Safari's iPhone privacy features curb tracking by default, but stop short of a VPN, Engadget finds

According to Safari's own information page, the browser blocks third-party cookies by default, uses machine learning to limit cross-site tracking, hides the user's IP address from known trackers and strips identifying information from certain URLs. Apple published a white paper in 2019 covering the full range of Safari's privacy capabilities.

Those defaults matter because advertising and data-broker networks, and by extension the FBI, collect private data, Engadget reported. Tracking information often follows users across unrelated sites, searches, purchases and profile visits. Safari cuts most of those data feeds off, limiting what is shared with those networks and making it harder for advertisers to build an infrastructure based on a user's behavior.

Even so, private does not put Safari on the same level as a quality VPN. Websites can still see the information required to serve the page being viewed, including a general idea of the user's location. Safari's defaults mean the average iPhone user hands over less data without knowing it, but the browser is far from an impenetrable shield, Engadget wrote.

The report distinguishes privacy from security. Privacy concerns how personal information is collected and used, while security concerns how data is protected from attack. Insecure data cannot be private, but a secure website can still have poor privacy practices.

Safari's strongest tools address address tracking, account security and unsafe website behavior. Its cross-site tracking protections try to stop advertisers and third parties from recognizing a user moving from site to site, and Private Browsing adds layers including tracker blocking, masking the IP address from known trackers and automatically removing some tracking information from links. The browser supports passkeys, which allow sign-in with Face ID or Touch ID instead of a password; because a passkey is tied to a specific website, it will not work on a fake lookalike page. Apple Pay is integrated into Safari, so users can avoid entering card numbers and authenticate with Face ID against cards stored in Apple Wallet.

Limits remain. Safari warns about dangerous sites but cannot verify that every page is legitimate and will not stop a user from entering credentials on a convincing phishing site. It warns about poor passwords, and Apple Intelligence in iOS 27 will be able to set stronger passwords automatically, but that feature is not yet available. Private browsing does not hide activity from an ISP or from sites a user is logged into, and anti-tracking tools reduce data collection without stopping websites from collecting data a user submits directly. As Engadget put it, Safari cannot protect users from what they decide to trust.

The privacy gap between browsers on the iPhone can be smaller than their marketing suggests. Outside the European Union, Apple requires third-party browsers on iOS to use Safari's WebKit rendering engine, so Chrome, Firefox and Brave cannot use the same engines on the iPhone that they use on desktop. Feature differences persist, and PrivacyTests.org maintains a comparison. Brave is a viable alternative for a stronger content blocker: its iPhone app promotes tracker and ad blocking and a privacy-focused Brave Search that collects no data about the user, in contrast to Safari's default use of Google. Brave also sells an optional VPN and firewall subscription.

Safari's advantage, in Engadget's account, is that its protections are built in and enabled by default, a point Apple frequently makes in comparison with Chrome. Chrome offers many of the same protections, but they must be turned on. The report frames the real question as not whether Safari is perfectly private, since no browser is, but whether its default settings increase privacy and whether privacy-enhancing options exist at all. For most iPhone owners, Engadget concluded, Safari is a solid option, particularly because it is made by the same company that built the phone and its operating system and does not require adjusting settings to be privacy-respecting.