Apple cuts identity resolution off at the domain level

Apple's WebKit team has published its most explicit plan yet to remove third-party web tracking from its devices, and it targets the one mechanism the industry built to survive cookie deprecation: email-based identity resolution. In a blog post titled "Blocking Identity Resolution Infrastructure," WebKit engineers John Wilander, Charlie Wolfe and Matthew Finkel write that "it's not enough to block cross-site cookies to prevent cross-site tracking today because the tracking industry has not stopped trying to track users on the web." Starting with iOS 27, Safari and WebKit will block network access to identity resolution infrastructure at the domain level across iOS, iPadOS, macOS and visionOS, preventing email addresses and other identifiers from being handed to providers such as LiveRamp, The Trade Desk, ID5, Permutive and Experian's Audigent. The twist that resets the whole first-party strategy: even a "bunkered" ID graph scoped to one company's data is being expunged, because "the central identity resolver is a third party and it holds cross-site, cross-device and cross-party data about the user." AdExchanger's James Hercher reports vendors are already spinning up backstop domains (The Trade Desk's TTDCDN.org) in a game Apple's engineers call unwinnable. Apple blocked cross-site cookies on Safari in 2020, and WebKit is explicit this is the escalation five years on, not a rerun of the 30% App Store commission fight but the identity layer underneath it.

The crux

Apple is not just killing cookies; it is declaring the post-cookie identity stack, the hashed-email ID graphs the sell side spent five years building, to be tracking, and blocking it at the network level before consent is ever asked.

Sell-side read

Addressable yield on Safari and iOS inventory is now under direct threat, because the authenticated-email signal that props up publisher CPM premiums and UID2/RampID-style IDs (the tokens IAB Tech Lab's identity guidance calls the foundation of cross-site matching) cannot leave the device. Publishers with deep first-party, logged-in audiences keep an edge; everyone else watches a large share of mobile web traffic get harder to monetise.

Watch

Whether IAB Tech Lab's Trusted Server and publisher-side server resolution become the sanctioned workaround, and how far Apple's domain blocklist expands over the next two quarters.