The story. A month after Safari started cutting off identity companies, Apple has explained why. Its engineers say email addresses have replaced cookies as the tracker, and that outside firms matching data across sites are the target. (Digiday, 20 October 2026)
01What happened
- Apple published its reasoning. A blog post from the Safari engineers on Monday 19 October says a company working with a site can take an email typed into a form and turn it into an ID.
- The named targets are plain. LiveRamp, ID5 and The Trade Desk’s UID 2.0 all work this way. Permutive and Audigent were also among the first companies cut off in September.
- The block is wider than iPhone. Apple’s post confirms it reaches Macs and the Vision Pro headset as well as iPhones and iPads.
- It blocks whole addresses. Safari shuts out the entire web address of a listed company, so changing how a request is built will not get it through.
- It has already hit the wrong target once. The Trade Desk’s ad server was blocked with UID 2.0 in the first days. A person with knowledge of the matter says it has been switched back on.
- Most ad tech still loads. Digiday’s own testing found most of the ad tech addresses it checked were still loading. Apple says it will keep preventing “covert and cross-site tracking by default”.
- Apple is hiring for ads. It has 86 open roles tagged Apple Ads, and 17 are in New York. Many listings predate the block, which points to a planned buildout.
02What it means inside a GAM network
The line Apple draws matters more than the list. A publisher using its own data to recommend articles or tailor pages is not tracking, in Apple’s account. The outside firm that matches that data is, because it can link one person across sites that no single site could join alone.
That describes the identity vendors many publishers pay to make readers more valuable to buyers. Apple’s post names no company, explains no route onto the list and offers no route off it. Our earlier piece put the first measured loss at 10.5% on updated readers, about 1% sitewide. This explanation says that loss was a policy, not a bug, and the policy has no stated limit.
For ad ops the practical point is where the identifier travels. A publisher-provided identifier set in Ad Manager is your own signal. An ID produced by a vendor you call from the page, or from a Prebid user ID module, depends on that vendor’s web address staying reachable.
The Trade Desk case is the warning for any inference. Apple’s list has already caught one company by mistake, so a block that appears in your logs may not be the one Apple intended.
One caution on motive. Digiday points to the record: Criteo warned in 2017 of a hit of up to 10% to fourth-quarter revenue ex-TAC, and Meta put the cost of App Tracking Transparency at about $10 billion for 2022. Apple declined to comment beyond its post, so any link to its ads hiring is inference.
Apple has said the quiet part out loud: email-based IDs are the target, and the outside matcher is the problem.
03What publishers should do about it
04The bottom line
Apple has said the quiet part out loud: email-based IDs are the target, and the outside matcher is the problem. Treat every identity vendor on your page as a dependency that Safari can switch off.