Insights

Apple’s identity resolution block is live: an exposure audit for publishers and buyers

Apple's WebKit block on identity resolution domains has shipped. What is confirmed, what is only reported, how to size your exposure on Apple devices and which fallbacks hold up.

· KASIS

Much of the trade coverage still talks about what Apple plans to do. The core change has already shipped. According to a WebKit blog post of 19 October 2026, Safari and WebKit in the iOS, iPadOS, macOS and visionOS 27 releases block network access to what Apple calls identity resolution infrastructure. iOS 27 began rolling out on 14 September 2026, according to PPC Land.

What is not confirmed is how far the block reaches: which vendors, how many, and how often the list changes. For anyone setting 2027 yield and audience budgets, that uncertainty matters more than the headline.

Confirmed and reported

Confirmed by Apple. The WebKit post describes third parties that collect an email address at login or newsletter sign-up, send it to their servers and return an opaque tracking ID to the page. Blocking is by domain, so vendors cannot simply change the structure of the request to work around it. Apple says “first party personalization is not tracking”, but argues that a central identity resolver is still a third party, even if its graph covers only one company’s data. The post names no vendors, gives no start date and describes no appeal process.

Reported, not confirmed. PPC Land reports that within a week of the rollout The Trade Desk could no longer serve ads in Safari on updated devices. On 29 September AdExchanger listed Unified ID 2.0, ID5, Audigent, LiveRamp and Permutive as affected. On 2 October, citing two unnamed sources, it reported a remotely updated list of hundreds of companies, also applying to other iOS browsers because they run on WebKit. In early October PPC Land noted that “Apple has confirmed none of it”, and Apple’s later post still names no vendors.

What is new compared with tracking prevention

WebKit’s tracking prevention page (last modified April 2023) already describes blocking all third-party cookies, partitioning third-party storage and capping cookies that JavaScript sets on landing pages from decorated links, as well as CNAME-cloaked cookies. Those rules limit what persists.

The new mechanism stops the call itself. In IAB Australia’s explainer, when a domain is on the list “the browser never makes the request”: no bid, no ID resolution, no creative. IAB Australia adds that the blocking code had been in public WebKit code since February and that the list surfaced through a Trade Desk bug report. Because Apple classifies by domain and says the request structure cannot be changed to avoid it, we would not assume a CNAME or first-party subdomain setup is safe.

Publisher exposure: sizing it

  • 24.88% Safari share of page views in Belgium, all platforms, September 2026 (StatCounter)
  • 19.94% Safari share across Europe, September 2026 (StatCounter)
  • 28.5% share of ad revenue from WebKit browsers across Aditude’s publisher customers (Aditude data reported by Digiday, October 2026)

StatCounter measures page views, not impressions or revenue, and counts Chrome and other iPhone browsers under their own names. AdExchanger and Digiday report that those browsers also run on WebKit, but none of our sources addresses Belgian or EU users specifically. Confirm the picture in your own browser and OS data before treating Safari share as a floor.

The Aditude figures, 30% of impressions and 28.5% of revenue, are Aditude’s own customer data as reported by Digiday: not Belgian, and covering all WebKit versions. They describe exposure, not revenue already lost. Apple places the block in the version 27 releases, so we infer that today’s loss depends largely on how many of your users have updated. Your own analytics, split by browser and OS version, is the only reliable number.

Evidence on CPMs is still limited. According to Permutive data reported by Digiday, no-ID inventory such as Safari sold at an average 42% discount to Chrome in August 2026, with a wider gap on mobile. The sample was more than 10 publishers and 569 million winning bids. Permutive also says IDs reach only about 30% of the bid stream.

Prebid needs a check too. The User ID module runs client-side: it calls the vendor’s URL from the page and, under the TCF, only with Purpose 1 consent. Sub-modules include id5IdSystem, uid2IdSystem, identityLinkIdSystem (RampID), hadronIdSystem (Audigent) and permutiveIdentityManagerIdSystem. The documentation says nothing about Apple, so blocked status can only be established by testing on iOS 27 devices. Test SharedID (EID source sharedid.org) and PubProvided ID (the publisher’s domain) as well, rather than assume they are unaffected.

Advertiser exposure

On the buy side, we would expect exposure wherever a campaign depends on an ID resolved in the browser on Apple devices. The places to check first are typically cross-site frequency capping, audience matching and measurement calls. If your DSP’s own domain is blocked, delivery on updated Safari stops rather than degrades, because the bid request is never made.

IAB Australia’s explainer, updated later in October, said The Trade Desk’s adsrvr.org would stay blocked until iOS 27.2 reaches users. Digiday reported in early October that its ad server had been partly restored, though bidding had not fully returned. Reports on its status have shifted since September, so ask your DSP for its current position rather than relying on older coverage.

Fallbacks and their limits

FallbackWhat it offersLimits
Publisher first-party data and loginsPermutive’s analysis of 80+ publishers over 12 months found own data lifted CPMs by 76% on direct deals and 32% on PMPs (Permutive figures reported by Digiday, October 2026).Logged-in users are a minority of traffic for many titles, per IAB Belgium.
Server-side identityID5’s CEO told Digiday, as summarised in AdExchanger’s 29 October roundup, “There’s nothing the device can do to block you”.Harder for smaller publishers without engineers. Apple’s reaction is unknown. IAB Tech Lab’s Trusted Server has no formal release yet, per PPC Land.
ContextualIn our view, the main appeal is that it does not depend on a user ID resolved in the browser.It is typically weaker for frequency control and conversion measurement. It replaces targeting, not identity.
Clean roomsIAB Belgium (2026, undated) cites a Belgian sales house working on LiveRamp and InfoSum, and an online bank that used a LiveRamp clean room through it to exclude existing customers from acquisition campaigns, with no efficiency figures published.Most Belgian organisations are exploring or piloting, per IAB Belgium. No source says whether clean room flows are affected by the block.

Two cautions. Moving identity calls to new domains not yet on the list is a temporary fix, as AdExchanger’s roundup describes it: a remotely updated list can catch up.

And, in our view, moving identity calls server-side may not remove the consent question. The EDPB’s Guidelines 2/2023 on Article 5(3) of the ePrivacy Directive (version 2.0, adopted 7 October 2024) include a section on unique identifiers (section 3.5), covering identifiers derived from an email address or phone number and shared across controllers, usually obtained at login or newsletter sign-up. In the TCF, Purpose 1 signals that Article 5(3) condition. Whether and how this applies to a server-side route is a question for your legal team.

What to do in the next 30 days

Publishers

  1. Measure WebKit share of sessions, impressions and revenue in your own data, including Chrome and in-app browsers on iOS, and the share already on version 27.
  2. List every userId sub-module in your Prebid build and the domains it calls. Test on iOS 27 devices and compare userIdAsEids in bid requests against older iOS versions.
  3. Compare CPM and fill for ID and no-ID impressions by browser, since the iOS 27 rollout in mid-September.
  4. Package first-party segments for direct and PMP deals, and review which bidders receive each ID through the bidders parameter.

Advertisers

  1. Ask your DSP and agency for delivery, match rates and frequency by browser and OS version since mid-September, not blended totals.
  2. Ask data and measurement vendors which of their domains fail on iOS 27 in their own tests, and whether workarounds rely on new domains.

We think the safe planning assumption is a list that grows and changes without notice. Budget on numbers you have measured yourself, not vendor averages, and treat any domain-based workaround as temporary.

Researched and drafted by KASIS Writer, our AI agent, from the public sources below. Reviewed and edited by the KASIS team.

Sources

More insights

All insights

Tell us what you’re working on.

Whether you sell media, buy it or build the technology in between, write to us and we’ll get back to you.