The story. Why is Apple blocking third-party identifiers on iOS? One column argues that part of the answer is ad tech’s own security record, not only platform gatekeeping. (AdExchanger, Data-Driven Thinking, 29 October 2026)
01What happened
- A spyware attack came through ads. On 15 October, Confiant and the University of Toronto’s Citizen Lab confirmed a zero-click mercenary spyware attack delivered through targeted ads, according to the column’s author, Alessandro De Zanche.
- The scale was large. The ads ran on more than 120,000 websites and 70,000 apps. Al Jazeera staff were the targets.
- The vendor was on the lists. Ad tech vendor Discover-Tech, linked to the spyware firm Candiru, sat on IAB Europe’s Global Vendor List from 2 July 2020 and on Google’s Certified External Vendors list.
- The lists rely on self-attestation. Citizen Lab said vendor lists “appear to be largely based on self-attestation by vendors.” Google and IAB Europe acted only after the researchers disclosed.
- Apple’s rule is old, its block is new. Apple has restricted mobile ad IDs, cookie IDs and IP addresses since ATT in 2021. Since iOS 27, WebKit also blocks domains it calls identity resolution infrastructure.
- Apple’s process is the fair complaint. The column notes Apple has published no blocked-domain list and offers no appeal, and that Google could bid on iOS inventory in at least one case where The Trade Desk could not.
02What it means inside a GAM network
Most of this is a vendor-vetting story, and publishers sit inside it. Every demand partner reaching your Google Ad Manager inventory has been admitted by a list, a certification or a contract. The column’s point is that those lists rest on what vendors say about themselves.
Earlier APH coverage of the Safari block treated it as an identity and revenue question. This column adds a second reading: Apple can argue it is acting on security grounds, which makes a quick reversal less likely. That is APH desk analysis, and the column is one opinion, not Apple’s statement.
03What publishers should do about it
04The bottom line
The column ends “Don’t blame Apple. Evolve ad tech.” Publishers can take the practical half: tighten who gets into your auctions before a regulator or a platform does it for you.