Apple Blocked ID Vendors. That Will Make Your Digital Advertising Better. - "see Fou yourself" FouAnalytics | Dr. Augustine Fou

Editor's Note

FouAnalytics is a syndicated column by Dr. Augustine Fou—one of the leading independent voices in ad fraud detection and digital marketing measurement—applying methodological rigor to the programmatic advertising supply chain. Following Apple’s WebKit update blocking identity resolution infrastructure, this piece breaks down why third-party IDs are often tied to bots, why hyper-targeting underperforms broad reach, and how ad buyers can adapt.

Why the "identities" behind precision ad targeting are far less reliable than you've been told

For twenty years, digital advertising has been sold on a simple promise: show the right ad to the right person at the right time. An entire industry was built to identify people online. Data brokers sell audience segments like "IT decision-makers." Identity companies sell IDs that supposedly follow the same person across websites, apps and devices. Advertisers pay a premium for this precision because it sounds like the opposite of waste.

Three research studies looked at how this actually works. Their findings are easy to summarize: the identities used to target ads are often attached to bots, often wrong about the real people they describe, and often no better than picking people at random.

Apple draws a line on identity (ID, cookies, fingerprints)

In September 2026, Apple's iOS 27 update began blocking a short list of identity companies in Safari, including The Trade Desk, LiveRamp, ID5, Permutive and Audigent. Ads bought through The Trade Desk briefly stopped appearing on updated iPhones.

Apple has now explained why. In an official WebKit post, from October 19, Apple says the industry responded to the end of cookies with "identity resolution": third parties invisibly collect your email address when you log in or sign up for a newsletter, convert it into a permanent tracking ID, and use it to follow you across websites and devices. Apple's description of these companies is blunt: "They are not themselves login providers or newsletter services, they're just there to track you." Safari now blocks them at the domain level, "meaning they can't just change the structure of the network request to work around the protection".

Today's post by Apple confirms my hypothesis that they blocked ID vendors that were using workarounds to defeat Apple's privacy protections. Many advertisers will see the block as a threat to their targeting. The research suggests that what's being lost is far less valuable than it looked and that digital advertising will achieve more outcomes without it.

Study 1: IDs were given to obvious bots

Researchers from Indiana University, the New Jersey Institute of Technology, Adalytics and DeepSee.io tracked the IDs attached to ad auctions on more than 600,000 websites over three and a half years. These IDs are the industry's main replacement for cookies, sold as a way to recognize the same real person wherever they go.

The data came from an automated program that visits millions of websites monthly. It never logs in, never clicks, never buys, and openly announces that it is a bot. Think of it as a robot walking into a store wearing a sign that says "I am a robot." Of the 18 identity companies that supplied nearly all the IDs, 17 gave the robot an identity anyway. Many gave it the same ID repeatedly; one ID followed the robot across nearly 30,000 websites. The robot's phone and computer visits were often stitched together into one "person," though the only thing they shared was an internet address borrowed from a cloud provider. That isn't recognizing a person. It's a guess presented as a person.

Study 2: Half the ad auctions came from "phones" no person could own

SupplyShield, led by Johnathan Barnes, analyzed 60 billion requests to show ads on mobile phones in a single week of September 2026. It looked for behavior no real person could produce, using three tests anyone can understand:

• 500 or more ad requests from one phone in one day. The typical phone generated about 19. Reaching 500 ad requests per day means triggering an ad every three minutes for 24 hours straight, without sleeping. Nearly 8 million phone IDs did this.

• 20 or more internet addresses for one phone in one day. A real phone connects from home, work, the cellular network, maybe a coffee shop. Twenty means jumping to a new network about every 70 minutes, day and night. More than 10 million phone IDs did this.

• 5,000 or more phones behind one internet address in one day. That's the signature of a device farm, where one connection pretends to be thousands of phones. More than 63,000 addresses did this.

More than half of all ad requests, 53 percent, came from phones or addresses that failed these tests. The good news is that the problem is concentrated: about 1 percent of phone IDs produced more than half the requests. Blocking a small group of obvious fakes removes a large share of the junk.

Most advertisers' fraud reports show mobile fraud in the low single digits, because those tools only measure ads after they're bought and delivered. SupplyShield sells the remedy and studied one data source over one week, so read its numbers with that in mind. But the tests are simple and conservative.

Study 3: The "IT decision-makers" mostly weren't

Nico Neumann of Melbourne Business School and Catherine Tucker of MIT, with two HP marketing leaders, examined an HP campaign aimed at IT decision-makers using five audience segments bought from leading data vendors. Then they did something almost no one does: they asked the people reached what they actually did.

More than 8 in 10 had no role in buying technology. Half or more weren't currently employed. Segments built by vendors' algorithms did worse than showing ads to random people on the same websites. When researchers checked the vendors' prospect lists, only about 1 in 6 job titles was correct.

The simple approach won. Showing ads to people reading business content reached real IT decision-makers more than 4 times in 10, and because it cost a fraction of purchased data, it was roughly 9 to 10 times more cost-efficient. This study involved humans, not bots, and still found the identities were mostly wrong.

How fraudsters pretend to be your best customers

Bots impersonate valuable audiences in two simple ways. First, they build a fake history: because segments are guessed from browsing, a bot that visits medical journal sites becomes a "physician." Second, they copy valuable IDs from ad auctions and attach them to their own fake traffic. That's why ads meant for doctors keep turning up on crappy websites and kids' coloring apps, and even a capybara simulator. Imagine hordes of doctors pretending to be capybaras all day long, instead of working as doctors. The more you pay for an identity, the more worthwhile it is for fraudsters to fake.

The brands that did less targeting grew more

An analysis of 86 public companies over 15 years found that brands keeping a healthy share of budget in broad-reach awareness advertising consistently outgrew peers that shifted almost everything to targeted digital. Progressive, known for broad-reach TV, grew about 11.6 percent a year; digital-first Procter & Gamble grew about 0.6 percent.

Targeted ads mostly reach people who were going to buy anyway. Broad reach finds new customers. Airbnb shifted from performance marketing to brand advertising and saw traffic grow significantly faster where its brand campaign ran. P&G cut $200 million of digital spend and increased its reach by 10 percent.

What to do about it

Verifying targeting isn't realistic for most companies; there's no master list of who is behind each ID. The better approach is simpler.

Block the obvious fakes:

A phone requesting 500 ads a day, a phone on 20 internet addresses a day, or 5,000 phones sharing one address isn't a real person. Ask your agency or ad platform, in writing, whether they block traffic like this before buying. If not, require it. Update the lists at least weekly, and cap how often any one device sees your ad. Expect available inventory to shrink; what disappears was never going to buy.

Here's how DSPs and SSPs using FouAnalytics scrub out the bot-driven IDs. In the beeswax example below, note the second row with 25 impressions, and 100% dark red. When this userID shows up in the bid request, the algos avoid bidding on it. Similarly the second ID on the TTD (Trade Desk) data grid shows 7 impressions and all dark red (bots in FouAnalytics measurement). This and the other IDs that are 100% dark red can be avoided. Conversely, see the IDs that are dark blue. The bidding logic can continue to bid on those since we have evidence those IDs were humans.

Simplify targeting:

Place ads next to relevant content on sites you've chosen, and put real budget back into broad reach. Every extra layer of audience data adds cost, shrinks your reach and increases reliance on unreliable IDs.

Stop paying for one-to-one precision:

Treat "people-based" and "verified audience" claims as sales claims. Ask vendors what you'd be paying for if their targeting were no better than random; in the HP study, it wasn't. Judge results by your own sales, not click rates. Bots click too. Try pausing targeted spending in a few regions and see whether sales change.

Don't fear losing the IDs:

As Apple blocks identity companies, you'll hear warnings about lost audiences. But these IDs were handed to self-declared robots, stitched together on flimsy guesses, and performed no better than random. Losing them means losing the appearance of precision, along with its fees, fake traffic and false confidence.

The bottom line

The industry has sold increasingly elaborate ways to identify people online. Apple now says much of it exists "just to track you," and three studies show that much of it is guessed, attached to bots, or produced by fake devices at enormous scale. Block what's obviously fake, buy more simply, and stop paying extra for precision that isn't there.

Do less targeting, and you'll likely make more money.

If the above still didn't convince you, check this post from Alan Wegrzyn.

And listen to Eric Tilbury:

"Everyone got locked into the mindset that user IDs were the north star and scale was basically unlimited. That part was never true.

User ID strategies aren't the devil. Going about them without being careful and knowing how the system actually works is. They're the easiest thing to understand and the easiest thing to measure, which is exactly why the entire ecosystem has gotten so good at gaming them. Both on the targeting side and the measurement side.

Meanwhile the strongest signal sitting in front of every impression is the content itself. Most setups don't even look at it. They just try to match an ID and hope the rest works out.

That's the gap. IDs can still have a place when you treat them carefully. But treating them like the only thing that matters is how you end up optimizing for the wrong outcomes and paying for it."

Why Subscribe

Because the "precision targeting" and user IDs you pay extra for might actually be attached to self-declared bots and fake mobile devices. Every week, FouAnalytics uses forensic campaign data to expose flawed ad-tech metrics, identity resolution loopholes, and programmatic waste, giving media buyers and brand marketers the independent proof needed to make smarter investments.

Subscribe below to read more from FouAnalytics weekly here on State of Streaming.

Sources

Apple WebKit (October 19, 2026). "Blocking Identity Resolution Infrastructure." https://webkit.org/blog/18438/blocking-identity-resolution-infrastructure/

AdExchanger (September 29, 2026). "Apple's Latest Operating System Blocks The Trade Desk From Serving Ads On Safari." https://www.adexchanger.com/platforms/apples-latest-operating-system-blocks-the-trade-desk-from-serving-ads-on-safari/

Smith, M., et al. (2026). "Bridging the Gap: A Longitudinal Analysis of Extended Identifiers in the Post-Cookie Era." https://arxiv.org/abs/2609.02069

SupplyShield Research (October 2026). "More Than Half of Mobile Ad Bid Requests Exhibit Non-Human Behavior."

Neumann, N., Tucker, C. E., Subramanyam, K., and Marshall, J. (2022). "What Type of Digital Advertising is Most Effective for B2B Prospecting? The Case of IT Decision-Makers." https://ssrn.com/abstract=4083057

Fou, A. (2026). "How Brands DIDN'T Grow: The Need for Digital Rebalancing." https://www.linkedin.com/pulse/how-brands-didnt-grow-need-digital-rebalancing-dr-augustine-fou-s4xxe/

Fou, A. (2026). "Bots impersonating your target audience. How? Bid Licking." https://www.linkedin.com/pulse/need-constantly-clean-userids-audience-graphs-dr-augustine-fou-oaeee/

Marketing Week (2022). "Airbnb CFO: We were right to shift spend from performance to brand-building." https://www.marketingweek.com/airbnb-cfo-performance-brand/

Reuters (2018). "P&G says cut digital ad spend by $200 million in 2017." https://www.reuters.com/article/business/pg-says-cut-digital-ad-spend-by-200-million-in-2017-idUSKCN1GD653/