Safari’s Privacy Stance Leaves 16 Web APIs on the Cutting Room Floor

Apple has reportedly declined to implement 16 different web APIs in Safari, citing privacy concerns. The underlying issue is fingerprinting: rather than these interfaces being used for their intended purposes, they often become tools for ad tech to build a profile of a user’s behavior and environment. A script could, for example, infer when a device was idle or detect nearby Bluetooth devices, then serve targeted ads based on that inferred activity.

The full list of omitted APIs, as reported by Catalin Cimpanu, includes:

  • Web Bluetooth – Connecting websites to nearby Bluetooth Low Energy devices.
  • Web MIDI API – Enumerating, manipulating, and accessing MIDI devices.
  • Magnetometer API – Accessing data about the local magnetic field via the device’s primary magnetometer.
  • Web NFC API – Communicating with NFC tags through a device’s NFC reader.
  • Device Memory API – Receiving the approximate amount of device memory in gigabytes.
  • Network Information API – Providing information about the device’s network connection and notifying scripts of connection type changes.
  • Battery Status API – Receiving battery status information from the hosting device.
  • Web Bluetooth Scanning – Scanning for nearby Bluetooth Low Energy devices.
  • Ambient Light Sensor – Getting current light levels via the device’s native sensors.
  • HDCP Policy Check extension for EME – Checking HDCP policies for media streaming and playback.
  • Proximity Sensor – Retrieving distance data between a device and an object via a proximity sensor.
  • WebHID – Retrieving information about locally connected Human Interface Device (HID) devices.
  • Serial API – Reading and writing data from serial interfaces, such as those used by microcontrollers and 3D printers.
  • Web USB – Communicating with devices via USB.
  • Geolocation Sensor (background geolocation) – A modern version of the older Geolocation API for accessing geolocation data.
  • User Idle Detection – Notifying websites when a user is idle.

The Double-Edged Sword

Reactions to this list are understandably mixed. On one hand, the web benefits from being a competitive platform for building a wide range of applications, and APIs like these can unlock those capabilities. Several of the omitted APIs also have legitimately responsible use cases—for instance, the Network Information API could allow sites to send less data on slower connections, and the Battery Status API could be used similarly for power-aware experiences.

However, Apple’s decision echoes an older and familiar privacy trade-off. Consider the behavior of :visited in CSS. Certain CSS declarations cannot be applied to visited links, and JavaScript APIs will intentionally misreport the current styling of visited links to make them appear always unvisited. The reason is the same: preventing sites from mining browsing history for fingerprinting purposes. When a feature’s existence becomes a liability for user privacy, browser vendors must weigh the utility against the cost—and in Safari’s case, these 16 APIs did not make the cut.