Apple's WebKit team published a blog post on October 20 titled "Blocking Identity Resolution Infrastructure," and the target isn't cookies. Safari already killed third-party cookies years ago. The target is the entire layer of third-party vendors that convert an email address collected during a login or newsletter signup into a persistent cross-site identifier. If your measurement or enrichment stack relies on that handoff, the ground just shifted under it.
What Apple Is Actually Blocking (and What It Isn't)
Apple isn't claiming to eliminate all web tracking or all fingerprinting. WebKit's own documentation separates cookie-based tracking from fingerprinting and notes that anti-fingerprinting protections reduce available signals rather than guarantee zero tracking. What's new is a domain-level block on third-party identity-resolution infrastructure: the services that sit between a publisher's login form and an ID graph, turning a user's email into a cross-site, cross-device identifier.
As AdExchanger reported, this is a targeted restriction plus a broader privacy direction, not proof that Apple has ended all advertising measurement. Apple WebKit engineers John Wilander, Charlie Wolfe, and Matthew Finkel wrote: "It's not enough to block cross-site cookies to prevent cross-site tracking today because the tracking industry has not stopped trying to track users on the web."
The blocking operates at the domain level, so vendors can't just restructure network requests to slip through. Some ad tech companies quickly spun up new domains to dodge the block list, but that's a temporary fix. Apple has the infrastructure and the incentive to keep updating the list.
Why This Hits B2B Harder Than DTC
A DTC brand running a seven-day purchase cycle on a single device might barely notice. B2B SaaS with 30-to-90-day consideration cycles across multiple sessions, devices, and stakeholders? That's where the damage compounds. Every session that can't be stitched to a known identity drifts into "direct" or "unknown" in your attribution reports. The gap between what your ad platform reports and what shows up as pipeline in your CRM widens quietly.
The industry's migration to first-party-based vendor approaches doesn't get you off Apple's block list either. The WebKit team was explicit: even if an identity graph is scoped to data from a single company, the central identity resolver is still a third party holding cross-site, cross-device data and performing matching functions "in the capacity of a clearinghouse." That capability is what Apple is targeting, regardless of whether the vendor calls itself "first-party enabled."
For context, eMarketer estimates Apple's US ad sales at $8.85 billion. Apple isn't a neutral referee. It has its own advertising business and its own privacy-preserving measurement tool, Private Click Measurement (PCM), which offers aggregated, limited attribution outputs, not user-level joins.
What to Diagnose Before You React
The reflexive move is to throw budget at server-side tagging or scramble for a new CDP vendor. Pause. Server-side tagging doesn't restore information the browser withholds. It can improve data quality for first-party events you already own, but it won't re-enable cross-site identity resolution that Safari has decided to block.
Start with your own data. Segment conversion reports by browser. Compare Safari cohorts against Chrome cohorts across the same campaigns and time windows. If Safari conversions are already underreported relative to Chrome (and they almost certainly are), you now have a baseline for measuring how much worse it gets as iOS 27 rolls out. Then audit your tag and CDP stack: which vendors make calls that could be classified as third-party identity resolution? If a vendor is taking an email from your login flow and matching it against a cross-site graph they maintain, that's the exact pattern Apple described blocking.
The Measurement Shift You Can't Avoid
If PCM becomes a more central measurement path in Safari, teams should expect more aggregated outputs and fewer user-level joins. The practical implication: you need reporting that ties to pipeline without depending on user-level cross-site identity. That means holdout tests by geo or by audience segment, not by user cookie. It means comparing self-reported attribution against platform-reported attribution and looking for the delta. It means accepting that Safari 27's block on firms that turn email addresses into tracking IDs is one more reason your attribution model should be treated as directional, not definitive.
That's a better foundation than chasing domain-swap workarounds Apple will close next quarter.
Five years ago, Safari killed third-party cookies and vendors scrambled to build identity resolution as the workaround. Now Apple is killing the workaround. The teams that built their measurement on the assumption that some third party would always stitch the identity graph together are the ones holding the weakest hand. The ones who already own their first-party data, run holdouts, and treat platform numbers as one signal among several? They'll read this news and barely change a thing.
