Browser Owners Are Redrawing The Identity Market

Apple's WebKit team said on 19 October that Safari now blocks network access to identity-resolution infrastructure across iOS, iPadOS, macOS and visionOS 27. The domain-level restriction prevents selected third parties from receiving email addresses and returning identifiers that can recognise the same person across sites and devices.

The immediate impact falls on identity providers including LiveRamp, ID5 and The Trade Desk's UID 2.0, which Digiday reported were among the first services affected. The wider consequence is that browser owners are no longer just limiting tracking techniques. They are deciding which advertising infrastructure can communicate with the user at all.

What Safari Changed

WebKit described identity resolution as a post-cookie method in which a third party receives an email address entered for a login or newsletter, converts it into an opaque identifier and builds an identity graph over time. Apple said logging out or unsubscribing does not necessarily remove the identifier held by that outside service.

Safari's response is deliberately broad. The block operates at the domain level, so changing the request format will not bypass it. WebKit also drew a line between a company personalising its own service and an outside resolver that can connect data across sites, devices and parties. In Apple's wording, “First party personalization is not tracking.”

8 Data Clean Room Platforms for APAC Marketing Teams

Compare eight current data clean room platforms for APAC marketing teams, with practical differences across cloud fit, privacy controls, identity, activation, partner adoption, and documented regional support.

Mission MediaMission Media

Browser Policy Now Determines Market Access

The common reading is that this is another privacy update. That misses the commercial mechanism. A browser-level block can remove an identity partner from campaign activation and measurement before a marketer, publisher or agency has made its own vendor decision.

The affected market is not standing still. Identity providers have spent years positioning email-based identifiers and clean rooms as privacy-conscious replacements for third-party cookies. Safari is now arguing that the central resolver remains a tracker because it can see relationships no single first party can see alone.

That leaves publishers and advertisers with a governance problem as much as a technical one. Apple has not publicly named every blocked company or explained a full entry and appeal process. Digiday reported that The Trade Desk's ad-serving domain was initially caught alongside UID 2.0 and later restored after being blocked by mistake.

Apple's Advertising Expansion Raises The Stakes

The timing adds competitive context. Digiday counted 86 open roles tagged Apple Ads, including positions in ad matching, machine learning and campaign optimisation, while Apple is reportedly expanding advertising into Maps. The publication also cited Branch data showing Apple's share of the iPhone app-install ad market rose from 17% to 58% around the period when App Tracking Transparency reduced tracking options for rivals.

That does not prove the Safari change was designed to advantage Apple's advertising business. It does mean CMOs and publishers should separate two questions: whether the privacy rationale is valid, and whether the process for deciding access is transparent. As one publishing-side ad-tech executive told Digiday, allowing Apple to determine which companies can communicate with Safari amounts to making “market-access decisions.”

What APAC Marketing Leaders Should Do Next

For APAC teams, the practical risk is uneven performance across markets, devices and data architectures. Regional programs already span different privacy regimes, cloud locations, publisher relationships and levels of logged-in audience coverage. A vendor that still supports activation in one environment may lose reach or measurement continuity in another.

CMOs should ask agencies and identity partners for a browser-specific impact assessment, including which domains are blocked, which functions fail, what first-party alternatives remain and how reported conversions change. Clean-room claims also need closer scrutiny. Privacy-safe computation does not guarantee browser access, and a technically compliant matching process may still depend on infrastructure Safari refuses to contact.

The decision is not whether to abandon identity or personalisation. It is whether the brand can continue operating when a browser owner changes the permitted route. Marketing leaders should require portable consent records, server-side measurement with clear legal purpose, direct publisher relationships and test plans that do not assume any external identifier will remain available. Safari's move suggests that post-cookie resilience now depends less on finding a universal replacement and more on removing single points of platform control.