Apple’s latest Safari restrictions on identity-linked domains have done what no amount of trade-press debate could: they have pushed a meaningful slice of ad tech to move identity resolution out of the browser and into publisher-controlled servers. The response is early, but the direction is clear.
What Apple changed
Apple’s WebKit team last week explained its objection to identifiers derived from signals such as email addresses being used to recognise people across websites without explicit consent. The restrictions themselves began before that explanation, leaving publishers and vendors to act on incomplete information. Live tests seen by Digiday during the week beginning Oct. 19 showed impact at Audigent, ID5, LiveRamp, Permutive and The Trade Desk.
The server-side shift
ID5 confirmed it is preparing to move more identity functions to publisher-controlled infrastructure. CEO Mathieu Roche argues resilience is the point:
“Going server-side is more resilient because you’re not on the device anymore, so there’s nothing the device can do to block you.”
He acknowledged implementation is harder for smaller publishers that outsource advertising operations, but larger organisations could complete the technical work in days rather than months. ID5 has started testing revised integrations with selected publishers.
Trusted Server gets a second look
IAB Tech Lab’s Trusted Server Framework, introduced in March 2025, is now drawing renewed interest. It proposes shifting ad requests, Prebid Server integration, edge processing and ad stitching into publisher-run systems. Supporters say this reduces dependence on browser policy. Critics point to added complexity and cloud dependence, and worry it may simply move practices beyond Apple’s view without resolving the underlying privacy questions.
- Restrictions arrived before Apple’s public clarification, leaving little time to adapt.
- Server-side identity removes device-level blocks but does not automatically answer Apple’s privacy objections.
- Larger publishers can test in days; smaller teams face bigger costs and vendor risk.
Why this matters for marketing budgets
Amy Jansen-Flynn, managing director of Audience360 & Publift and an IAB Australia executive tech council member, warned that selective addressability could concentrate spend:
“When one company can switch off addressability for independent publishers while walled gardens keep theirs, it doesn’t end tracking; it concentrates it.”
Immediate commercial damage is limited because iOS 27 adoption is still low. Permutive said only a small number of its customers were affected. But the structural signal is bigger: independent publishers risk losing predictable targeting, pushing more budgets toward Apple, Google and Meta. Apple has not separately disclosed ad revenue, and it remains small next to more than $200 billion in annual iPhone sales.
What to do now
Anastasia-Nikita Bansal of TeqBlaze and the IAB Tech Lab Trusted Server Working Group cautioned that no single solution is guaranteed against Apple’s ecosystem updates. Vendors should not exploit the disruption to pile on new charges, and publishers should treat server-side moves as part of first-party data strategy rather than a one-time fix.
The unresolved question is whether publisher-controlled infrastructure can satisfy Apple’s privacy requirements, or whether it becomes the next round of cat-and-mouse. Until that is answered, the safest path is to reduce dependence on browser-level identity calls while being honest about the costs.
Source: Digiday
