietly cutting off some of the biggest names in ad tracking. On Oct. 19, Apple’s WebKit engineers published a post on blocking “identity resolution infrastructure,” the companies that turn the email address you type into a website into an ID that follows you around the web. The Safari tracking block started with iOS 27 in September, and Apple says it will keep going.
If you run a law firm, a real estate team or a contracting business, you have probably never heard of the companies on the list. That is fine. What matters is the direction: one of the largest phone and browser makers in the world is telling advertisers that following people from site to site is over on its devices.
For a small business, that is less a crisis than a nudge. The businesses that do well from here are the ones that own their own contact list and measure what happens after a lead raises their hand.
The short answer
Apple’s Safari now blocks third-party companies that convert email addresses into cross-site tracking IDs. Most local businesses are not hit directly, but audience targeting on Apple devices is likely to keep shrinking. The fix is to rely less on borrowed audiences and more on your own list, your own follow-up and simple lead tracking.
Table of contents
- What Apple announced
- Why it matters for marketing
- 5 moves to make this week
- What this means for your business
- Common questions
What Apple announced
According to PPC Land (Oct. 19, 2026), the WebKit post confirms that Safari blocks network access to third-party identity resolution providers on iOS, iPadOS, macOS and visionOS 27. The block works at the domain level, so the provider never receives the email address and no tracking ID gets created. iOS 27 began rolling out on Sept. 14, and ad tech firms started noticing blocked domains within a week.
Digiday (Oct. 20, 2026) summarizes Apple’s reasoning in plain terms:
- Email addresses have replaced cookies as the main tracking identifier, because people keep one address for years and use it on every device.
- Logging out or unsubscribing does not stop an outside firm from keeping that data and building a profile.
- A business personalizing content for its own customers is not the target. Outside firms that match people across different sites are.
- Apple says it will “continue to prevent covert and cross-site tracking by default,” which suggests more companies could be added.
Digiday and PPC Land both report that the firms caught early include LiveRamp, ID5, Permutive, Audigent and The Trade Desk’s Unified ID 2.0. AdExchanger (Oct. 20, 2026) adds that vendors are shifting toward first-party models and that workarounds like new domains are expected to be short lived. Apple has not published a list or explained how companies get on or off it.
Why it matters for marketing
Most local businesses buy ads through Google, Meta or a local platform, not through the identity firms Apple named. So nothing broke on your account this morning. But the audience products many advertisers rely on, such as “people who visited sites like yours” or “people who match this profile,” depend on recognizing the same person across sites. Every time a browser blocks one of those links, those audiences get smaller and fuzzier on that browser.
PPC Land notes that advertisers buying against affected segments should expect lower Safari reach. That is the pattern to plan around: rented audiences get less reliable over time, while a list of people who actually contacted you stays yours.
There is also a measurement angle. WebKit lists measuring ad effectiveness among the things it does not intend to disrupt, according to PPC Land, but it does not say whether any specific conversion setup is covered. If your reporting already feels like guesswork, expect it to get noisier, not cleaner.
The LA Law Firm SEO Checklist
Forty checks across the three systems that decide whether a Los Angeles firm gets found: the map listing, the pages, and the proof. Includes the Google Business Profile rules firms break most often.
Send me the checklist5 moves to make this week
1. Make your own list the main asset
Apple is blocking outside firms from using email addresses. It is not stopping you from emailing people who gave you theirs. Make sure every web form, call and walk-in lands in one CRM with a source field. Then use it: a short monthly email to past clients and open leads is the kind of first-party marketing no browser update touches. Our guide on email marketing that turns cold leads into clients lays out a simple sequence.
2. Stop leaning on retargeting alone
Retargeting can still help, but treat it as a bonus, not the plan. If a big share of your budget goes to following past visitors, shift some of it toward search ads and local visibility that catch people when they are actively looking. Our post on retargeting strategies for legal practices covers where it still earns its keep.
3. Track leads, not just clicks
When browser-side tracking gets weaker, the most reliable data is what happens after someone calls or fills out a form. Use call tracking numbers by channel, ask “how did you hear about us” on every intake, and record which leads became signed clients, listings or jobs. We walk through the basics in tracking law firm marketing performance, and the same approach works for agents and contractors.
4. Ask your vendors one direct question
If you pay for audience targeting, a lead platform or a “data-driven” ad package, ask: does any of this depend on third-party identity matching, and how is it affected on Safari? A good partner answers plainly. A vague answer tells you something too.
5. Review what your website forms share
Apple’s whole argument is that people do not expect the email they type into a form to travel to companies they never chose. Check which scripts and tags fire on your contact and intake pages, remove anything you do not use, and make sure your privacy policy matches what the site actually does. For law firms, intake forms can hold sensitive details, so this is worth a careful look. This is not legal advice; talk to your own counsel about privacy obligations in your state.
What this means for your business
Big tracking changes tend to hurt the advertisers who outsourced their thinking to an audience list. Local businesses usually have an advantage here: your customers search for you by need and by neighborhood, call you, and refer their friends. None of that depends on a tracking ID.
So the playbook stays simple. Show up when people search. Answer fast. Capture every lead in a system you own. Follow up until they say yes or no. That is the core of The Super Simple Marketing Method, and it holds up whether Safari blocks five companies or fifty.
Common questions
Does the Safari tracking block stop Google or Facebook ads?
No. Reporting so far focuses on third-party identity firms, not Google or Meta ad platforms. Your ads still run on iPhones. What can weaken over time is audience targeting and measurement that depend on matching people across sites.
Can I still email people who gave me their address?
Yes. Apple says a business personalizing for its own customers is not the target. The block covers outside resolvers that match data across sites. Your own email list and CRM follow-up are unaffected by this change.
Will more companies be blocked?
Possibly. Apple says it will keep preventing covert and cross-site tracking by default, and its policy allows further restrictions without notice. Plan as if borrowed audiences will keep getting smaller.
Build marketing you own
Browser rules will keep changing. A lead system you control keeps working. If you want help setting one up, book a free strategy consultation with Maldonado Marketing.