Editor's Note
FouAnalytics is a syndicated column by Dr. Augustine Fou—one of the leading independent voices in ad fraud detection and digital marketing measurement—applying methodological rigor to the programmatic advertising supply chain. Following Apple’s WebKit update blocking identity resolution infrastructure, this piece breaks down why third-party IDs are often tied to bots, why hyper-targeting underperforms broad reach, and how ad buyers can adapt.
For twenty years, digital advertising has been sold on a simple promise: show the right ad to the right person at the right time. An entire industry was built to identify people online. Data brokers sell audience segments like "IT decision-makers." Identity companies sell IDs that supposedly follow the same person across websites, apps and devices. Advertisers pay a premium for this precision because it sounds like the opposite of waste.
Three research studies looked at how this actually works. Their findings are easy to summarize: the identities used to target ads are often attached to bots, often wrong about the real people they describe, and often no better than picking people at random.
In September 2026, Apple's iOS 27 update began blocking a short list of identity companies in Safari, including The Trade Desk, LiveRamp, ID5, Permutive and Audigent. Ads bought through The Trade Desk briefly stopped appearing on updated iPhones.
Apple has now explained why. In an official WebKit post, from October 19, Apple says the industry responded to the end of cookies with "identity resolution": third parties invisibly collect your email address when you log in or sign up for a newsletter, convert it into a permanent tracking ID, and use it to follow you across websites and devices. Apple's description of these companies is blunt: "They are not themselves login providers or newsletter services, they're just there to track you." Safari now blocks them at the domain level, "meaning they can't just change the structure of the network request to work around the protection".
Today's post by Apple confirms my hypothesis that they blocked ID vendors that were using workarounds to defeat Apple's privacy protections. Many advertisers will see the block as a threat to their targeting. The research suggests that what's being lost is far less valuable than it looked and that digital advertising will achieve more outcomes without it.
Researchers from Indiana University, the New Jersey Institute of Technology, Adalytics and DeepSee.io tracked the IDs attached to ad auctions on more than 600,000 websites over three and a half years. These IDs are the industry's main replacement for cookies, sold as a way to recognize the same real person wherever they go.
The data came from an automated program that visits millions of websites monthly. It never logs in, never clicks, never buys, and openly announces that it is a bot. Think of it as a robot walking into a store wearing a sign that says "I am a robot." Of the 18 identity companies that supplied nearly all the IDs, 17 gave the robot an identity anyway. Many gave it the same ID repeatedly; one ID followed the robot across nearly 30,000 websites. The robot's phone and computer visits were often stitched together into one "person," though the only thing they shared was an internet address borrowed from a cloud provider. That isn't recognizing a person. It's a guess presented as a person.
SupplyShield, led by Johnathan Barnes, analyzed 60 billion requests to show ads on mobile phones in a single week of September 2026. It looked for behavior no real person could produce, using three tests anyone can understand:
500 or more ad requests from one phone in one day. The typical phone generated about 19. Reaching 500 ad requests per day means triggering an ad every three minutes for 24 hours straight, without sleeping. Nearly 8 million phone IDs did this.
20 or more internet addresses for one phone in one day. A real phone connects from home, work, the cellular network, maybe a coffee shop. Twenty means jumping to a new network about every 70 minutes, day and night. More than 10 million phone IDs did this.
5,000 or more phones behind one internet address in one day. That's the signature of a device farm, where one connection pretends to be thousands of phones. More than 63,000 addresses did this.
More than half of all ad requests, 53 percent, came from phones or addresses that failed these tests. The good news is that the problem is concentrated: about 1 percent of phone IDs produced more than half the requests. Blocking a small group of obvious fakes removes a large share of the junk.
Most advertisers' fraud reports show mobile fraud in the low single digits, because those tools only measure ads after they're bought and delivered. SupplyShield sells the remedy and studied one data source over one week, so read its numbers with that in mind. But the tests are simple and conservative.
Nico Neumann of Melbourne Business School and Catherine Tucker of MIT, with two HP marketing leaders, examined an HP campaign aimed at IT decision-makers using five audience segments bought from leading data vendors. Then they did something almost no one does: they asked the people reached what they actually did.
More than 8 in 10 had no role in buying technology. Half or more weren't currently employed. Segments built by vendors' algorithms did worse than showing ads to random people on the same websites. When researchers checked the vendors' prospect lists, only about 1 in 6 job titles was correct.
The simple approach won. Showing ads to people reading business content reached real IT decision-makers more than 4 times in 10, and because it cost a fraction of purchased data, it was roughly 9 to 10 times more cost-efficient. This study involved humans, not bots, and still found the identities were mostly wrong.
Because the "precision targeting" and user IDs you pay extra for might actually be attached to self-declared bots and fake mobile devices. Every week, FouAnalytics uses forensic campaign data to expose flawed ad-tech metrics, identity resolution loopholes, and programmatic waste, giving media buyers and brand marketers the independent proof needed to make smarter investments.