Identity Resolution Goes The Way Of The Cookie

Full analysis

Apple just told the ad-tech tracking industry it is a bad actor, in writing, on the WebKit engineering blog. Three Apple engineers published guidance blocking identity resolution providers on Safari, with no grace period and no industry consultation. The Trade Desk's UID2 domain stays blocked. Only its main ad-serving domain came back after a GitHub argument. Zach Edwards of DecryptAds, who joined AdExchanger's James Hercher and Anthony Vargas, says the server-side workarounds everyone is reaching for buy maybe two or three years before Apple shuts them too.

What's being decided: whether to keep investing in persistent-ID infrastructure on the open web, or treat Safari addressability as a wasting asset and reprice around it. This is hard to undo in one direction. If you gut your identity spend and Apple blinks, rebuilding takes years. The other direction is easy: you can keep running UID2 on Chrome and non-Safari traffic tomorrow regardless. There's no hard deadline, which is the trap. Apple enforces at the domain level whenever it wants.

The Market Analyst takes Safari's minority share of web traffic and immediately flags the composition problem: it's an outsized slice of high-income US and European users, exactly the audience premium publishers sell at a premium. Blocking addressability there isn't a rounding error for a Trade Desk or a Magnite leaning on open-web identity. In plain terms: the richest eyeballs on the web just got harder to target by name. But watch who this does not hurt. Walled gardens (Google, Meta, Amazon) have logged-in users and don't need third-party syncing. Every Apple move like this pushes budget toward players who own their audience. That's the real repricing: the open web's independent identity layer loses value, and the logged-in giants gain, again.

The Skeptic starts with Edwards. He runs DecryptAds. His business gets more valuable the more ad-tech tracking looks illegitimate. Weigh his "unsafe at scale, period" against that. The hashed-ID critique has teeth (unsalted, unrotated emails are genuinely weak), but "anyone with a big dataset can de-anonymize them" is the privacy-researcher framing, and the FTC invitation is him recruiting the referee he'd want. The CNAME timeline is also off: he says six-plus years, the real figure is four to five. Small, but he's selling inevitability, and inevitability runs on confident timelines. None of that makes him wrong. It means the "only consent survives" conclusion is also the conclusion that sells his report.

The Operator starts Tuesday morning by auditing which identity syncs touch Safari and modeling the revenue hit. That part is doable. The problem is the cat-and-mouse Edwards describes, where "the cat can see basically everything." You spend engineering cycles moving from subdomains to subfolders, book a short-term win, and Apple closes it on a timeline you don't control. That's not a roadmap, that's a treadmill. The second-order effect at 90 days: your post-cookie identity vendor keeps billing you for coverage that quietly shrinks on your best-paying audience, and nobody sends a notice when it does.

The CFO frames the spend question as whether to keep paying for an identity layer that works great on Chrome and degrades on Safari with no warning. UID2 and its cousins still cover the majority of open-web traffic, so ripping it out now is premature and expensive to reverse. But the chase budget, the engineering time spent evading Apple, has a payback measured in Edwards' two-to-three-year window and then zeroes out. Fund the Chrome-and-app coverage you already run. Stop funding the Safari evasion arms race. That's not retreat, that's declining to pour money down a hole Apple can refill whenever it likes.

The Customer / End User (the advertiser) has a simpler frame. The buyer doesn't care which domain a sync runs through. They care whether they can reach a 40-year-old homeowner in California and measure it. On Safari, that gets harder and more expensive, so budget drifts to where targeting still works cleanly: retail media and the logged-in platforms. The advertiser isn't asking ad-tech to win the Apple fight. They're asking for reach and proof, and they'll buy it from whoever delivers, Apple fight or not.

Where the council splits:

1. Is this a structural kill or a treadmill? Edwards and the Market Analyst say structural: Apple has no Safari ad revenue to protect, so it faces none of Google's constraints and will keep closing doors. The Operator and CFO say it's survivable on everything except Safari for now, so the mistake is overreacting and gutting coverage that still works.

2. How much do you trust the messenger? The Skeptic's whole point. Edwards' "consent is the only path" is both a technical argument and a sales pitch for a world where his firm referees. The others treat his timeline as roughly right. It might be, but "roughly right" is doing a lot when you're deciding a multi-year budget.

3. Who actually wins? Everyone agrees the open-web independent identity layer loses value. The disagreement is whether that's a slow bleed publishers can manage or an accelerant that hands another round to Google, Meta, and Amazon.

What it hinges on: two beliefs. First, that Apple will in fact close the subfolder workaround on something like Edwards' timeline rather than lose interest. Apple's track record on ITP says it finishes what it starts, so this one leans toward Edwards. Second, that regulators pick up the hashed-ID critique. That's far less certain. The Google antitrust penalty was light enough that Edwards himself argues enforcement has no teeth, which cuts against his own FTC hope.

The council leans one way on spending: keep your non-Safari identity coverage, stop funding the Safari evasion chase, and assume budget keeps drifting to logged-in inventory. Verify the revenue-at-risk number on your own Safari traffic before you touch anything. Don't let a vendor or a researcher size it for you.

Prediction: The Trade Desk's UID2 domain will still be blocked on Safari when Apple ships the iOS/Safari release that follows WWDC 2027 (June 2027), with no restoration of identity-sync functionality on that domain.

Confidence: High Apple published this as formal policy and has never reversed an ITP tightening.

Why: Apple's WebKit team put this in writing and enforced at the domain level, restoring only the Trade Desk's generic ad-serving domain while leaving the UID2 identity-sync domain blocked. Every prior Intelligent Tracking Prevention move (third-party cookies, then CNAME subdomain cloaking) has only ratcheted one direction, because Apple has no Safari ad revenue to lose and treats privacy as a product feature it markets. For the block to lift, Apple would have to decide persistent cross-site identity is acceptable after formally labeling the companies behind it "the tracking industry," which runs against both its incentives and its public posture. The opposite outcome, a restoration, would require Apple to walk back a stated policy with no external pressure forcing it, and the light Google antitrust penalty means no regulator is making it.

Revisit by 2027-07-15: We're right if the Trade Desk's UID2 identity-sync domain remains blocked on Safari as of the first iOS/Safari release after WWDC 2027. We're wrong if Apple restores identity-sync functionality on that UID2 domain before then.