Earlier this month, ad tech received its latest warning about the cybersecurity vulnerabilities baked into programmatic advertising.
That context is largely missing from discussions about Apple’s plan to disable the third-party ID infrastructure that powers digital advertising on iOS and Mac devices. But ad tech’s wider issues paint Apple’s actions in a different light.
On October 15, ad security firm Confiant and the University of Toronto’s Citizen Lab confirmed a zero-click mercenary spyware attack delivered through targeted advertising. Technology provided by two Israeli companies, ad tech vendor Discover-Tech and the spyware firm Candiru, was used to spy on staff at the news outlet Al Jazeera. The attack was linked to ads that ran on more than 120,000 websites and 70,000 apps.
One of the report’s authors, Citizen Lab senior researcher Wolfie Christl, told Forbes, “It’s difficult, if not almost impossible, to consistently protect yourself from malicious ads. Ad blocking must now be considered a cybersecurity best practice.”
Ironically, this spyware report dropped while the latest ad tech vs. Apple polemic was still reverberating. Since the release of iOS 27, Apple WebKit, the software that powers Safari and all other browsers on iPhones, including Google Chrome, has blocked requests to a set of ad tech domains that handle cross-site tracking. (The macOS 27 Golden Gate update similarly blocked cross-site tracking tech on desktop Safari.) On October 19, a post on the WebKit blog explained what the blocked domains have in common: they are all “identity resolution infrastructure.”
In other words, Apple just put third-party ad tech – which widely relies on ID resolution – on notice.
But given Christl’s warning that ad blocking has become cybersecurity table stakes, can we really blame Apple?
Villainizing Apple is easy but short-sighted
We’ve seen this dance before, with Apple taking an antagonistic stance against widely used digital advertising technologies. But accusations that Apple is using privacy as a Trojan horse to expand its own advertising empire seem petty in light of bigger concerns over ad tech’s cybersecurity protections.
This time around, ad tech has legitimate complaints against Apple. They’ve faced a month of silence from Apple with no published list of domains blocked by WebKit and no way to appeal. And, in at least one documented case, Google was allowed to bid on ad inventory on iOS while The Trade Desk could not. Enforcing measures bluntly and silently in this fashion is counterproductive, unfair and unprofessional.
Apple has legitimate concerns, too.
There’s a lot of nuance to unpack, so let me split the question of “Can we really blame Apple?” into three parts.
Can we blame Apple for treating identity as a security matter?
Mathieu Roche, CEO of ID5, one of the ID vendors blocked by WebKit, summarized the position of part of the industry by calling the move “an attack against the business model of the web.” I, for once, disagree with Mathieu.
We’ve been hearing these arguments since at least 2021, when the programmatic open marketplace rebranded itself as the open web.
Ad tech has a role to play in the open web’s business: It belongs in the background, providing the tools media owners and advertisers need to run their own advertising business, under their own standards, with consent they collect and keep.
But ad tech’s role does not depend on finding one person across 120,000 websites and 70,000 apps. However, the open marketplace is built on recognizing the same individual. And while most advertisers and ad tech companies aren’t trying to deliberately target specific people, those who want to can do so by exploiting ad tech.
The WebKit post makes the same distinction: First-party personalization “is not tracking, and is not what our technologies seek to prevent,” the WebKit team writes. But a central identity resolver, even one holding the data of a single company, is a third party acting as a “clearinghouse,” according to Apple.
Now look at how the open marketplace’s business model was exploited. Discover-Tech bought ads through Google’s and Yandex’s exchanges and Comcast’s Beeswax. The ads “covertly directed millions of devices to contact Candiru’s servers, likely for large-scale tracking and reconnaissance,” according to Citizen Lab.
Discover-Tech’s customers could pick a person to profile or infect with malware by targeting three different identifiers: a mobile advertising ID, browser cookie ID or IP address. But Apple has systematically restricted, blocked or partly hidden by default all three of those identifiers since it implemented ATT in 2021. And Apple’s browser team explained in 2019 that it treats circumvention of its anti-tracking measures “with the same seriousness as exploitation of security vulnerabilities.”
Critics of the latest Apple move argue that ATT at least asked users whether they consent to tracking, whereas the WebKit block list works without user input. But users were already asked their preference via the industry’s own consent framework.
Discover-Tech was on IAB Europe’s Global Vendor List for over six years. In that time, hundreds of millions of Europeans clicked “agree” on website consent requests authorizing Discover-Tech to process their data. That is what consent looks like when a media owner collects it once, and then it trickles it down to hundreds of vendors no average user knows.
Meanwhile, looking out for ad tech is not Apple’s mission, and ad tech’s business model is not the web’s, no matter how many times ad tech tries to convince itself otherwise.
Apple’s main business priority is its devices. Its customers buy those devices, in part, because of Apple’s professed commitment to trust and safety.
So can we blame Apple for protecting its devices and customers, which means treating the ability to find one person across sites and apps as a security matter? No.
Can we blame Apple for not trusting the industry’s vendor lists?
Complaints that Apple has not published its WebKit block list also ring hollow, considering the dire state of ad tech’s self-published vendor lists.
Discover-Tech was on Google’s list of Certified External Vendors. It was also on IAB Europe’s Global Vendor List since July 2, 2020. That means it was “registered and approved” by IAB Europe, an association that says it takes “reasonable steps to vet and approve” applicants, including “the identity of the party or parties controlling the vendor.”
But, for most of the period in which Discover-Tech had IAB Europe’s blessing, its company records showed links to the spyware industry on its board and among its shareholders.
The vendor lists that ad tech relies on, Citizen Lab concludes, “appear to be largely based on self-attestation by vendors.” Google and IAB Europe acted after the researchers’ disclosure, not before: Google blocked the company “for systematically violating our policies,” and IAB Europe suspended it.
Know Your Customer (KYC) checks should be the first layer of any ad buying and selling in this industry. Humans, not lists, should be making decisions on which partners have access.
So can we blame Apple for not treating the industry’s vendor lists as a guarantee of trust and safety? No.
Can media owners blame Apple?
Ad tech might have its gripes with Apple, but as IAB Tech Lab CEO Anthony Katsur recently wrote, “Ad tech can adapt.” According to Katsur, the bigger story is the pressure the WebKit block puts on publishers. He’s right on both counts.
Publishers whose first-party data strategy relies on a third-party identity resolver, whether it works from their logged-in users’ email addresses or from other signals, are under immense pressure.
But Apple has promised not to touch what media owners always had: their own data, with consent they collect and keep, used to target users on their own properties. It’s another reason for media brands to build their own contextual targeting.
Meanwhile, moving ID resolution infrastructure to the publisher’s server is not the easy out some in the industry would have you believe. Apple’s policy says that attempts to circumvent its protections may bring “additional restrictions without prior notice.”
For premium media owners, the future is not the open marketplace, and it is not ID-based targeting as we knew it. It is their first-party data and their own relationship with the audience, and contextual targeting built on top of that data and those relationships.
So can media owners blame Apple? No.
Apple is just accelerating a trend that was already underway. The open marketplace will collapse, sooner or later, and the ad tech companies whose only business is that marketplace will go with it. The ones that provide tools for media owners and advertisers to run their business with trust, safety and transparency at the core will thrive.
And, zooming out from publisher concerns, cybercrime delivered through advertising is much wider than one spyware vendor and much bigger than the current argument with Apple.
So don’t blame Apple. Evolve ad tech.
“The Sell Sider” is a column written by the sell side of the digital media community.
Follow Alessandro De Zanche and AdExchanger on LinkedIn.
For more articles featuring Alessandro De Zanche, click here.
