Apple’s iOS 27 Tracking Block Puts Ad Tech on Notice

By Nathan Brooks

Since the release of iOS 27, Apple has blocked requests to cross-site identity-resolution domains across Safari and every other browser on iPhones, including Google Chrome; macOS 27 Golden Gate applied the same restriction to desktop Safari. An October 19 WebKit post said the blocked domains all provide identity-resolution infrastructure.

On October 15, Confiant and the University of Toronto’s Citizen Lab confirmed a zero-click mercenary spyware attack delivered through targeted advertising. The operation targeted Al Jazeera staff and used technology from two Israeli companies, ad tech vendor Discover-Tech and spyware firm Candiru. Its ads appeared on more than 120,000 websites and 70,000 apps.

Industry complaints cited a month of silence from Apple, with no published domain list and no way to appeal. In at least one documented case, Google could bid on iOS ad inventory while The Trade Desk could not.

The disparity is documented; claims that Apple uses privacy to expand its ad empire remain speculation. Critics call silent enforcement counterproductive, unfair and unprofessional, but they do not erase the confirmed security risk.

Is Apple treating identity as a security problem?

Ad tech gives media owners and advertisers tools under their own standards and consent. Those tools do not require identifying one person across 120,000 sites and 70,000 apps, but the open marketplace is built to recognize the same individual.

Since at least 2021, when programmatic buying was rebranded as the open web, the industry has defended cross-site recognition. Apple distinguishes first-party personalization from tracking. Its concern is any third-party resolver, even one holding a single company’s data, acting as a clearinghouse across sites. That fits Apple’s device-centered trust-and-safety priorities.

Discover-Tech bought ads through Google’s and Yandex exchanges and Comcast’s Beeswax. Citizen Lab said the ads covertly directed millions of devices to Candiru’s servers, likely for large-scale tracking and reconnaissance.

Customers could select a person to profile or infect with malware through a mobile advertising ID, browser cookie ID or IP address. Most advertisers do not deliberately target individuals, but the infrastructure lets bad actors do so.

Apple has restricted, blocked or partly hidden by default those three identifiers since implementing App Tracking Transparency in 2021. In 2019, WebKit said it treats circumvention of anti-tracking measures as seriously as exploiting security vulnerabilities.

Critics say ATT sought consent; the WebKit block does not. The industry’s answer is that users had already chosen through its consent framework: Discover-Tech remained on IAB Europe’s Global Vendor List for more than six years, while hundreds of millions of Europeans clicked “agree” to data processing it controlled.

Citizen Lab senior researcher Wolfie Christl told Forbes: “It’s difficult, if not almost impossible, to consistently protect yourself from malicious ads. Ad blocking must now be considered a cybersecurity best practice.” That supports Apple’s security rationale, although it does not resolve the secrecy and unequal enforcement around the block.

Why can’t vendor lists guarantee trust?

Discover-Tech was also on Google’s Certified External Vendors list and joined IAB Europe’s Global Vendor List as a registered, approved vendor on July 2, 2020. IAB Europe said it vets applicants, including controlling parties’ identities. Yet company records showed board and shareholder links to the spyware industry for most of that period.

Citizen Lab concluded that vendor lists largely rely on self-attestation. Google blocked Discover-Tech for systematic policy violations, and IAB Europe suspended it; both acted only after the researchers’ disclosure. The lesson is direct: know-your-customer checks should rely on human decisions, not a list.

What should publishers and advertisers do?

IAB Tech Lab CEO Anthony Katsur says, “Ad tech can adapt,” while warning that the block creates more pressure on publishers. Media owners using third-party resolvers to turn logged-in email addresses or other signals into audience segments face disruption, especially when those resolvers remain blocked.

Apple promises not to touch publishers’ own consented data used on their properties. Moving identity resolution to publisher servers is no easy escape: the policy warns that circumvention may bring additional restrictions without prior notice.

For premium media owners, the forecast favors first-party data, direct audience relationships and contextual targeting over legacy ID-based targeting.

For practitioners, cross-site identity-based reach will be harder to maintain, and budgets tied to blocked ID workflows will need revision. Available evidence gives no campaign-cost figure, so agencies lack a defensible price estimate from this action.

The column predicts the open marketplace will collapse sooner or later and ID-only vendors will fail, while trust-and-safety tools thrive. That is a forecast, not a confirmed result; Apple’s policy and the researchers’ findings are the confirmed facts.

Whatever the verdict on Apple’s execution, the case’s practical answer is to evolve ad tech. Apple is accelerating an existing shift: vendors must earn trust through vetted partners, first-party tools and transparency. Advertising-delivered cybercrime extends well beyond this dispute.

Going forward, ad tech’s survival will depend on whether those tools can preserve advertiser reach without recreating the tracking system Apple blocked.