Apple’s ongoing MO
In October 2022, an Apple engineer posted on GitHub Apple’s intention to curtail one such cloaking technique. In more simple terms, the post detailed how Apple planned to compare the IP address in the incoming response with the IP address of the main resource response. If they are mostly different—which they would be if they are coming from third parties—these cookies can only live for seven days before they are destroyed, limiting the ability of websites to use and make inferences from this data.
Apple never made a formal blog post about the change or indicated when it would go into effect.
Anton Lipkanou, president of Delve, an analytics-focused agency that offers support for tools like Google and Adobe Analytics, said the change is live and already creating anomalies in websites’ data.
However, Jen Simmons, Apple Evangelist on the web developer team for Safari & Webkit, tweeted on April 11 that the change had not shipped. Apple has not responded to a request for comment.
Part of ad-tech execs’ dissatisfaction with the change is how little Apple has communicated about it, given that it will affect the architecture of many websites.
How publishers and advertisers could be impacted
Sites that work with many third parties using this technique may have to retool how their websites work, said Loch Rose, chief analytics officer at Publicis-owned data firm Epsilon.
“There is plenty of sites where the majority of their traffic is Apple,” Rose said. “So they lose a lot of functionality.”
It creates a lot of blind spots and it creates a lot of unnecessary headaches
Ratko Vidakovic, founder of ad-tech consultancy AdProfs
Brands should start breaking up their reporting into other browsers to avoid making decisions on the wrong data, said Lipkanou. With these types of cookies now deleted every seven days, returning users will be much harder to identify.
Lipkanou also advised brands to rely on shorter-term metrics, such as last-touch or data-driven attribution, instead of first-touch.
The change will also impact publishers and their advertising products, said Ratko Vidakovic, founder of ad-tech consultancy AdProfs.
“The less a publisher knows about their audiences, the less they can provide insights to advertisers,” he said. “It creates a lot of blind spots, and it creates a lot of unnecessary headaches.”
How worried should the industry really be?
This isn’t Apple’s first rodeo trying to stop the practice of hiding third parties in first-party cookies, and it won’t be the last.
Sources say there exists yet other workarounds that Apple hasn’t yet squashed. Equally, sources say that the industry should not be surprised by Apple’s ongoing moves to close these loopholes.
The safest way for websites to work with third parties, both in terms of user privacy and avoiding future changes in browser policy, is by sharing information server-to-server, bypassing the browser entirely. But websites using this approach miss some key signals about users that can only be gleaned by knowing browsing behavior, Lipkanu said.