Customer journey tracking—the art of linking ad impressions, clicks, site visits, emails and store purchases into one person’s path—has always been held together by fragile identifiers. On October 19, 2026, WebKit dealt it another blow: Safari 27 will block identity firms from turning email addresses into tracking IDs.
What Safari 27 actually does
Apple’s browser now cuts network access to third-party resolvers that take an email address and return a persistent cross-device ID. John Wilander, Charlie Wolfe and Matthew Finkel explained the logic in WebKit’s post: “For the majority of users, their email address serves as a globally unique ID that they keep for years, even decades.” Apple named no companies, but earlier reporting tied the practice to The Trade Desk, ID5 and LiveRamp.
That matters because deterministic email matching has been the strongest cross-device link after a login. Without it, many probabilistic graphs get thinner.
Google and payments step into the gap
Google is responding with signed-in data. In October 2026, the company said Floodlight will use Google signed-in data from November to recover unattributed cross-device conversions in Display & Video 360, Search Ads 360 and Campaign Manager 360—no volume estimate given.
On the payments side, TransUnion and Fiserv launched Transaction Matching on October 21, 2026, tying in-store card and tap-to-pay transactions to persistent shopper profiles. They did not disclose match rates or consent mechanisms.
Why this matters for performance marketers
Most purchases are not caused by one ad. A shopper may see a video on a phone, search on a laptop two days later, and buy in an app the following week. Journey data feeds attribution models, automated bidding and audience building. When observable paths shrink, platforms fill gaps with modelling—and few disclose the mix of measured versus estimated conversions.
On top of Safari 27, consent rules are tightening. From June 15, 2026, Google consent mode became the sole control over whether Google Ads cookies and identifiers are collected from GA4. A declined banner removes a person from the observed journey.
What to do now
Marketers who rely on third-party identity vendors need to test what actually breaks in Safari 27 and ask for match-rate transparency. Practical moves:
- Push logged-in user IDs as your primary identity layer; they still survive device changes.
- Move event collection server-side with your own subdomain to reduce browser interference.
- Implement consent mode v2 properly—consented first-party data beats modelled guesses.
- Audit your GA4 and Amazon conversion path reports; know your lookback windows and touchpoint splits.
- Pressure identity and measurement vendors for disclosed match rates and consent flows.
The open-web identity graph is not dead, but it is being rebuilt around signed-in data, server-side collection and consented first-party signals. The brands that adapt now will be the ones whose attribution still adds up next year.
Source: PPC Land
