iOS 26 Turns on Fingerprinting Protection for All Browsing

What Changed

Fingerprinting identifies a browser by combining many small technical details, such as screen size, graphics hardware, installed fonts and audio settings, into a profile that is unique enough to recognize the same device across sites, without cookies.

Apple introduced Advanced Fingerprinting Protection in Safari 17, but only for Private Browsing; users could turn it on for normal browsing in settings. With iOS 26 in September 2025, it became the default for all browsing in Safari.^1,2

The protection works in two ways. Safari makes every user's fingerprint less unique and less stable, for example by reporting fixed values for some screen and window measurements and adding noise that changes per site and per session. And, as WebKit describes, scripts that Apple classifies as fingerprinters are restricted further: they can't read many device characteristics, can't set long-lived storage, and can't read query parameters from the page's URL.³

Users can still limit the protection to Private Browsing or turn it off.⁴

Why It Mattered

As cookies and advertising IDs became harder to use, some companies turned to fingerprinting, or to "probabilistic" matching that combines IP addresses and device details to link visits. Apple already banned fingerprinting in apps: its developer agreement says apps may not derive data from a device to uniquely identify it, and apps that use SDKs doing so can be rejected.⁵ On the web, it couldn't enforce a rule like that.

Making the protection the default moved fingerprinting from a policy question to a technical one in Safari. Known fingerprinting scripts receive degraded data, so attribution and identity tools that rely on device signals become less accurate on iPhone. The same year, Google moved the other way, lifting its ban on fingerprinting in its ad platforms. Blocking classified scripts from reading the page's query parameters also affects tools that try to capture click IDs from the URL.³