Safari iOS 27 tracking block: what it means for iGaming

The short version: Apple's 27 software releases stop Safari from connecting to third-party identity resolution vendors. These are the companies that turn an email address typed at login or newsletter sign-up into a tracking ID that follows people across sites ^[1]. So far the measurable damage is small, because few people have updated. Where the update has landed, though, bids and prices have fallen, and Apple has said it will keep going ^{[2, 5]}. iGaming advertisers who rely on cross-site IDs to find adults, and to keep the wrong people out of their audience, should plan now around signals that don't depend on those IDs. That means contextual targeting, publisher first-party data and logged-in environments.

No iGaming-specific data on the block has been published yet. This piece draws on general advertising reporting and Apple's own documentation, and applies it to licensed operators and affiliates.

What Apple actually blocked

On 19 October 2026, Apple's WebKit team set out the policy. In the iOS, iPadOS, macOS and visionOS 27 releases, Safari and WebKit block network access to identity resolution infrastructure. The block works at the domain level, so vendors cannot get round it by changing the structure of their requests ^[1]. Apple describes the target as third parties that are present on pages where people enter an email address but are not login providers or newsletter services themselves ^[1].

Two points in the post matter for advertisers. First, Apple says first-party personalisation is not tracking and is not what it is trying to prevent. Second, it says a central identity resolver is still a third party even when it only handles one company's data, because it can do matching and targeting as a clearinghouse ^[1]. Owning your data is not enough on its own. What matters is where the matching happens.

The industry found out before Apple explained anything. According to Digiday, the update cut off The Trade Desk's ad server and its UID 2.0 identity system, and ID5, LiveRamp, Permutive and Audigent were soon found to be blocked too. Apple partly restored The Trade Desk's ad server in early October, but the identity vendors stayed blocked ^[5]. Digiday also reported that the block runs from a list few people outside Apple can see ^[2], and one publisher executive said there was no notice to affected businesses and no clear way to appeal ^[3].

What publishers and buyers are seeing

The early numbers come from ad tech vendors, not Apple, and cover their own customers. Treat them as signals, not market-wide measures.

In the first week, Aditude reported that Safari on iPhones and iPads made up 11.7% of the ads its customers showed and 11.4% of their ad revenue. Only about 8% of users had upgraded at that point, and Aditude put the overall revenue hit at about 1% ^[2]. Some publishers saw little or no impact, especially those with mostly subscription businesses. One executive warned that the block would hurt publishers with little direct-sold inventory more than those selling much of their inventory directly ^[2].

By late October the picture was wider. Across Aditude's customers, browsers built on WebKit account for 30% of ad impressions and 28.5% of ad revenue. That includes Safari everywhere and every browser on iPhones and iPads. iOS bid rates fell 14% between 15 September and 8 October and have since been down about 8%. Mac bid rates were off about 25%. eCPMs were down 4% on iOS and 11% on Macs ^[5]. Only 3.8% of impressions had moved to the new WebKit version so far, but adoption grew by half in a week, and Digiday expects holiday iPhone sales to push it higher ^[5].

Permutive also argues that IDs only ever covered about 30% of the bid stream. In its analysis of more than 80 publishers over 12 months, applying publishers' own data lifted CPMs by 76% on direct-sold deals and 32% on private marketplace deals ^[5]. Permutive is itself one of the blocked vendors and sells this approach, so read the figure with that in mind.

Addressability is back on the agenda

At Prebid Summit in New York on 13 October, Digiday reported that addressability and measurement restrictions were back at the top of the agenda after iOS 27, and that speakers expected the trend to continue for years ^[4]. Permutive's CEO said publishers are moving audience intelligence and decision-making to the supply side, much as Meta rebuilt its targeting on its own signals after Apple's earlier changes ^[4].

The supply side's main technical answer is server-side infrastructure. Publishers have returned to IAB Tech Lab's Trusted Server, which moves ad processes off the reader's device and onto servers the publisher controls ^[3]. ID5 is moving more of its identity infrastructure server-side ^[6]. But doubts remain. Critics question whether moving third-party identity resolution server-side deals with Apple's privacy objection or just puts it out of the browser's reach. Some sources fear another round of cat and mouse, with publishers investing in practices Apple has already said it opposes ^[6]. Buyers should not assume today's workarounds will last.

Why this matters more in iGaming

For most advertisers, losing IDs means some lost efficiency. For gambling advertisers there is a second issue. Identity signals often do two jobs: finding the right adult audiences, and keeping the wrong ones out. When an ID stops resolving on Safari, both jobs are affected.

• Age-appropriate reach. Audience segments built from cross-site IDs will reach fewer Safari users. Contextual signals on adult-focused content, and publisher data from logged-in, age-declared users, don't depend on a third-party resolver being reachable from the device.
• Suppression. If you suppress existing customers, self-excluded people or other groups through ID matching run by a blocked vendor, that suppression may silently fail on Safari. Check how each suppression list is applied, and add publisher-side and contextual exclusions as a backstop. Robust suppression and clear safer-gambling messages are good practice whatever happens to targeting.
• Frequency. Without a stable ID, frequency caps across sites become less reliable on Apple devices. Expect more variance in how often the same person sees your ads, and set caps at the deal or publisher level where you can.
• Measurement. Conversion paths that relied on cross-site IDs will under-report Safari users. Don't read a Safari drop in your attribution as a fall in campaign quality until you have checked whether the signal itself has gone.

Contextual targeting is no longer a fallback. OpenX data reported by Digiday shows the share of US buyer spend on its platform going to third-party audience data fell from 78% in 2022 to around 40% by 2025, while targeting by surrounding content rose to up to 35%. CTV helped drive that, because buyers can target by programme, genre and rating ^[5]. For video and CTV buys, that kind of programme-level targeting is a useful way to reach adult audiences without relying on browser IDs.

Rules on who you may target, which data you may use and which audiences you must exclude differ by market. See our market regulation briefs for each jurisdiction before changing your targeting set-up.

What this means for your plan

• Audit your stack this month. List every identity, data and measurement vendor in your display and video buys. Ask each one in writing whether its domains are affected in Safari 27 and what its fallback is. The vendors named so far include The Trade Desk's UID 2.0, ID5, LiveRamp, Permutive and Audigent ^{[5, 6]}.
• Split reporting by browser and OS version. Compare WebKit 27 traffic with everything else, so you can tell signal loss apart from genuine performance changes. Adoption is still low but rising ^[5].
• Move budget towards signals that survive the block. Use contextual, publisher first-party and logged-in inventory through private marketplaces and curated deals. Publishers who sell more directly appear less exposed ^[2], and that is where publisher data has shown the strongest price lift ^[5].
• Reinforce suppression. Don't rely on one ID-based route to exclude audiences. Layer publisher-side exclusions, contextual exclusions and conservative frequency caps, and keep safer-gambling messages in every creative.
• Be careful with server-side workarounds. Apple says first-party personalisation is fine but third-party resolvers are not, even when they handle a single company's data ^[1]. Prefer set-ups where matching happens in environments you or the publisher control, and ask partners how their approach fits Apple's stated policy.
• Plan for further change. Digiday reports that Apple has shown every sign of pressing on ^[5]. Build Safari losses into Q4 and 2027 forecasts instead of waiting for a fix.

For the wider picture on running acquisition without cookies, see our earlier article, Player acquisition without third-party cookies (/insights/cookieless-targeting). A later article in this series will look at measurement in more detail, including how to judge campaign quality when deterministic signals thin out.