# What Safari 27's new tracking block means for your data > Apple now blocks some tracking domains outright in Safari. Here's how Triple Whale is adapting. **Author:** Kellet Atkinson **Published:** 2026-11-13 **Category:** News **Source:** https://www.triplewhale.com/blog/ios-27-tracking --- > **Key takeaways** - Safari 27 refuses to send requests to a private list of domains that Apple links to cross-site identity tracking. - Safari 27 doesn’t block the Triple Pixel. Safari traffic to the Pixel looks normal across our customers. - Apple’s own policy says it doesn’t intend to disrupt advertising measurement or analytics for a single website. That’s the work Triple Whale does. - To stay ahead of any change, we’re moving Pixel traffic onto each store’s own domain, which this block doesn’t check. - If you’re on Shopify, you don’t need to do anything. We’ll move your store for you. For years, Safari’s privacy rules limited what a tracking request could carry. Safari blocked third-party cookies, capped how long some cookies last, and trimmed referrer data. The request itself still left the browser, though. Safari 27 adds a stricter rule. If a page tries to load something from a domain on Apple’s list, Safari refuses before anything reaches the network. The vendor never receives the request, so there’s nothing to recover or model later. Safari 27 shipped on September 14, 2026, with iOS, iPadOS, macOS, and visionOS 27. The block is on by default in normal browsing. ## What Apple says it’s targeting In ‘[Blocking Identity Resolution Infrastructure](https://webkit.org/blog/18438/blocking-identity-resolution-infrastructure/),’ Apple’s WebKit team says the target is what it calls *identity resolution*. Apple states that third parties “invisibly collect your email address when you log in or sign up for a newsletter.” They then tie that email to a lasting tracking ID. Apple says the block works “on the domain level.” A vendor can’t get around it by changing how its requests look. Apple goes on to explain that “first-party personalization is not tracking.” Your own site’s logins, email signups, and personalization aren’t the target. **What the block doesn’t touch** - **Requests to the site you’re on**: A request from yourstore.com to yourstore.com/collect is never checked against the list. - **Clicks**: Following a link is a navigation, and the block doesn’t cover navigations. - **Server-to-server calls**: Data that one server sends to another never passes through the browser. ### Who’s on the list so far? Apple doesn’t publish its list. [One version became public on September 21](https://bugs.webkit.org/show_bug.cgi?id=324771), when The Trade Desk filed a bug report with Apple. It named domains run by Unified ID 2.0, ID5, LiveRamp, Permutive and Audigent, plus The Trade Desk’s own ad domain. Apple lifted the block on The Trade Desk’s domain in the iOS 27.2 beta and closed the bug on October 9. [According to AdExchanger](https://www.adexchanger.com/platforms/how-data-and-ad-tech-vendors-are-preparing-for-the-ios-27-fallout/), the block seemed aimed at The Trade Desk’s cookie-matching service. Because Safari blocks whole domains, it stopped The Trade Desk’s ads from serving too. AdExchanger’s reporting and independent testing on Safari 27.2 both found the identity vendors still blocked. That testing also found that tags from Google, Meta, Microsoft, LinkedIn and Criteo still sent their requests. A review of WebKit’s code also found that Apple can now update the list without shipping an iOS update. ## What it means for your data For most advertisers, the direct hit so far is small. If your ads run on Google, Meta, Microsoft, or LinkedIn, testing so far shows the identity block hasn’t cut off those tags. Look closer if you use identity or audience vendors, or buy programmatic media. Tools that depend on UID2, ID5, or LiveRamp IDs lose those IDs on Safari 27. AdExchanger notes that marketers use these IDs to connect channels, for example, streaming TV ads to later web visits. If you buy through The Trade Desk, check your Safari delivery on iOS 27 since mid-September. AdExchanger reported that some advertisers won and paid for iOS 27 impressions that never rendered. Apple’s fix is in the iOS 27.2 beta, so the gap can continue until shoppers update to 27.2. ### What about Triple Whale? Is the Pixel affected? The Triple Pixel isn’t blocked. Requests from Safari 27 reach us, and we see no drop in Safari traffic across our customers. Apple can change its list at any time, though, and Safari carries a large share of shopping traffic, especially on iPhone. If a Triple Whale domain were ever listed, you’d still see your orders, because they come from your store platform. But fewer Safari orders would show the ad clicks behind them, so more would land as non-attributed. **What Apple says it doesn’t intend to target** Apple’s rules for what it isn’t targeting live in WebKit’s Tracking Prevention Policy. A section called Unintended Impact lists everyday practices that Apple says it isn’t trying to stop. [View the full list under “unintended impact” here.](https://webkit.org/tracking-prevention-policy/) Apple adds that some of these practices “may be inadvertently affected because they rely on techniques that can also be used for tracking.” **Where Triple Whale fits** Measurement is a good example. The Triple Pixel recognizes returning shoppers on your store, so it can connect the ads they clicked to the orders they placed. Tracking tools use similar techniques, and that overlap is what this section of the policy covers. Two practices on that list describe what Triple Whale does: | Apple’s “unintended impact” item | Where Triple Whale fits | | --- | --- | | “Measuring the effectiveness of advertising.” | This is what the Triple Pixel is for. It shows which ads led to which orders on your store, so you can see which marketing works. | | “Analytics in the scope of a single website.” | Each brand’s data stays with that brand. Your identity graph belongs to your store and serves only your attribution. We never link a shopper on one store to the same shopper on another. | Apple’s post describes a different kind of company than Triple Whale. It targets hidden third parties that “are not themselves login providers or newsletter services, they’re just there to track you.” Their goal is a profile that follows a person from site to site. Brands install the Triple Pixel deliberately, and it only measures your brand’s own marketing. We see this as a strong case, and we aren’t counting on it alone. Apple says it “will try to limit unintended impact.” The same policy also says Apple will “typically prioritize user benefits over preserving current website practices,” and it doesn’t grant exceptions to specific companies. That’s why we’re also moving the Pixel onto your store’s own domain, as we explain below. ## How we’re adapting: Moving Pixel’s traffic onto your store’s own demain We’re moving the Pixel’s traffic onto your store’s own domain, where this block doesn’t apply. For Shopify stores, we’re rolling this out gradually and doing the work for you. For stores on other platforms, we’re building a first-party option and will reach out when it’s ready. Throughout, we watch Safari traffic across our customers closely, so we’d spot a change quickly. Safari only checks requests that go to a different site. After the move, the Pixel’s requests stay on your store’s domain. _[image]_ ### Here’s what you should do - If you’re on Shopify: Nothing. We’ll move your store for you, and your reports work the same way after the move. - If you’re not on Shopify: Nothing yet. We’ll contact you when the first-party option is ready for your platform. - Ask your other vendors: If you use identity, audience, or data partners, ask each one in writing how it works on Safari 27. If you buy through The Trade Desk, also ask your agency or DSP about iOS 27 impressions that didn’t render. - Check Safari when something looks off: Split the metric by browser and OS version, then compare it with your store’s orders. A block shows up as a Safari-only drop that starts when shoppers update. ## **Questions we’re hearing** *Is Safari 27 blocking Triple Whale?*No. Requests from Safari 27 reach us, and we monitor this closely. *Will my numbers change when my store moves?*We don’t expect them to. The Pixel collects the same data; only the address it sends that data to changes. *Does this affect Chrome and other browsers on iPhone?*Chrome and most other iPhone browsers run on Apple’s WebKit engine. It isn’t confirmed whether they apply this block. Our fix works the same way in every browser, so it covers them either way. *Does Triple Whale share my customer data with other brands?*No. Your identity graph is yours, and it serves only your attribution. *Who can I talk to? *Reach out to your Triple Whale contact or [email our support team](mailto:support@triplewhale.com).