Identity resolution has become the most expensive phrase in publisher ad tech this fall. On October 19, 2026, Apple's WebKit team said Safari now blocks network access to identity resolution infrastructure in its 27 releases, and on October 27, Digiday published the first broad look at what that means for the money, using data from the publisher platform Aditude. Where the update has landed, eCPMs are down 4% on iOS and 11% on Macs. This guide explains what Apple blocked, what the early numbers show and seven proven steps to protect your yield.
We stick to what the sources actually say. Every number in this article comes from Apple's own post or from Digiday's reporting, which credits Aditude, Permutive, OpenX, eMarketer and Enders Analysis. We do not project your losses, because no one can yet say how far the damage spreads, and Digiday says as much itself.
Table of Contents
What Is Identity Resolution?
In ad tech, identity resolution is the work of recognizing the same person across different sites and devices. Digiday describes the companies that do it as firms that piece together scraps of data about a person, from email addresses and phone numbers to IP addresses and device details. The result is an identifier that buyers can use to target, cap frequency and measure campaigns.
Apple's definition is narrower and more pointed. In its post, the WebKit team describes third parties that invisibly collect an email address when someone logs in or signs up for a newsletter, send it to their servers, create an opaque tracking ID permanently linked to that email and send the ID back to the page. Over time, Apple says, these companies build a data profile it calls an identity graph.
That framing matters for publishers. Many of the identity tools in your Prebid stack rely on exactly this pattern: a hashed email collected at login or newsletter signup, turned into an ID that travels in the bid request. Apple's post treats that whole category as tracking, even when the publisher collected the email with a clear purpose in mind.
What Apple Blocked and Why
According to the WebKit team's explanation, Safari and WebKit block network access to identity resolution infrastructure in the iOS, iPadOS, macOS and visionOS 27 releases. Apple says this stops those services from sending email addresses to their servers. The blocking is done on the domain level, so a vendor cannot get around it by changing the structure of a network request.
Apple draws a clear line around first party use. Its post states that first party personalization is not tracking and is not what its technologies seek to prevent. The catch is in the next sentence: even when an identity graph is scoped to one company's data, Apple says the central identity resolver is still a third party holding cross site, cross device and cross party data.
The post also explains the reasoning. Apple notes that it fully blocked cross site cookies six years ago, and argues that the tracking industry responded with a post cookie method built on email addresses. It points out that for most users, an email address is a globally unique ID they keep for years, even decades, which allows cross device tracking as well as cross site tracking.
Apple names no vendors in the post. It also reminds iCloud+ subscribers that its Hide My Email service creates a unique, random address for each website, which adds protection against email based tracking. For publishers that rely on logged in readers, that is a second, quieter pressure on the same signal.
How We Got Here: The Safari 27 Timeline
The block did not arrive with an announcement. Digiday's account starts last month, when the latest iPhone software update landed and The Trade Desk's ads stopped loading in Safari. Apple had blocked two of its web addresses: the ad server that puts its ads on screen and its UID 2.0 identity system. The industry soon worked out that ID5, LiveRamp, Permutive and Audigent had been cut off too.
In early October, Apple partly restored The Trade Desk's ad server. UID 2.0 and the other identity vendors stayed blocked, and Apple said nothing while the industry spent Advertising Week New York guessing why. On October 19, the WebKit post finally explained the move. We tracked the first wave of revenue effects in our earlier guide to Safari ads after iOS 27.
What the Early Numbers Show
The most useful publisher data so far comes from Aditude, as reported in Digiday's graphic analysis. Across Aditude's customers, browsers built on WebKit, which Digiday describes as Safari everywhere and every browser on iPhones and iPads, account for 30% of ad impressions and 28.5% of ad revenue. That is the exposure at stake once the update reaches everyone.
It has not reached everyone yet. Only 3.8% of impressions and 3.3% of Prebid revenue had moved to the updated version when Digiday published, but adoption grew by half in a week, and new iPhones over the holidays will push it higher. In other words, the early losses apply to a small slice of traffic that is growing quickly into a large one.
Where the update has landed, buyers are bidding less. Digiday reports that iOS bid rates fell 14% between September 15 and October 8 and have since been down about 8%, while Mac bid rates are off about 25% with no sign of recovery. Digiday links the Mac weakness to The Trade Desk's bidding, which had yet to come fully back after Apple's block accidentally caught its ad server.
Publishers are earning less per ad as a result. According to the same Aditude data, eCPMs are down 4% on iOS and 11% on Macs, and revenue per ad opportunity has fallen 6% and 20% respectively. The gap between those two measures is worth noticing: revenue per opportunity falls further than eCPM, a sign that weaker bidding may be costing fill as well as price.
Why the Losses Could Grow
Digiday's view is that the losses look set to grow, because Apple has shown every sign of pressing on. Blocking trackers fits the privacy stance Apple has spent years building its brand on. Put the Aditude numbers together and the logic is simple: a decline that today touches a few percent of impressions will touch far more as the update spreads through a channel worth more than a quarter of revenue.
There is also a commercial undercurrent. Part of what makes the crackdown hard for ad tech to accept, Digiday notes, is the suspicion that it clears the way for Apple's own ads business. eMarketer expects Apple to earn $9.05 billion from ads in the U.S. in 2026, rising to $10.46 billion in 2027, and $14.48 billion globally in 2026.
Enders Analysis adds context on why ads matter to Apple. In 2018, services brought in 24% of Apple's profit, with hardware such as the iPhone delivering the other 76%. Today services account for 43% and products 57%. Apple does not say how much of that comes from ads, but every dollar there adds to the part of the business it most wants to grow.
The Other Side of the Argument
Not everyone thinks the loss of IDs is the real story. Permutive, itself one of the companies Safari blocked, argues that the better question is how many readers IDs ever reached. Its data, as reported by Digiday, shows inventory without IDs traded at an average 42% discount to Chrome across more than 10 publishers and 569 million winning bids in August, with the gap wider on mobile.
But Permutive also says IDs cover only about 30% of the bid stream, which leaves buyers competing for a minority of readers and most publisher audiences going unsold. Its pitch is that publisher data can reach the rest. Across more than 80 publishers over 12 months, Permutive's analysis found that applying that data lifted CPMs by 76% on direct sold deals and 32% on private marketplace deals.
OpenX numbers in the same report point the same way. In 2022, 78% of U.S. buyer targeting spend through OpenX went on third party audience data. By 2025, that share had shrunk to around 40%, while targeting by the content around an ad rose to as much as 35%, helped by CTV. Read these as directional signals from vendors with a view, not neutral benchmarks.
7 Proven Steps to Protect Your Yield
None of these steps reverse Apple's decision. They help you see the impact clearly, keep the readers you have and sell the signals that still work. Each one draws on the sources above.
1. Split your revenue by browser and OS version
Aditude's numbers are averages across its customers. Your own exposure depends on how much of your traffic runs on WebKit and how much of that has updated. Break out impressions, eCPM, fill and revenue per opportunity by browser and operating system version so you can see the trend as adoption grows through the holidays.
2. Track revenue per opportunity, not just eCPM
The Aditude data shows revenue per ad opportunity falling further than eCPM on both iOS and Mac. If you only watch eCPM, you will miss lost fill. Add a per opportunity or per session metric to your daily dashboard.
3. Audit which identity vendors load on your pages
Apple names no vendors, but Digiday lists UID 2.0, ID5, LiveRamp, Permutive and Audigent among those cut off. Check your Prebid user ID modules and tag manager for these and similar scripts, confirm what each one collects and how its identity resolution works, and decide whether it still earns its place on Safari traffic.
4. Keep first party relationships first party
Apple's post says first party personalization is not what it seeks to prevent. Logged in readers and newsletter subscribers still have value on your own site, even if the email can no longer travel to a third party resolver in Safari. Our guide on how to monetize first party data covers the basics.
5. Package context into deals
The OpenX shift toward content based targeting suggests buyers are already paying for context. Build private marketplace packages around your strongest content verticals so Safari impressions carry a reason to bid that does not depend on knowing the reader.
6. Plan for the holiday adoption jump
Digiday expects new iPhones over the holidays to push adoption higher. Treat Q4 forecasts for Safari and iPhone traffic with caution, and avoid committing to guaranteed numbers that assume pre update pricing.
7. Talk to your demand partners
Ask your SSPs and ad management partner how their Safari bid rates have moved since September and which identity resolution signals, if any, they now pass for WebKit traffic. Our guide to cookieless advertising lists the alternatives worth raising.
What to Watch Next
The next few months will show whether the early declines hold as adoption grows. Watch for fuller data from more platforms, any change in Apple's list of blocked domains and how quickly The Trade Desk's bidding returns on Macs. Also watch how buyers price context and publisher data on Safari, because that is where the replacement value will show up first.
For most publishers, the practical lesson is clear. Identity resolution on Safari can no longer be treated as a dependable layer of yield. The sites that measure their exposure early, protect their direct reader relationships and sell context with confidence will be in the strongest position when the holiday adoption wave arrives.