Apple's Safari Identity Crackdown Pushes Ad Tech Server-Side

Apple's restrictions on identity providers in Safari took effect before the company explained them, leaving publishers and ad tech firms including Audigent, ID5, LiveRamp, Permutive and The Trade Desk scrambling, according to live test results seen by Digiday during the week beginning Oct. 19. The industry's preferred response — moving advertising infrastructure beyond the browser — is accelerating, but no one can yet say whether it will hold.

Apple clarified its objections only after the restrictions landed. In a WebKit explanation published last week, the company objected to identifiers derived from information such as email addresses being used to recognize individuals across websites without explicit consent. Most publishers first learned about the restrictions through industry reporting or outreach from technology partners, not from Apple.

What does Apple actually want?

Apple's communication with the industry remains selective. Most sources described the public WebKit portal as the principal channel for technical questions, though separate sources, requesting anonymity to preserve commercial relationships, said some back-channel discussions had helped resolve outstanding issues.

Digiday's inquiries into Apple's motivations, beyond its stated privacy commitment, went unanswered by press time. Privacy-industry sources suggested Apple's approach may reflect concerns about potential litigation from third-party tracking enabled by its technology — a reading that differs from claims Apple is deliberately undermining independent advertising to feed its own ad business. Apple does not separately disclose advertising revenue, which remains small next to the more than $200 billion it generates annually from iPhone sales.

Critics still see a redirection risk. "An open, ad-funded internet depends on consistent rules," said Amy Jansen-Flynn, managing director of Audience360 & Publift and executive tech council member at IAB Australia. "When one company can switch off addressability for independent publishers while walled gardens keep theirs, it doesn't end tracking; it concentrates it," she said, arguing the changes will push ad spend further toward Apple, Google and Meta.

How much damage has Safari actually done?

Measurably, little so far. Permutive said only a small number of its customers were affected, because consumer adoption of the relevant Safari changes remains low — though it is expected to increase. Affected publishers have been placed on an interim solution while migrating to Permutive's first-party infrastructure, which has supported most customers since 2020.

Several sources noted that relatively low adoption of iOS 27 has generated far more discussion than measurable disruption.

What is the server-side answer?

ID5 is preparing to migrate more of its identity infrastructure server-side, with CEO Mathieu Roche confirming the development. "Going server-side is more resilient because you're not on the device anymore, so there's nothing the device can do to block you," he said.

Under the proposed approach, identity functions previously performed through calls to third-party domains would run through publisher-controlled infrastructure. Roche acknowledged implementation would be harder for smaller publishers, particularly those outsourcing ad operations, but said larger organizations could complete the technical work in days rather than months. ID5 has begun testing revised integrations with selected publishers, though broader deployment remains at an early stage.

Is Trusted Server durable?

The episode has renewed interest in IAB Tech Lab's Trusted Server Framework, introduced in March 2025. The open-source initiative shifts advertising functions traditionally executed in browsers into publisher-operated infrastructure, including server-side ad requests, Prebid Server integration, edge processing and ad stitching.

Criticism predates Apple's intervention. Some question whether the added infrastructure increases complexity and dependence on cloud providers; others raise fingerprinting concerns and whether the framework preserves existing identity practices. The more fundamental objection: does moving third-party identity resolution server-side address Apple's privacy concerns, or simply place those activities beyond its browser-level controls?

Sources familiar with publisher-side identity strategies worry publishers could invest substantial resources in infrastructure built around practices Apple has already said it opposes, inviting another round of cat-and-mouse. Digiday raised these concerns — privacy safeguards, implementation costs, future restrictions — with IAB Tech Lab leadership; it declined to comment.

Who backs publisher control?

"There is no absolute guarantee that any single solution will permanently solve the challenges posed by Apple's ecosystem updates," said Anastasia-Nikita Bansal, TeqBlaze CEO and member of IAB Tech Lab's Trusted Server Working Group. She argued publisher-controlled infrastructure could grow in importance after Google's ad tech antitrust proceedings, particularly behavioral remedies meant to give publishers more flexibility over ad serving while retaining AdX demand.

TeqBlaze maintains that first-party decisioning and server-side operations are complementary, not competing. Still, the costs of operating and maintaining additional infrastructure remain significant, especially for publishers without dedicated engineering resources, and the company warned against providers exploiting the disruption to impose extra costs.

Roche, for his part, rejected the framing of a battle between identity providers and alternative approaches. "I think we're picking the wrong battle by trying to kind of fight against each other," he told Digiday.

Trusted Server could reduce publishers' operational dependence on browsers, and Apple's intervention has raised the urgency. Whether it delivers lasting independence depends not on where the infrastructure sits, but on whether the underlying data practices survive contact with Apple's privacy requirements — a question no framework has yet answered.