Two days after Apple's WebKit team said Safari now refuses to connect to companies that turn email addresses into tracking IDs, the question publishers have been asking since iOS 27 shipped is getting louder: is Apple shutting the open web's advertising plumbing while building an ad business of its own? PPC Land set eight WebKit blog posts, dated June 5, 2017 to October 19, 2026, beside the dated record of Apple Ads, formerly Apple Search Ads. The two timelines run in parallel. Safari went from purging cookies of domains its on-device classifier flagged to blocking named domains at the network layer, while Apple's ad unit went from a single App Store slot in 2016 to Maps, more search positions and, since July 28, 2026, terms that cover "web applications" and "other platforms." What the record does not contain is any figure tying one to the other.

In Short

Since 2017, Apple has kept adding rules to Safari that stop outside companies from following people from website to website, and on October 19, 2026 it said Safari now blocks firms that turn email addresses into tracking codes. Over the same years Apple's own ad business, which sells ads inside the App Store and now Apple Maps, has grown, and eMarketer forecasts its US ad revenue at $8.85 billion for 2026, although Apple publishes no ad figure of its own. The timing lines up, but no public data shows money moving from blocked web trackers to Apple Ads, and Apple's ads today run in Apple's own apps rather than on the websites Safari's rules affect.

Why the question is being asked now

The October 19 post, "Blocking Identity Resolution Infrastructure," was covered by PPC Land on the day it appeared. That article dealt with what the block does and what it leaves out. This one looks at a different question, one raised in public by publisher executives and identity vendors over the past three weeks, and put to PPC Land directly: whether Apple's tracking restrictions on the web and the growth of Apple's own ad business are two sides of one strategy.

The suspicion has a recent history. Raptive's chief strategy officer Paul Bannister linked the Safari block to Apple's App Store fees on October 8, calling the privacy rationale "a long con," and ID5's Mathieu Roche said regulators should look. Neither offered documents showing intent. Apple, for its part, has never mentioned its ad business in any of the eight WebKit posts reviewed here.

The way to test the idea is to lay the dates side by side. That is what follows.

What WebKit built, post by post

2017: a classifier, not a list

The first post, "Intelligent Tracking Prevention," was published on June 5, 2017 under John Wilander's name. It opens with a principle that recurs in every later post: "The success of the web as a platform relies on user trust."

The mechanism was statistical. According to WebKit, Intelligent Tracking Prevention (ITP) collected statistics on resource loads and user interactions, bucketed "per top privately-controlled domain or TLD+1." A machine learning model then decided which domains "have the ability to track the user cross-site." Three features carried the signal: subresource under number of unique domains, sub frame under number of unique domains, and number of unique domains redirected to. "All data collection and classification happens on-device," the post said.

Classified domains that had not received user interaction in 30 days had their cookies and website data "immediately purged." Domains used as a first party within the previous 24 hours kept cookie access in third-party contexts; those used within 30 days kept partitioned cookies. The post said WebKit had found "popular websites with over 70 such trackers, all silently collecting data on users."

Two pieces of guidance from that post matter for what came later. On web analytics, WebKit suggested that "a popular way to do cross-site analytics for a family of sites is to use link decoration, i.e. pad links with information that needs to be carried across origins and navigations." On ad attribution: "We recommend server-side storage for attribution of ad impressions on your website. Link decoration can be used to pass on attribution information in navigations."

Ad platforms adapted quickly. By August 2018, Google and Microsoft had found ways around ITP using first-party cookies and click identifiers carried in URLs.

2018: the 24-hour window closes

ITP 2.0, announced on June 4, 2018, removed the 24-hour window. Domains classified as having tracking abilities had their cookies partitioned immediately, and embedded content needing its own cookies had to call the Storage Access API, which "requires that the user interacts with the embedded content." The post explained why the window went: it "allowed social media and search engines that the user interacted with as first parties to track the user across websites while inside that 24 hour window."

ITP 2.0 also added detection of "first party bounce trackers," a "collusion graph" to classify domains that redirect to one another, and a downgrade of the referrer header to the page's origin for classified domains.

The FAQ in that post is worth reading against 2026. "ITP does not rely on a centralized blacklist of known trackers," it said. "Instead, it captures per-domain (eTLD+1) statistics on-device and classifies each domain's ability to track cross-site." Asked whether users could whitelist a domain, the answer was: "No, there is no such whitelisting feature."

By September 23, 2019, the advice to use link decoration had turned into a problem WebKit was fighting. The ITP 2.3 post said ITP 2.2 had already capped client-side cookies created on a landing page at 24 hours when the user arrived from a classified domain with a query string or fragment in the URL. "Unfortunately, we see continued abuse of link decoration," the post said.

ITP 2.3 extended the cap to all script-writeable storage. If a user was navigated from a classified domain to a URL such as website.example?clickID=0123456789, all of that site's non-cookie website data would be deleted after seven days of Safari use without interaction. The reason given was blunt: "Site owners have been convinced to deploy third-party scripts on their websites for years. Now those scripts are being repurposed to circumvent browsers' protections against third-party tracking." The same release downgraded document.referrer to the referrer's eTLD+1 when it carried link decoration from a classified domain.

On March 24, 2020, Safari 13.1 and iOS and iPadOS 13.4 began blocking all third-party cookies by default. "Cookies for cross-site resources are now blocked by default across the board," the post said, adding that this "removes any sense of exceptions or 'a little bit of cross-site tracking is allowed.'" WebKit described Safari as "the first mainstream browser to fully block third-party cookies by default," credited the Tor Browser and Brave, and noted: "We know Chrome wants this behavior too and they announced that they'll be shipping it by 2022." The post also thanked Google for a report that started an analysis of ITP's internal state as a tracking vector.

The same post extended the seven-day cap to IndexedDB, LocalStorage, media keys, SessionStorage and service worker registrations. It described first-party storage on many sites as "littered with data keyed as various forms of 'tracker brand user ID.'"

Eight months later, on November 12, 2020, Safari 14 capped cookies set in "third-party CNAME-cloaked HTTP responses" at seven days. WebKit cited a paper from researchers at Sokendai and France's ANSSI that "found 1,762 websites CNAME cloaking 56 trackers in total," and a report that 250 websites of banks, healthcare companies, restaurant chains and civil rights groups had been compromised through mismanaged CNAME records. The post also introduced a "SameSite=Strict jail" for bounce trackers, with a threshold of 10 unique navigational redirects, and noted: "Our current list of domains we subject to this protection is empty because the domain reported to us has stopped their bounce tracking."

2023: lists arrive in Private Browsing

The June 6, 2023 post from WWDC23 announced 88 web features for Safari 17. Its Private Browsing section listed, among other items, "blocking for known trackers and fingerprinting," "blocking for known tracking query parameters in links," mitigation of "trackers that map subdomains to third-party IP addresses," and "noise to fingerprintable web APIs." The same list included "Private Click Measurement for direct response advertising, similar to how it works for in-app direct response advertising."

2024: Private Browsing 2.0 and a word on ads

The July 16, 2024 post, "Private Browsing 2.0," explained how those lists work. PPC Land covered it the next day. The post is the most explicit of the eight on Apple's stance: "Apple believes that users should not be tracked across the web without their knowledge or their consent."

The tracker blocker is "compiled using data from DuckDuckGo and from the EasyPrivacy filtering rules from EasyList." Only domains flagged by both sources are blocked. One sentence in that passage bears directly on the question of whether Apple is removing other companies' ads: "In doing so, Safari intentionally allows most ads to continue loading even in Private Browsing."

Link Tracking Protection strips "a subset of query parameters that have been identified as being used for pervasive cross-site tracking granular to users or clicks," before navigation. Parameters "only used for campaign attribution" pass through. On the destination page, third-party scripts reading location.search, location.href or document.URL get the URL without any query string or fragment.

Fingerprinting defenses inject noise into 2D canvas, WebGL and Web Audio readbacks, a direct answer to canvas fingerprinting, and fix screen and window metrics. The Web Audio noise switched from a uniform distribution at 0.1% to normally distributed noise in Safari 17.5. In all browsing modes, ITP now applied the seven-day cookie cap to responses from "cloaked third-party IP addresses," treating two addresses as different parties if one is IPv4 and the other IPv6, or if they share a common prefix of fewer than 16 bits in IPv4 or 64 bits in IPv6. PPC Land examined that heuristic on October 16.

The post also attacked Google's Topics API, then shipping in Chrome. It cited a paper by Yohan Beugin and Patrick McDaniel of the University of Wisconsin-Madison, published at the 2024 IEEE Security and Privacy Workshops, which concluded that "the real users from our dataset can be fingerprinted through the Topics API." Apple's own position: "We think the web should not expose such information across websites and we don't think the browser, i.e. the user agent, should facilitate any such data collection or use." PPC Land reported the clash with Google on July 17, 2024.

As its measurement answer, WebKit offered Web AdAttributionKit, "formerly Private Click Measurement," as "a replacement for tracking parameters in URL." In Private Browsing, attribution is scoped to the tab and discarded when the tab closes.

2026: a domain-level block on a business category

The October 19, 2026 post completes the arc. "We fully blocked cross-site cookies six years ago," it says. "However, the tracking industry has not sat idle since." In iOS, iPadOS, macOS and visionOS 27, "Safari and WebKit block network access to identity resolution infrastructure," at "the domain level, meaning they can't just change the structure of the network request to work around the protection." The post defines the targets as companies that "are not themselves login providers or newsletter services, they're just there to track you."

What the arc shows

Read in sequence, the eight posts trace two shifts. The first is from algorithm to list. In 2018 WebKit said ITP did not rely on "a centralized blacklist of known trackers." By 2023 Private Browsing blocked known trackers from third-party lists, and by 2026 Safari blocks a category of companies by domain in all browsing on Apple's 27 releases.

The second shift is in what counts as acceptable workaround. In 2017 WebKit recommended link decoration and server-side storage for ad attribution. Link decoration was capped in 2019 and stripped of known click identifiers in Private Browsing in 2023. Server-side cookies set through cloaked subdomains were capped in 2020 by CNAME and in 2023 by IP address. Each post frames the new rule as a response to industry circumvention of the previous one. Whether that framing is accurate in each case cannot be tested from the posts, which name almost no companies.

What Apple Ads built over the same period

Apple Search Ads launched in 2016, the year before ITP, with what Apple later described to developers as "a single ad placement at the top of search results." For five years it stayed close to that format. The expansion that followed came after App Tracking Transparency, the iOS 14.5 rule that from April 26, 2021 required apps to ask permission before tracking users across other companies' apps and websites.

According to PPC Land's reporting on the April 2025 rebrand, Search tab campaigns arrived in May 2021, ads reached the Today tab and the "You Might Also Like" section of other apps' product pages in late 2022, and Today tab ads became larger in December 2023. Apple Search Ads expanded to 21 more countries on October 3, 2024.

The pace picked up in 2025 and 2026:

The July terms are where the two timelines could meet

Every Apple Ads surface launched so far sits inside an Apple app: the App Store, Maps, and, under Apple's separate "Personalized Ads" setting, News and Stocks. None is a third-party website. That is the strongest factual argument against the idea that Safari's web restrictions clear space for Apple Ads. The inventory that ITP and the identity block affect, ads on publishers' sites bought through demand-side platforms and enriched with cross-site IDs, is inventory Apple does not sell.

The July terms leave that door open. As PPC Land reported on July 15, Section 6(a) replaced "the relevant Apple software applications or Apple devices" with "the relevant devices, operating systems, software or web applications, or other platforms or properties," and the definition of ad content now includes web pages and links. A follow-up three days later noted that the new text removes any requirement that Apple own the surfaces where its ads run. Eric Seufert of Mobile Dev Memo offered a narrower reading at the time: the language may simply cover Apple services, such as the Apple TV app, on other companies' hardware. Apple named no new surface, market or date, and has not since.

Bloomberg's March report said Maps ads could appear on the web version of Maps. If that happens, it would still be an Apple property.

The money: what is known, and what is not

Apple's own disclosures

Apple does not report advertising revenue. What it has said is qualitative. On the call for the quarter ended March 28, 2026, chief financial officer Kevan Parekh said Apple saw "year-over-year growth in our advertising business," as PPC Land reported on May 1. For the quarter ended June 27, 2026, he said advertising set a June-quarter revenue record, and the Form 10-Q attributed the 12% rise in services revenue, to $30.739 billion, "primarily due to higher net sales from advertising and cloud services," according to PPC Land's August 3 report. Services also include App Store commissions, iCloud, AppleCare, payments and video, so the advertising share cannot be isolated.

Third-party estimates

Every revenue number in circulation is an outside estimate, and the methods are rarely published.

  • eMarketer, April 30, 2026: forecasts Apple's US ad revenue at $8.85 billion in 2026, rising to $11.06 billion in 2030. The article does not describe the method and gives no worldwide figure. PPC Land has previously cited an eMarketer estimate of about $8.5 billion; the two figures appear to come from different forecast vintages, and eMarketer's newer one is used here.
  • Evercore, as reported in October 2021: projected Apple's ad revenue at about $5 billion for 2021 and $20 billion a year by 2024, according to accounts of a Financial Times report. No later disclosure from Apple allows that projection to be checked. eMarketer's 2026 US figure is less than half of it, though one covers the US only and the scope of the Evercore figure was not stated in the reports reviewed.
  • Analysts cited in an Apple-funded study, April 2022: Columbia Business School professor Kinshuk Jerath, in a paper Apple paid for, put Apple Search Ads revenue in the "low single-digit billions" and called it a "small percentage of world-wide mobile advertising."

Market share

No independent, current estimate of Apple's share of any advertising market was found for 2026. eMarketer publishes a chart of US digital ad revenue shares for 2026 that includes Apple, but its values are not in the public text. The share figures that exist all date from the first year of App Tracking Transparency and measure app-install advertising on iOS, not web advertising:

  • Branch, via the Financial Times, October 2021: Apple's ads accounted for 58% of iPhone app downloads that came from clicking an ad, up from 17% a year earlier, in the six months after ATT took effect. Seufert said at the time the analysis might overstate Apple's position because it focused on non-gaming apps and excluded mobile web ads.
  • InMobi's Appsumer, September 2022: Apple's share of advertiser spend across more than 100 consumer apps in North America and EMEA rose five points to 15% between the first quarter of 2021 and the second quarter of 2022, peaking at 16% in the fourth quarter of 2021. Apple Search Ads adoption among those advertisers reached 94.8%.
  • Jerath, April 2022: argued that Apple Search Ads growth in 2021 came from overall mobile ad growth, growth in certain app categories and the service's launch in China, not from ATT.

Those three sources disagree, and all three concern apps.

The regulatory record concerns apps, not Safari

The only official findings on whether Apple's privacy rules favour its own ads come from competition authorities, and every one of them is about ATT on iOS apps.

Germany's Bundeskartellamt said in preliminary findings on February 13, 2025 that Apple defined tracking narrowly, as data processing across companies, which left its own combination of user data inside its ecosystem outside the rules. France's Autorité de la concurrence fined Apple 150 million euros on March 30, 2025, finding App Tracking Transparency neither necessary nor proportionate, while accepting privacy as a legitimate aim; until iOS 15 Apple did not ask users of its own apps for consent. Italy's competition authority fined Apple about 98.6 million euros on December 22, 2025, finding that third-party developers had to ask for consent twice while Apple's own "Personalized Ads" prompt asked once, and that Apple's advertising arm gained revenue and volume from the difference.

No regulator has issued a comparable finding about ITP or Safari's blocking of web trackers. The October 19 post draws the same line the German authority criticised in apps: "First party personalization is not tracking, and is not what our technologies seek to prevent." Apple's ads in the App Store and Maps are first-party by that definition, because Apple runs the store and the map. Apple says it needs no ATT prompt for them because they use first-party data and never the advertising identifier.

What the evidence shows, and what it does not

What it shows

The timing overlaps. Safari's restrictions tightened in 2017, 2018, 2019, 2020, 2023, 2024 and 2026. Apple Ads added placements in 2021, 2022, 2023, 2025 and 2026, and Apple's own executives now describe advertising as a driver of services growth.

The definitions favour first parties, and Apple is the first party on its own platforms. WebKit's line between first-party personalization and third-party tracking places Apple's in-app ads on the permitted side, and places the identity vendors that serve the open web on the blocked side.

Safari's approach has diverged from Chrome's. In 2020 WebKit expected Chrome to block third-party cookies by 2022. Google instead said on April 22, 2025 that it would keep them, and on October 17, 2025 retired most Privacy Sandbox technologies, including the Topics API Apple had opposed. Safari is now the major browser where cross-site identity is most restricted. StatCounter, which measures page views on sites carrying its tracking code, put Safari at 18.27% of worldwide browser usage in September 2026. Cloudflare, measuring traffic across its network, found Safari at 81.1% of US iOS traffic in September 2025, as PPC Land reported. Outside the European Union, every browser on iPhone runs on WebKit.

What it does not show

There is no public data showing advertising budgets moving from Safari web inventory to Apple Ads. The share studies above measure app-install ads after ATT, not web ads after ITP. Apple Ads sells no inventory on third-party websites today, so a web advertiser who loses Safari reach cannot buy it back from Apple.

The sequence does not fit a simple story either. ITP began in 2017, four years before Apple Ads moved beyond its single search slot, and the 2020 cookie block arrived while Apple Search Ads was still largely that one placement. The posts also state, consistently and over nine years, a privacy rationale that predates Apple's ad expansion, and the 2024 post says Safari "intentionally allows most ads to continue loading."

Nothing in the eight posts discusses Apple's advertising business. That silence can be read two ways, and the documents do not settle which.

Motive is not established by any source reviewed. Bannister's argument is an inference from timing and from the July terms. Apple's stated reason, in the October 19 post, is that "users deserve to not be tracked, not across websites and not covertly through fingerprinting, unless they explicitly opt in to it."

The open question

The test, if there is one, lies ahead. If Apple Ads starts selling placements on third-party websites or in other companies' apps, as its July terms now allow, Apple would be competing for the same inventory from which Safari has removed its rivals' identifiers, while using first-party data that WebKit's rules do not touch. That has not happened. Until it does, the record shows a browser maker restricting third-party tracking and an ad business growing inside that browser maker's own apps, with no disclosed figure connecting the two.

Why it matters for marketers

For advertisers, the practical effect of the WebKit record is already priced into Safari campaigns: shorter cookie lives, stripped click identifiers in Private Browsing, partitioned storage and, since iOS 27, no identity-resolver IDs. Measurement on Safari increasingly runs through Apple's own frameworks, Web AdAttributionKit on the web and AdAttributionKit in apps, which Apple Ads itself joined in 2025.

For publishers, the concern is concentration. Each restriction has removed a tool that independent ad tech used to recognise Safari users, and the replacements Apple offers measure clicks and conversions without identifying people. Platforms with logged-in users and their own inventory, Apple among them, are not affected in the same way. Whether that is a by-product of a privacy policy applied evenly, or something more, is a question the documents raise without answering. Regulators have so far answered it only for apps.

Timeline

Summary

Who: Apple, through its WebKit team (John Wilander and colleagues) and its advertising unit Apple Ads. Affected parties include web publishers, ad tech firms and identity resolution vendors. Third-party estimates come from eMarketer, Evercore, Branch, Appsumer and an Apple-funded study by Kinshuk Jerath.

What: A comparison of eight WebKit posts on tracking prevention, from Intelligent Tracking Prevention in 2017 to the identity resolution block in 2026, with the dated expansion of Apple Ads from one App Store slot to multiple search positions, the Today tab, product pages and Apple Maps. The record shows both moving in parallel and Apple's definitions placing its own in-app ads on the permitted, first-party side. It contains no figure linking Safari's restrictions to Apple Ads revenue.

When: The WebKit posts are dated June 5, 2017, June 4, 2018, September 23, 2019, March 24, 2020, November 12, 2020, June 6, 2023, July 16, 2024 and October 19, 2026. Apple Ads milestones run from 2016 to the Maps launch on August 21, 2026 and the terms change effective July 28, 2026.

Where: Safari and WebKit on iOS, iPadOS, macOS and visionOS; Apple Ads in the App Store and Apple Maps in the US and Canada. Regulatory findings came from Germany, France and Italy and concern iOS apps only.

Why: Publishers and identity vendors have argued since iOS 27 shipped that Apple's privacy measures serve its ad business. Apple's stated reason, repeated across nine years of posts, is that users should not be tracked across the web without their knowledge or consent. Apple's July 2026 terms, which allow ads on web applications and other platforms, are the point at which the two could meet, but Apple has announced no such product.