Fewer buyers are responding and fewer identifiers are available. But CPMs haven't fallen in a way that can be clearly pinned on Apple. New data from ad revenue analytics firm Pubstack sharpens the picture of Apple's ad blocking on iOS 27. It separates what is already breaking down from what has yet to be measured.
In our previous article on Apple's restrictions, Hubvisor reported a 30% drop in SSP response rates on Safari for iOS since Oct. 1, without a comparable drop in bid CPMs. The problem showed up first in auction participation. Ad requests held steady, but fewer bidders answered.
Pubstack looks at a different part of the problem: the identifiers buyers use to recognize audiences. Its analysis covers browser-side Prebid impressions from a panel of publishers in France, Germany, the U.K., Italy and Spain, from Aug. 17 to Oct. 14.
The data lands just after Apple's WebKit team explained its approach on Oct. 19, as reported by Digiday. Apple is going after cross-site tracking built on identifiers, including those derived from an email address. The tools built to replace cookies are in its sights too.
Apple draws a line between the personalization a company offers its own customers and data matching by third parties that can recognize the same person across sites. But it doesn't say what puts a company on its blocklist, or what it takes to get off.
For publishers, the problem goes beyond losing one signal. How do you build an identity strategy when the rules for access to Safari are this vague?
The Trade Desk's ID drops by as much as 93%
The Trade Desk's identifier, which Pubstack tracks under adserver.org, showed up in 93% fewer ad requests on iOS 27 than on earlier versions. The decline was 54% for LiveRamp, 52% for ID5, 43% for EUID and 38% for Audigent.
The drops are steep, but they're easy to misread. They track how often the IDs show up, not what they earn. They don't mean monetized impressions, let alone revenue, fell by the same amounts.
The IDs also started from very different levels. Before the update, ID5 appeared on about 48% of iOS impressions in the continental markets studied, compared with 5% for The Trade Desk's identifier and 3.4% for LiveRamp. So an ID5 cut in half still reaches a far larger share of inventory than a Trade Desk ID that has almost vanished.
Results vary by market. In the U.K., ID5 and Audigent also fell off, but LiveRamp showed no comparable decline. That makes it hard to boil the issue down to a list of vendors hit the same way everywhere.
Losing an ID doesn't mean losing all targeting
Some IDs are holding up. Pubstack found SharedID, Criteo, Lotame and Teads unaffected. And in a normalized comparison of Chrome on iOS 27 against earlier versions, the share of impressions carrying at least one identifier barely moved.
That helps explain why some IDs can disappear en masse without CPMs dropping by the same amount. Several identifiers can sit on the same impression. When one goes, others are still there.
Buyers still have to be able to use them. An audience built on one identifier doesn't automatically work with a different one. The same goes for user recognition, frequency capping and measurement tools built on a specific integration.
So knowing an impression carries some ID says little about what buyers can still activate. An impression can stay identifiable for some buyers and become much less usable for others. Demand could shift between buyers before any drop in the average price shows up.
Steady CPMs aren't enough to reassure publishers
On pricing, Pubstack urges caution. Its team compared iOS CPM trends with Android's at each publisher, using fixed weighting to limit the effect of changes in traffic mix. This part of the analysis covers 40 publishers, 23 of them in France.
Across all markets, the result swings from +0.5% to -1.4% depending on whether the baseline starts Aug. 17 or Aug. 31. Just including the last weeks of summer vacation is enough to flip the sign.
France shows a more negative signal, but it also depends on the baseline. Germany, by contrast, shows a relative increase in both windows. None of it points to a decline solid and consistent enough to blame on iOS 27.
That matches what Hubvisor found: the damage doesn't necessarily show up in CPMs at first. It doesn't prove publisher revenue is safe either.
The price of monetized impressions, the number of buyers responding and the volume of impressions actually sold are three different things. An average price can hold while part of the demand disappears. And because Pubstack only looked at browser-side Prebid, its analysis doesn't cover all of a publisher's programmatic revenue.
The potential cost depends on adoption, and on fixes
To estimate what comes next, Pubstack built a model. It draws on each ID's initial coverage, how much availability it lost and the CPM gap between impressions with and without that identifier, measured on Android at the same publisher.
With iOS 27 adoption estimated at around 10% based on Chrome for iOS, the model puts the potential hit to iOS CPMs across the publishers studied at 0.4% to 0.7%. At 30% adoption, the drop would reach 1.2% to 2%. At full adoption, 4% to 7%.
It's tempting to read that last range as a forecast of lost publisher revenue. It isn't one. It applies to iOS CPMs in Pubstack's sample and rests on assumptions that could push the result either way.
First, impressions carrying an ID may be worth more for other reasons: returning visitors, available consent, different profiles. Not all of the CPM gap can be pinned on the identifier itself. Second, adding up the effects of several IDs that sit on the same impression risks double counting. Pubstack itself presents the total as an upper bound on the cost of losing them.
Pulling the other way, the model doesn't separately estimate any direct loss of demand caused by blocked ad domains. That's exactly the kind of mechanism auction participation data can expose.
One last variable: the restrictions themselves keep changing. The WebKit ticket about blocking adsrvr.org, which The Trade Desk uses for ad requests and delivery, was marked resolved on Oct. 9, after a back-and-forth over a change in an iOS 27.2 beta.
The Trade Desk's ad server has since been unblocked after being targeted by mistake, according to a source cited by Digiday. That doesn't mean its identifiers are back. Letting an ad render and recognizing the user it's meant for are two separate functions. Projecting the initial block unchanged through full adoption would be a stretch.
There's a competitive wrinkle too. Apple is building its own ad business. That doesn't prove the restrictions are designed to favor its offerings. But Apple both sets the terms for reaching Safari audiences and sells ad inventory of its own.
Walled gardens could still come out stronger, a risk raised in our first article. That remains a possible economic consequence, and this data doesn't show budgets moving. What Pubstack shows more directly is how fragile some identity tools are on the open web.
Publishers' next look at the numbers will need to set available IDs and auction responses against the revenue they actually collect. CPMs on their own may tell a far too reassuring story.
