Columnist Paul Evans looks at Apple’s battle with ad tech, and the ramifications for the industry…

Apple now keeps a list of advertising and data companies that cannot operate in Safari, and it can add to that list whenever it chooses. 

The Trade Desk, LiveRamp, ID5, Permutive, and Audigent were among the earliest casualties of iOS 27, blocked from collecting data and from serving ads within days of the update going live. By the time ExchangeWire reported the story last week, Apple had replaced that initial list with a dynamically updated library reportedly covering hundreds of customer data platforms, ad tech vendors, data sellers, and identity graph operators.

No rulebook, no appeal

The list is unpublished. Companies are added without notice and, seemingly, with no route to challenge their inclusion. When Google proposed removing third-party cookies from Chrome, the UK’s competition regulator spent years scrutinising the plan. Yet Apple has been able to deliver this blow to the advertising industry with no comparable oversight at all.

Publishers now take the most immediate hit, losing the ability to recognise some of their most valuable readers - even where those readers have consented. To the inverse, who benefits? Apple’s own growing ad business does, where nobody audits their pool of data independently.

IAB’s trusted server needs trust

So far the industry has responded by playing 'nicely'. Vendors want published criteria and publishers want an appeals process, while others have turned to IAB Tech Lab’s Trusted Server, which moves the auction onto publisher-controlled servers out of Apple’s sightline. Each response is justified, but unfortunately each one also legitimises the premise that a device manufacturer may decide privately who operates on the Open Web. 

Trusted Server does read consent signals, but IAB Tech Lab’s own documentation leaves their legal interpretation, and what happens to the data downstream, to whoever deploys it. Without published principles that bind those deployers, and someone checking they keep to them, it risks becoming another clever workaround, hiding old habits from a browser that has learned to see them.

How Apple came to own privacy

Apple has built this position deliberately, over the best part of a decade. Safari introduced Intelligent Tracking Prevention in 2017 and in March 2020 became the first mainstream browser to block all third-party cookies by default. In January 2019 Apple bought a billboard overlooking CES in Las Vegas reading ‘What happens on your iPhone, stays on your iPhone’, then took the message national with its ‘Privacy. That’s iPhone.’ campaign. App Tracking Transparency followed with iOS 14.5 in April 2021, forcing apps to ask permission before tracking users across other companies’ apps and websites. Within a year Meta was telling investors that ATT would cost it around $10bn in 2022 revenue. 

The latest announcement and features within iOS 27 applies the same logic to the open web, except that this time nobody asks the user. Apple has framed the problem as people being tracked without being asked, amplifying those fears and presenting itself as the defender of consumer interests. 

No shared industry story to beat it

IAB, WFA, ISBA, IPA and AOP – our predominant industry bodies - represent almost every business that funds, sells or depends on open-web advertising, and each has done serious work on developing standards and guidance regarding privacy and consent. Even so, the open web still has no shared position that a consumer or politician would recognise. Nothing explains in straightforward terms why it deserves to exist and how it behaves. Instead, Apple has inevitably filled that void with its own narrative.

The rules already exist of course. GDPR and the ePrivacy framework set out how consent must be gathered and what personal data may be used for, and regulators enforce them. What the industry has never done is champion that foundation collectively and in public. Too often compliance is treated as a cost to be minimised, when it could be the clearest proof that the open web is run responsibly. A shared commitment from the trade bodies to operate visibly within the law, and to hold their members to it, would change the conversation with regulators and consumers alike. It would also expose Apple’s list for what it is: a private rulebook layered on top of a legal one that is already being enforced.

Can regulation work for us?

Any appeal to Apple’s goodwill will achieve little. The industry’s real leverage lies with competition regulators, who have already shown they will look past any pretence of privacy framing. France and Italy both fined Apple over ATT, concluding that its rules disadvantaged third parties in ways its privacy goals did not justify. In the UK, the CMA confirmed in October 2025 that Apple holds strategic market status in mobile platforms, a designation that explicitly covers browsers and browser engines. A blocklist enforced through WebKit, with no published criteria, should sit squarely within that scope – we just need them to act on our behalf now too.

That is the case vendors and our trade bodies should be making, and it only works if it is framed around consumers and competition. Complaints about lost revenue will go on deaf ears. Evidence that a dominant platform has decided which of its advertising competitors can reach iPhone users, while lawful consent goes ignored, is something a regulator can act on. Apple has spent a decade making privacy its argument. The open web’s best reply is to make fair competition its own.