Apple's iOS 27 Blocklist Cuts Off Major Ad-Tech Identity Firms

Apple's iOS 27 Blocklist Puts Cross-Site Identity on Notice

Apple's iOS 27 added a blocklist that stops Safari from resolving requests to a set of ad-tech identity vendors. The Trade Desk (the largest independent DSP), LiveRamp (a data connectivity and identity platform), ID5, Permutive (a publisher data platform), and Experian's Audigent were on the initial list. Because Apple requires every browser on iPhone and iPad to run its WebKit engine, Chrome and Firefox on iOS are hit just as hard as Safari. The block is also dynamic: Apple can update the list without shipping a new iOS version, which removes the delay that has historically given vendors time to adapt.

The Trade Desk was quietly pulled back off the list in a test build within days. Apple runs its own ad network, and blocking the largest independent DSP carries antitrust exposure it apparently does not want right now. That removal does not signal restraint across the board. It signals that Apple will use antitrust risk as a release valve for companies big enough to sue it, and leave everyone smaller on the list.

What this breaks

Safari has blocked third-party cookies since 2017 via ITP (Intelligent Tracking Prevention), and vendors have survived by routing around it with server-side integrations and first-party CNAME setups. The dynamic blocklist is different because Apple can kill each workaround the moment it appears. That removes the cat-and-mouse game that kept vendors alive on iOS.

For campaign managers running Safari-heavy inventory, which skews premium, older, and high-income, the repricing has to happen now, not at the next quarterly review. Any DSP seat leaning on RampID or ID5 to extend reach on iOS is flying partly blind. The slower problem is measurement: attribution models that assume a user stays the same person across iOS sessions will overcount unique reach and undercount frequency. The budget misallocation shows up before the dashboard does. Publishers are already being pushed toward the IAB Tech Lab's Trusted Server spec, which means new integration work nobody budgeted for this quarter.

Who loses

ID5 and Permutive are in the worst position. Both are small, VC-backed, and their core product links cookieless browsers back to cookie-based identifiers. Apple just cut that link on roughly half of US mobile traffic with no reversal path for the vendors. One banker quoted in coverage of this story said plainly they would not invest in an ID company today. When the growth surface gets a trapdoor installed and fresh capital dries up at the same time, the usual outcome is a forced sale into a larger data or measurement parent.

Publicis, which has agreed to acquire LiveRamp, cannot renegotiate the deal publicly. LiveRamp still has real value as a first-party data and CRM-onboarding platform for Publicis clients, but the growth story investors were sold rests heavily on the cross-site identity graph Apple just undermined on iOS.

Publishers with Safari-heavy audiences will see CPMs compress on those impressions until they rebuild targeting on contextual signals or logged-in first-party data.

Who gains

Clean-room vendors and Apple's own ad network. Every Safari impression that lost its targeting premium has to be repriced somewhere, and Apple is the one pricing it.

Our call: At least one of ID5, Permutive, or Audigent will be acquired, wound down, or fold its standalone identity product into a parent's offering by the end of Q1 2027 earnings season (mid-February 2027). Confidence is medium: the funding environment is closed, but timing a forced sale is hard. Before repricing your entire iOS strategy, verify how much of your Safari reach actually ran through these specific vendors versus logged-in first-party data you already control.

Apple's iOS 27 added a blocklist that stops Safari from talking to a set of ad-tech identity vendors. The Trade Desk, LiveRamp, ID5, Permutive, and Experian's Audigent were on the first list. Because every browser on iPhone and iPad runs Apple's WebKit engine, this hits Chrome and Firefox on those devices too, not just Safari. The quiet part: Apple built a way to update that list on the fly, without shipping a new iOS version. The Trade Desk has already been pulled back off in a test build, probably because Apple runs its own ad network and does not want the antitrust headline.

How hard is this to undo? For the vendors, very hard. There is no Chrome-style delay-and-reverse escape hatch here. Apple ships the block, and it stays shipped until Apple decides otherwise. For operators repricing Safari inventory, easy to undo. For Publicis, which agreed to buy LiveRamp, impossible to undo. What's actually being decided: whether open-web cross-site identity has a future on the half of US mobile traffic that runs on Apple hardware. What sets the deadline: Q4 campaigns are live now on broken identity plumbing, and the LiveRamp deal closes into this.

---

The Market Analyst. The LiveRamp acquisition by Publicis just got worse, and nobody can renegotiate it in public. Publicis is buying a company whose core asset is a cross-site identity graph, and Apple just put a trapdoor under the Safari half of that graph. The deal still makes sense as a first-party data and CRM-onboarding play for Publicis clients, but the growth story investors were sold is thinner today. ID5 and Permutive are the ones in real trouble. Both are small and VC-backed, and that banker quote about not investing in an ID company is the actual market event. Who gains? Clean-room vendors and Apple's own ad network, which now prices every Safari impression that lost its targeting premium.

In plain terms: Apple shrank the market for the exact thing Publicis just paid up to own.

The Skeptic. Safari has blocked third-party cookies by default since 2017 via ITP, Apple's tracking-prevention system. Identity vendors have routed around it for years with server-side integrations and first-party CNAME setups that make their tracking look like it belongs to the publisher. For this to be the extinction event the press cycle claims, Apple has to find and kill every evasion route faster than vendors can build new ones. That is a big assumption against a long cat-and-mouse history. And the dynamic blocklist cuts both ways: every update Apple pushes carries antitrust optics, which is exactly why The Trade Desk was back off the list inside days. Publishers have discounted iOS audiences in their floors for years. The marginal CPM hit may be smaller than Advertising Week whispering makes it feel.

In plain terms: Safari was already a bad neighborhood for tracking. This makes it worse, not new.

The Operator. Campaign managers running Safari-heavy inventory, premium publishers, older demos, high-income segments, need to reprice that reach in Q4, not at the next quarterly review. Any DSP seat leaning on RampID or ID5 to extend reach on iOS is flying partly blind right now. The slower problem is measurement. Attribution models that assume a user stays the same person across iOS sessions will overcount unique reach and undercount frequency. That means budget gets misallocated for weeks before the degradation shows up in a dashboard. The IAB Tech Lab's Trusted Server spec is where publishers are already being pushed, which means new integration work nobody budgeted for this quarter.

In plain terms: the targeting still runs, it just quietly stops working, and the reports lie to you about it.

The CFO. This is a repricing of an entire asset class, and it will not show up as a single line item anywhere. For the identity vendors, the fundraising door just closed. ID5 and Permutive now have to fund a pivot to contextual or first-party-only products out of whatever runway they have, with that banker quote ringing in every investor's ear. For Publicis, the question is whether LiveRamp's price reflected a growth graph or a defensive data consultancy, because Apple just decided which one Publicis is actually getting. For publishers, the cost shows up as lower CPMs on their Safari audiences, roughly half of US mobile, until they rebuild targeting on contextual signals or logged-in first-party data.

In plain terms: the people who raised money on cross-site ID just watched the collateral lose value overnight.

---

Where they disagree. The Skeptic thinks Safari was already so hostile that this is incremental, and that vendors will route around it like they always have. The Market Analyst and CFO think this time is structurally different, because the dynamic blocklist means Apple can kill each workaround the moment it appears, which removes the cat-and-mouse game that kept vendors alive. That is the real fight: is WebKit now a wall vendors cannot climb, or just a taller fence?

Second disagreement: The Trade Desk's quick removal. The Skeptic reads it as proof the whole thing is constrained by antitrust and will stay restrained. The Market Analyst reads it the opposite way, Apple will use antitrust exposure as a release valve for the companies big enough to sue it, and leave everyone smaller on the list.

What this hinges on. One belief: can Apple durably enforce the block faster than vendors adapt? If yes, open-web cross-site ID on iOS is finished and the survivors are contextual and clean-room plays. If Apple's enforcement is leaky and antitrust keeps it cautious, this is a hard quarter that vendors grind through. The council leans toward structural damage for the small, undifferentiated ID vendors and a release valve for the large. The thing to verify before repricing everything: how much of your Safari reach actually depended on these specific blocked vendors versus logged-in first-party data you already control.

---

Prediction: At least one of ID5, Permutive, or Experian's Audigent will be acquired, wound down, or fold its standalone identity product into a parent's offering by the end of Q1 2027 earnings season (mid-February 2027).

Confidence: Medium — the funding door is shut, but timing of a forced sale is hard to clock.

Why: These are small, VC-backed identity vendors whose core product links cookieless browsers back to cookie-based identifiers, and Apple just cut that link on roughly half of US mobile traffic with a mechanism that has no reversal path. A banker quoted in this coverage said plainly they would not invest in an ID company today, which means the next funding round for these firms either does not happen or happens at a price that forces a sale. When a company's growth surface gets a trapdoor installed under it and fresh capital dries up at the same time, the usual outcome is consolidation into a larger data, identity, or measurement parent that wants the pipes without the standalone burn. The opposite outcome, all three raising clean rounds and continuing independent, requires investors to fund a business model Apple just capped, which is the less likely bet.

Revisit by 2027-02-28: We're right if any of ID5, Permutive, or Audigent is acquired, shut down, or absorbed into a parent's product line by the end of Q1 2027 earnings season. We're wrong if all three remain independent, standalone, and operating their cross-site identity products as before.