Do you hear them?
The bells? The drums?
Apple is coming. And we’re not talking about 30%.
“It’s not enough to block cross-site cookies to prevent cross-site tracking today because the tracking industry has not stopped trying to track users on the web.” Those are the words of Apple WebKit software engineers John Wilander, Charlie Wolfe and Matthew Finkel in a blog post published Monday evening.
The post, titled “Blocking Identity Resolution Infrastructure,” is Apple’s most direct expression to date of contempt for the entire third-party ad tech and mar tech ecosystems. It’s also the first time Apple has laid down such a blatant plan to rid Apple devices of third-party web tracking.
“We do this because users deserve to not be tracked, not across websites and not covertly through fingerprinting, unless they explicitly opt in to it,” writes the Apple trio.
The Apple bites
Apple isn’t taking this extreme policy step lightly.
The WebKit team argues that Apple has been pushed to this point. Blocking all cross-device cookies on Safari in 2020 was “a huge step forward for privacy on the open web,” they write.
But could tech vendors leave well enough alone? Not from Apple’s point of view.
“The tracking industry has not sat idle since,” they write.
Apple’s engineers note that mar tech, ad tech and all sorts of third-party tech and data vendors have rallied under new banners, such as “post-cookie tracking” and “identity resolution.”
An iPhone owner, for example, might sign up for a newsletter or log into a subscription assuming their email could be used by that service for follow-ups or outreach. But when that person unsubscribes from the newsletter or logs out, they’re unlikely to realize their email has already been absorbed into a network of ID graphs, where it can help build third-party profiles and continue to be used for targeting and tracking.
The ad tech and mar tech industries (“the tracking industry” is Apple’s internal nomenclature, apparently) have already begun a major migration from third-party services to a more first-party-based vendor approach – which is a big change.
For instance, LiveRamp’s bread and butter historically has been to serve as the central identity spine or ID graph for many large businesses and media companies. The same goes for its Authenticated Traffic Solution, a network of publisher-provided data. Together, these data assets strengthen the utility of its core RampID.
Switching to a first-party structure means LiveRamp (or any such identity/mar tech/CDP- type vendor) must instead narrow its identity graph to only the first-party data of each individual client. Five or so years ago, this idea was known as a “bunkered” version of a data clean room.
In short, each first party has its own ID graph and therefore no first-party graphs can communicate directly. That’s very different from the marketplace relying on a shared identity that’s constantly being refined and expanded.
But that shift doesn’t necessarily get vendors off Apple’s blocklist. The WebKit team is clear in its blog post that even this first-party-based revolution is wholly inadequate and explicitly part of what is being expunged, starting with iOS 27.
Ouch.
“Even if identity graphs are only scoped to data from a single company, i.e. a first party, the central identity resolver is a third party and it holds cross-site, cross-device and cross-party data about the user and can perform matching and targeting functions in the capacity of a clearinghouse,” write the WebKitters. “That is a tracking capability that each first party does not have on their own.”
For vendors that are not themselves first-party data owners – such as login providers or newsletter services – the iOS 27 block will be in effect.
PrepTech
So, is there anything third-party ad tech and mar tech vendors can do to continue targeting ads on Apple devices?
(crickets)
Seriously, though, the answer is “not much.”
The new iOS policy blocks email addresses and other data to their servers. “The blocking is done on the domain level,” per Apple’s engineers, “meaning they can’t just change the structure of the network request to work around the protection.”
For many vendors, shifting to first-party tech services was already a daunting enough prospect. And in Apple’s view, that may not even shield them from the crackdown.
There are, of course, quicker, less credible and therefore less sustainable workarounds. For example, some of the early ad tech companies targeted by iOS – The Trade Desk, LiveRamp, Experian’s Audigent, ID5 and Permutive – quickly spun up new domains that weren’t on WebKit’s block list. One source familiar with Permutive’s strategy noted that this tactic is a temporary Band-Aid, not a solution.
And for the real ad tech nerds, check out this esoteric Prebid GitHub example. A few weeks ago – right around when AdExchanger first broke news of Apple iOS 27 blocking key ad tech vendors – The Trade Desk created a new domain (TTDCDN.org) to serve as a secondary or backstop domain if/when its core ad-serving domain (adsrvr.org) were to be blocked by Apple.
But this is a losing game of cat and mouse.
In the WebKit team’s telling, “the tracking industry,” their catchall for everyone operating in the world of identity tech, mar tech and ad tech three-letter acronyms, has spent the past five years “usher[ing in] what they call the post cookie era.”
What else could Apple do other than “put strong protection in place” to deal with those post-cookie era solutions?
At this point, some industry sufferers might retort that nobody in the ad tech or mar tech spheres “ushered in” a post-cookie era. Apple did that when it unexpectedly began blocking cookies by default years ago.
Everything that’s happened since has been vendors just trying to get by in Apple’s post-cookie era.
WebKit is unlikely to find their arguments persuasive.
