Apple iOS 27 to Block Third-Party Identity Resolution and Ad Tracking

Apple Is Killing Third-Party Identity on Safari

Apple's WebKit team just published its block list. Starting with iOS 27, Safari will block third-party identity resolution at the domain level, and the post names names: The Trade Desk (the largest independent ad-buying platform), LiveRamp (the identity and data connectivity company), Experian's Audigent, ID5, and Permutive.

The first-party carve-out is not a carve-out. Apple's position is that if the central matching happens at a third party, it's cross-site tracking and it's blocked. LiveRamp's Authenticated Traffic Solution (ATS), the product that matches logged-in users across sites without cookies, falls directly into this category. The post essentially names ATS's entire category.

What breaks, and when

The first thing that fails is bid enrichment on Safari traffic, which already runs around 19% match rates after Apple's Intelligent Tracking Prevention (the Safari feature that killed cross-site cookies starting around 2020). Once iOS 27 ships, any auction call touching a named resolver at the domain level gets blocked before the bid request populates. Yield teams should audit which identity partners fire on Apple traffic and strip them from Safari paths now, to stop blank ad calls dragging floor CPMs down.

Frequency capping breaks within 90 days of ship. Without cross-site identity, the same user either gets the same ad on a loop or disappears entirely, and campaign performance numbers degrade fast. Safari inventory becomes contextual-only in practice, and the price adjusts quickly.

The steelman case for "overblown" is real: a WebKit post is an engineering team's stated plan, not shipped code. ITP took 12 to 24 months to fully enforce. Server-side tagging, CDN aliasing, and first-party proxies can route identity calls without Apple seeing the handshake in the browser. Safari's share of ad-supported web traffic also runs below its device share, because iOS users spend time in apps where SKAdNetwork (Apple's app-attribution system) already governs.

That said, Apple's post targets the resolver function itself. The workarounds are real and temporary.

Winners and losers

LiveRamp is the most exposed. ATS is the centerpiece of its growth story, and Apple removed Safari from that product's reach while customers watch. New ATS deals get harder to close under that uncertainty.

The Trade Desk registering TTDCDN.org signals they saw this coming and chose the domain game anyway. Domain-level blocking makes that a treadmill.

Publishers who lean on open-web programmatic face an eCPM reset on roughly half of US mobile web inventory. Safari impressions reprice toward contextual rates, and the gap shows up in the next two quarters.

Amazon's DSP (Amazon's demand-side ad-buying platform) is the quiet winner. Device-level identity inside Amazon's own apps never touched Safari's open web. Spend that loses targeting on the open web moves toward surfaces Amazon and Meta own outright, and Amazon owns the biggest one with its own logged-in identity.

Our call: LiveRamp's revenue growth rate for the fiscal year ending March 2027 will come in below the prior year's growth rate, reported in earnings around May 2027. Apple named ATS's category directly, the first-party pivot doesn't clear Apple's own bar, and the drag shows up as deceleration before it shows as decline. For that to be wrong, LiveRamp's CTV and data-collaboration business would have to outrun the Safari hit in the same window Apple is publicly discrediting the core product.

Apple's WebKit team just published its kill list. Starting with iOS 27, Safari will block third-party identity resolution at the domain level, and the blog post names names: The Trade Desk, LiveRamp, Experian's Audigent, ID5, Permutive. The twist that matters is the first-party carve-out that isn't one. Even if a vendor has migrated to a first-party data setup, Apple's position is that if the central matching happens at a third party, it's still cross-site tracking, so it's still blocked.

What's being decided, and how hard to undo. This isn't a decision operators get to make. Apple has made it. What open-web ad-tech operators are deciding is how fast to rebuild Safari monetization around context instead of identity, and whether to keep paying for the cat-and-mouse domain game. For Apple, this is hard to undo. Once WebKit ships resolver-layer blocking and markets it as privacy, walking it back means publicly re-enabling tracking. For everyone else, the deadline is set by Apple's ship cadence, not a blog post. The last time Apple did this (Intelligent Tracking Prevention, the Safari feature that killed cross-site cookies in 2020), the gap between stated intent and full enforcement ran a year or more.

The Market Analyst. LiveRamp is the most exposed public name on the list, full stop. Authenticated Traffic Solution (ATS, their product that matches logged-in users across sites without cookies) is the centerpiece of the growth story, and Apple named it in spirit by naming the whole "authenticated traffic solutions" category. Sell-side will reprice the Safari-addressable part of LiveRamp's forecast toward zero. The Trade Desk registering TTDCDN.org tells you they saw this coming and chose to play the domain game anyway, which is a treadmill when blocking happens at the domain level. For a generalist: Apple just put a hard ceiling on a business these companies told investors had no ceiling. The quiet winner is Amazon's DSP, because device-level identity inside Amazon's own apps never touched Safari's open web in the first place. Spend that loses targeting on the open web walks toward surfaces Amazon and Meta own outright.

The Skeptic. Steelman the "overblown" case, because it's stronger than the headline. A WebKit blog post is an engineering team's stated plan, not shipped code. ITP took 12 to 24 months to fully bite, with carve-outs negotiated along the way. Domain-level blocking has real holes: server-side tagging, CDN aliasing, and first-party proxies route identity calls without Apple ever seeing the handshake. Most large publishers already run server-side Google Tag Manager or Cloudflare Workers that can relay a match without a named domain firing in the browser. And Safari's slice of ad-supported web traffic runs lower than its device share, because those users spend their time in iOS apps where SKAdNetwork (Apple's app-attribution system) already governs. For a generalist: Apple announced the demolition, but the building has back doors and the room was half-empty. The damage is real and narrower than "existential."

The Operator. The thing that breaks first is bid enrichment on Safari traffic, which already runs around 19% match rates after ITP. Once iOS 27 ships, any auction call that touches a named resolver at the domain level gets blocked before the bid request even populates. Yield teams need to audit which identity partners fire on Apple traffic and strip them out of Safari paths now, not to save matching, but to stop blank ad calls that drag floor CPMs down. The 90-day surprise is frequency capping. Without cross-site identity, the same user either gets hammered with the same ad or disappears entirely, and the campaign performance numbers clients use to justify open-web budgets degrade. For a generalist: Safari inventory quietly becomes contextual-only, and the price adjusts fast.

The CFO. The real cost here isn't the identity vendor line item. It's the eCPM reset on roughly half of US mobile web inventory for publishers who lean on open-web programmatic. Safari impressions reprice toward contextual rates, and that revenue gap shows up in the next two quarters, not three years out. On the vendor side, the question is whether the cat-and-mouse spend (new domains, proxy infrastructure, legal review) is money thrown at a treadmill. Every dollar spent routing around domain-level blocking buys months, not a moat. The smarter capital allocation is building measurement and targeting native to Apple's own permissioned framework, Privacy-Preserving Ad Attribution, because that's the one channel Apple won't block. First mover there owns something durable.

Where the council splits

Two real disagreements.

The Skeptic and the Operator part ways on how fast this bites. The Skeptic says 12-to-24-month enforcement gap plus server-side workarounds equals time to adapt. The Operator says blank ad calls and broken frequency capping hit the P&L inside 90 days of ship, workarounds or not, because the enrichment layer fails before the auction. Both can be right: the blocking ramps slowly, but the operational mess shows up the day it starts.

The Market Analyst and the Skeptic disagree on magnitude. The Analyst sees a hard ceiling slammed onto LiveRamp and The Trade Desk's open-web story. The Skeptic says Safari web is already the worst-performing dollar in the stack, so the repricing is smaller than the "existential" framing. The honest resolution: the damage to the vendors named is larger than the damage to the ecosystem, because the ecosystem reroutes to walled gardens while the named resolvers eat the loss directly.

What it hinges on

Three things. First, whether domain-level blocking actually survives server-side relay, or whether Apple extends to behavioral detection that catches proxied matching too. The blog post's logic ("the central resolver is a third party, period") suggests Apple intends to chase the function, not just the domain. Second, how much open-web Safari spend is genuinely identity-dependent versus already contextual. Third, how fast budget that loses addressability on the open web walks to Amazon, Meta, and CTV, where Apple has no reach.

The council leans one way. The workarounds are real but temporary, Apple has stated it's targeting the resolver function and not the domain, and the buy side has somewhere obvious to go. The named resolvers take a structural hit on Apple surfaces. The thing to verify before over-reacting: how much of each vendor's revenue actually touches Safari open-web auctions, because that number separates a dented quarter from a broken thesis.

Prediction: LiveRamp's full-year revenue for the fiscal year ending March 2027, reported in its Q4 FY2027 earnings in roughly May 2027, will grow slower than the prior fiscal year's growth rate.

Confidence: Medium — Apple named ATS's category directly and it's the growth engine.

Why: Apple's post explicitly targets "authenticated traffic solutions," which is the exact category LiveRamp's Authenticated Traffic Solution sells into, and the first-party carve-out language rules out LiveRamp's own post-cookie pivot because the match happens at a third-party resolver. LiveRamp's growth story to investors rested on ATS being the answer to cookie deprecation, and Apple just removed Safari, roughly half of US mobile browsing, from that product's reach while customers watch. New ATS deals get harder to close into that uncertainty, and the drag shows up as a deceleration before it ever shows up as a decline. The opposite outcome, growth accelerating, would require LiveRamp's CTV and data-collaboration business to outrun the Safari hit in the same window Apple is publicly discrediting the core product, which is the less likely path while the news is fresh.

Revisit by 2027-05-31: We're right if LiveRamp's reported revenue growth rate for FY ending March 2027 is below its FY ending March 2026 growth rate. We're wrong if it meets or exceeds the prior year's growth rate.

One more thing the Analyst flagged and I'll underline: the sleeper beneficiary isn't a contextual pure-play, it's Amazon's DSP. Open-web Safari dollars that lose targeting don't evaporate, they move to surfaces Apple can't touch, and Amazon owns the biggest one with its own logged-in identity. That shift won't show up in a LiveRamp print. It'll show up in whose retail-media and app inventory quietly gets more open-web overflow next year.