Apple's iOS 27 Privacy Changes: What They Mean for Meta Ads (and Why Google Gets Off Lighter)

Every few months a headline says Apple is "killing" ad tracking, and advertisers brace for another iOS 14.5. This autumn the headlines are about Safari: Apple quietly started blocking a group of ad-tech and data companies when iOS 27 rolled out on 14 September, and it took five weeks to explain why.

This post covers every Apple privacy change that matters to advertisers in 2026, what each one does, and which ad platform it hurts. It's written for UK businesses running Meta and Google ads. Where Apple has said something in its own words, we link to it. Where a detail comes from someone reading Apple's source code or a bug ticket, we say so, because a lot of what's circulating hasn't been confirmed.

Apple's privacy changes in 2026, at a glance

Apple announced almost none of this. The iOS 27 and Safari 27 release notes didn't mention the tracking changes. The Safari block was found by ad-tech engineers when their ads stopped serving, and Apple's WebKit team explained it on 19 October. The EU prompt change came through a developer notice. So the timeline below mixes Apple's own statements with reporting, and the table after it says which is which.

Change 1: Safari 27 blocks "identity resolution" companies

What identity resolution is

When you type your email address into a website to log in or sign up for a newsletter, a third-party script on that page can quietly send the address to its own servers. The company behind the script turns it into a tracking ID that stays linked to your email address. Because you use the same email address everywhere, that ID can recognise you on other sites and other devices, and it can be sold as an audience or attached to bid requests.

That's identity resolution, and it's what much of the ad-tech industry built to replace the third-party cookie. Apple's WebKit team, in a post signed by John Wilander, Charlie Wolfe and Matthew Finkel, describes it as the post-cookie way of tracking people across sites. It points out that logging out or unsubscribing doesn't remove the ID, and that the companies doing it are present but invisible on the page: they aren't the login provider or the newsletter service you think you're dealing with.

What Safari now blocks

From iOS, iPadOS, macOS and visionOS 27, Safari blocks network access to these services. The block works on the whole domain, so every subdomain is caught and a vendor can't get round it by changing how its requests are built. Apple's post names no companies and publishes no list.

The names come from elsewhere. When The Trade Desk's ads stopped serving in Safari, its engineering lead Ian Meyers filed WebKit bug 324771 on 21 September and reproduced nine entries from the list: eight real domains plus one test entry. They belong to:

• Unified ID 2.0 (uidapi.com), the email-based ID The Trade Desk built
• The Trade Desk's own ad server (adsrvr.org)
• ID5 (two domains)
• LiveRamp (two domains)
• Permutive
• Audigent, now part of Experian

The bug report's screenshot shows the requests being blocked in normal browsing, not just Private Browsing. Apple hasn't said whether any setting turns the block off.

What isn't blocked

• Meta and Google. No Meta or Google domain is on any reported version of the list. In the Yahoo page Meyers used as his example, AdExchanger reports that Google's ad requests went through while The Trade Desk's were blocked.
• Other identity providers, so far. Digiday saw results of a test of more than 70 ad-tech domains. Only the original handful were blocked. Zeta's LiveIntent, Lotame and Yahoo's ConnectID were not.
• First-party data. The WebKit post is explicit: "First party personalization is not tracking." A site recognising its own logged-in customers isn't the target.

The back-and-forth since

Blocking The Trade Desk's ad server stopped it serving ads at all in Safari, not just stopped it identifying people. On 5 October WebKit's John Wilander asked The Trade Desk to test an iOS 27.2 beta, which appears to remove adsrvr.org from the list while keeping UID2 blocked. Apple hasn't said whether the ad server block was a mistake. People on the current version won't get the change until iOS 27.2 ships.

On 2 October AdExchanger reported, citing two unnamed sources, that Apple plans to replace the short list with hundreds of data, ad-tech and martech companies. Apple hasn't confirmed it, and the 70-domain test above found no sign of it yet. Digiday reports that Apple has added code that would let it expand the list without a software update, but that this code hasn't shipped. IAB Tech Lab's Rowena Lam says the block is also live on macOS 27, and the industry's main complaint is that there's no notice, no published criteria and no appeal.

Change 2: Safari's quieter tracking rules got tighter again

The identity block got the headlines. The changes that touch Meta and Google advertisers more directly are older, quieter and still moving.

Link Tracking Protection: click IDs stripped from some links

Since iOS 17 in 2023, Safari has removed tracking data from links shared in Messages and Mail, and from links opened in Private Browsing. Apple's announcement didn't publish the list of parameters, but third-party testing consistently shows it includes Meta's fbclid and Google's gclid. It doesn't run in normal browsing unless the user switches on Advanced Tracking and Fingerprinting Protection for all browsing in Safari's settings.

Safari 27 extends the list. A source-code review by analytics engineer Mariusz Brucki found X's click ID (twclid, plus cn and cxt), Threads' xmt and YouTube's si being added. Apple's release notes don't mention it, and we've seen no evidence that iOS 27 turns link stripping on in normal browsing.

What it means:

• For Meta: when fbclid is stripped, the pixel can't set its click cookie, so Meta loses its cleanest way of tying a purchase to an ad click. It falls back to weaker signals and modelling.
• For Google: gclid goes too, but Google built a fallback for iOS in 2021. Its wbraid and gbraid parameters work with conversion modelling to attribute clicks Apple's rules affect.

Fingerprinting protection, and the LinkedIn and Bing precedent

Since iOS 26 in September 2025, Safari has applied its advanced fingerprinting protection to all browsing, not just Private Browsing. Apple said so in its June 2025 announcement. Scripts Apple classes as fingerprinters lose access to the device details, and in some cases the URL and referrer data, they'd use to recognise someone.

The same code review of the Safari 27 beta found two things that should make every ad platform pay attention, as PPC Land reported in July:

• LinkedIn's Insight Tag, Tealium and Segment were added to the fingerprinting list, so they lose access to URL parameters and referrer data.
• Microsoft's Bing ads tag was blocked by the IP address it connects to, at the network level. That means proxying it through your own subdomain doesn't help, because the destination address is the same.

Both findings come from reading the beta's code, not from Apple, and we couldn't confirm whether the Bing block shipped in the final release or whether it applies outside Private Browsing. What matters is the target. These are the conversion tags of two big self-serve ad platforms, not small ad-tech middlemen. Meta's pixel and Google's tag haven't been reported on either list.

The seven-day cookie cap you're already living with

Since 2019, Safari has capped cookies set by JavaScript at seven days. The Meta pixel's _fbp and _fbc cookies are set that way, and so are Google's tag cookies. If someone clicks your ad and comes back to buy eight days later in Safari, the cookie that connected them to the click has gone. Cookies set by your own web server in an HTTP response aren't capped the same way, which is why server-side capture keeps coming up below.

Change 3: A softer tracking prompt in the EU (not the UK)

What's changing

Germany's competition regulator, the Bundeskartellamt, opened a case in 2022 over concerns that Apple held other companies' apps to stricter consent prompts than its own. It accepted binding commitments from Apple and closed the case on 17 August 2026. On 16 September Apple published the result for developers. From iOS 27.2 and iPadOS 27.2, apps in the EU can use an alternative version of the App Tracking Transparency prompt. According to 9to5Mac's summary and Apple's notice, it:

• runs full-page instead of as a pop-up, with a blue graphic instead of an orange one
• drops the word "track"
• replaces "Ask App Not to Track" with Reject, next to Allow
• can carry formatting and an optional "Additional Information" button
• lets apps ask again a year after the user's last answer, whether it was yes or no, unless the user has turned off the setting that lets apps ask at all

The alternative is the only version in Germany, France, Italy, Poland and Romania, and optional in the other 22 EU countries. The original prompt stays everywhere else, including the UK. iOS 27.2 has been in beta since 16 September with no public release date. Apple has four months from formal service of the German decision to make the changes, which PPC Land calculates can't fall before 13 December 2026.

What it means

This is the one change this year that probably helps Meta. Neutral wording and a second ask every year at people who said no should, if anything, lift opt-in rates for Facebook, Instagram and every app that feeds Meta's ad network. Nobody has published a forecast, and the Bundeskartellamt said raising consent levels wasn't its aim. For context, Adjust put the industry average opt-in rate at 35% of users who saw the prompt in Q2 2025.

For a UK-only advertiser, nothing changes. If you sell into the EU, it's worth knowing the date iOS 27.2 lands so you can read any shift in Meta's EU match rates and results against it.

And in the UK?

No change is announced. The pressure is building, though. On 3 September 2026 a proposed £2 billion opt-out collective claim was filed at the Competition Appeal Tribunal on behalf of UK app developers. It alleges ATT imposed stricter rules on third-party developers than on Apple's own advertising. It's at an early stage, certification hasn't been decided, and Apple denies wrongdoing. Separately, the CMA designated Apple's mobile platform with strategic market status in October 2025, but it hasn't imposed any requirement on ATT so far.

The Apple privacy features already working against your ads

The 2026 changes sit on top of nearly a decade of earlier ones. If you're trying to understand why your iPhone numbers look the way they do, this is the full stack.

Which ad platform is most affected by Apple's privacy changes? Meta

Neither Meta nor Google was named or blocked in iOS 27. So the fair answer to "which is most affected" isn't about October. It's about what Apple's privacy work is aimed at, and which business model sits in its path. On that, Meta is more exposed than Google, and it isn't close.

Meta sells audiences. Google Search sells intent

Meta's ads work by learning who buys. The pixel, the Conversions API and app events tell Meta what people did on your site or in your app, Meta joins that back to their Facebook and Instagram profiles, and the algorithm finds more people like them. Almost every Apple protection on the list below is aimed at that join: ATT in apps, cookie caps and link stripping on the web, and now domain blocking.

Google Search starts with a query someone typed into Google. That signal is Google's own, on Google's own site, and Apple's rules don't touch it. Google needs Apple's cooperation to measure the conversion afterwards, but not to find the customer in the first place. Google is also Safari's default search engine.

The track record says the same

In February 2022, Meta's then finance chief Dave Wehner told investors Apple's iOS changes would cost it about $10 billion in revenue that year. A few months earlier, Alphabet's Ruth Porat had described the effect on YouTube as modest. Meta has rebuilt a lot since then with the Conversions API and modelling. The structural difference hasn't gone away.

Where Meta is exposed in 2026

• The cross-browser gap. Most Meta ad clicks on an iPhone open inside Facebook's or Instagram's own browser, which keeps its own cookies. When that person comes back days later in Safari to buy, Safari has no record of the click. Meta has to match the purchase some other way, usually the customer's email or phone number.
• Click IDs and cookies. fbclid is stripped in Mail, Messages and Private Browsing, and the pixel's cookies last seven days at most in Safari.
• Email matching. The email address is now Meta's most important bridge, and Hide My Email gives some iPhone users a throwaway address that won't match their Meta account.
• The direction of travel. WebKit's description of what it blocks is a third party collecting the email address someone types on another company's site and turning it into a persistent ID. Browser-side automatic advanced matching in the Meta pixel reads form fields, hashes the email and sends it to Meta. Apple hasn't said a word about Meta, and its tracking prevention policy says it doesn't intend to break ad measurement. But if Apple ever decides browser-side matching counts as identity resolution, pixel-only advertisers would lose the most. Google's tag-based enhanced conversions works in a similar way, so this risk isn't Meta's alone. It's another reason to send customer data from your server.

Where Google is exposed

Google isn't immune. gclid is stripped where fbclid is, its tag cookies get the same seven-day cap, and enhanced conversions lose matches to Hide My Email and Private Relay too. Google's audience-led channels, YouTube, Display and Demand Gen, look more like Meta than like Search, and that's where you'd expect most of Google's iPhone measurement loss to land. The difference is that Google built for this early: wbraid and gbraid for iOS in 2021, plus enhanced conversions and modelled conversions.

What Meta advertisers should do before Black Friday

None of this needs an emergency. All of it should be live before your Black Friday campaigns start, because peak season is when lost purchases cost you most and when you're least likely to want to change your tracking.

Two of these link to deeper guides. If Meta purchases show up as "Unassigned" in GA4, start with why Meta traffic shows as Unassigned. For the blended view, see what MER is and why it matters. Our Black Friday checklist puts the tracking checks in the right week.

A word on what not to do. The point of server-side tracking is to stop losing data you're entitled to, from your own customers, with consent. It isn't a way to rebuild cross-site tracking that a browser has decided to block. Apple's tracking prevention policy reserves the right to act against workarounds, and UK GDPR and PECR still apply to every event you send.

What Google Ads advertisers should do

Google's exposure is smaller, but the checks are quick:

Our guide to Consent Mode v2 covers the setup, and our monthly Google Ads updates log tracks anything new on the Google side.

What Apple hasn't changed, despite the headlines

• Apple hasn't blocked the Meta pixel or Google's tag. Neither appears on any reported list.
• Link stripping still isn't on in normal browsing by default. It covers Mail, Messages and Private Browsing, plus anyone who has switched on the stricter setting for all browsing.
• The tracking prompt in the UK is the same. The redesign is EU-only.
• Apple hasn't confirmed a list of hundreds of companies. That report rests on anonymous sources, and testing so far hasn't found it.
• There's no new Apple measurement tool for web advertisers. WebKit's post offers nothing to replace what it blocks.

How we put this together

We started from Apple's own words: the WebKit blog, Apple's newsroom announcements for iOS 15, 17 and 26, and Apple's developer notice on the EU prompt as reproduced in trade coverage. We then followed the WebKit bug tracker as reported by PPC Land, and the reporting from AdExchanger, Digiday, 9to5Mac and TechCrunch. UK market share figures are StatCounter's for September 2026.

How we label things:

• Where Apple has confirmed something, we link to Apple or WebKit.
• Where a detail comes from reading WebKit's source code or a bug ticket, we say "reported" or "code review". The Bing and LinkedIn findings, the new click IDs on the stripping list and the iOS 27.2 change to The Trade Desk's ad server all fall into that group.
• The impact grid is our assessment, not a measurement. Apple didn't respond to Digiday's requests for comment, and hasn't published the list, its criteria or an appeal route.

We'll update this page when iOS 27.2 ships. For what changed inside Meta itself this month, including product browsing switching on by default on 28 October, see our Meta ads updates.

Frequently asked questions