Apple just became the biggest threat to the open web’s identity stack. On September 14, 2026, iOS 27 shipped with a Safari change that stops requests to domains powering several universal IDs—UID2, ID5 and LiveRamp’s RampID among them.
What universal IDs actually do
A universal ID is a single pseudonymous identifier that every company in an ad transaction can read. Instead of each SSP and DSP holding its own cookie and stitching them through cookie syncing, publisher, SSP and DSP see the same value.
Most start with a hashed, normalized email. UID2’s documentation walks through lowercasing, stripping plus addressing for Gmail, hashing with SHA-256 and then salting with a rotating secret before the raw value is encrypted into a token that refreshes hourly. In OpenRTB 2.6 those tokens travel in the eids array, marked as authenticated, observed or inferred. Probabilistic IDs like ID5 also use IP address, user agent and browsing patterns to extend reach beyond logged-in users.
For marketers, a universal ID is a reach extender: upload a hashed customer file once and find those people across every publisher passing that ID. Deterministic IDs like UID2 and RampID also tie measurement to people rather than browsers.
Google blinked. Apple didn’t.
Chrome spent six years promising to kill third-party cookies—first by 2022, then early 2025, then via a user-choice prompt in July 2024. Google dropped the prompt in April 2025 and retired most Privacy Sandbox APIs in October 2025. The Trade Desk’s chief executive, Jeff Green, called the pattern a “bait and switch.” That left cookies in place but removed the urgency that launched UID2, RampID and SharedID.
Safari, apps and connected TV never had third-party cookies to lose. That’s where universal IDs found real adoption. Now Apple is blocking the exact domains those IDs rely on. ID5 CEO Mathieu Roche called the move “an attack against the business model of the web.” On October 5, Apple’s John Wilander asked The Trade Desk to test an iOS 27.2 beta without explaining what it changes.
Your move
- Run multiple universal IDs rather than betting on one, so a Safari or platform block hits only part of your reach.
- Audit match rates by browser—especially Safari—because no independent audit of match quality has been published for the main IDs.
- Treat hashed emails as personal data. The FTC said in July 2024 that hashing does not make data anonymous.
- Watch the iOS 27.2 beta and Apple’s unpublished domain list before locking programmatic budgets.
Ownership is also concentrating: Publicis agreed to buy Lotame in March 2025 and LiveRamp in May 2026. And UID2’s neutrality remains contested—The Trade Desk built it, administers it and bids with it. If your identity stack over-relies on one vendor, this Safari block is your warning shot.
Source: PPC Land
