I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and have brought over 40 of them to successful exits. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

Author’s note: I’m doing the afternoon keynote at the Prebid Summit on Oct. 13 in NYC, where I’ll build on this article in connection with Google’s adtech remedies.

When Tim Berners-Lee founded the W3C, he baked nondiscrimination and universality into the fundamental vision of the web. And for a long time, the internet ran on a set of deeply held (albeit poorly codified) norms—some of which are being cast aside by Big Tech.

If we’re being honest, the adtech community has also played a part in bending the norms that underpinned the internet. I’m pretty sure that’s what Eric Seufert meant when he wrote that Apple had robbed the mob’s bank when it launched ATT.

As a whole, the adtech marketplace has done pretty well over these past couple of decades operating mostly in a regulatory vacuum.

But when lawlessness bites, it bites hard.

Case in point: On Sept. 29, 2026, AdExchanger broke the story that a number of identity vendors (e.g., Audigent, ID5, Permutive, TTD’s UID2.0) had their domains blocked on iOS 27 and MacOS 27 as a result of policy chances pursuant to Apple’s war on fingerprinting activity. What’s worse, The Trade Desk’s primary ad request domain (Adsrvr.org) was also blocked, which has the net impact of blocking TTD’s ability to access Safari ad inventory on devices using iOS 27.

While the blockade on adsrvr.org has been lifted, the threat of Apple blocking others’ ability to serve ads on Safari remains.

Browsers have a long history of protecting users from things like pop-up ads and malware—and even cookies and tracking. For the most part, browsers have been given tons of leeway by regulators, policymakers, and even standards bodies when it comes to how browsers protect their users.

Once you factor in the ways that browsers make money, many of us believe that browsers shouldn’t get so much leeway.

I’ve documented the path that some browsers have taken over the years, moving from a true user agent to a monetization engine—all the while continuing to be given the benefit of the doubt. Apple is no exception. This obviously isn’t the first time Apple has imposed a draconian ruleset for commercial gain.

But let’s ask the question: Is Apple simply protecting its users here? Apple can certainly claim that it’s protecting users from tracking. And to be clear: When asked, users indicate that they don’t care much for tracking.

But many of them also don’t care much for paying for content. And creating a system by which content creators’ only choice is paid subscriptions, and charging a 30% vig on those paid subs, isn’t protecting anyone but Apple. (I’ve noticed that advocates often cite the “adtech tax” but are much less vocal about Apple’s content tax.)

Browsers and regulators have historically laid claim to the idea that users choose a browser due to its fantastic privacy practices. I can certainly see how that type of logic could apply to the Firefox and DuckDuckGo browsers.

But as you may know, Apple doesn’t currently offer its users the choice of adopting a different browser. Outside of the EU, everyone on iOS uses a skinned version of Apple’s WebKit. Apple can’t really claim that users are “choosing” Safari at all.

Maybe privacy is one of the many reasons people choose an iPhone. After all, Apple sure does tout privacy and security as core features. But then that begs an entirely different question.

It’s difficult to say for sure given the Kafka-esque nature of Apple’s approach to blocking, but all accounts suggest that Google is absent from Apple’s recent block-list.

That seems a rather curious omission for two reasons:

If Apple wants to protect its users’ privacy, why not start with protecting them from the very company that Apple has complained about for years? One has to wonder if Apple’s financial relationship with Google is playing a part in Apple’s blocking decisions. If it is, then Apple’s claim that it is protecting users comes off as much less credible.

Starting in January, all browsers (including Safari) will be required to support an opt-out preference signal like the Global Privacy Control (GPC). By unilaterally blocking certain tracking domains, Apple is imposing its judgement on tracking rather than providing those controls to users. Heck, there are even policymakers in Europe who are seeking to incorporate GPC signals into the GDPR rules.

One interesting data point about opt-out signals is that some places impose anti-preferencing rules for browsers in terms how they implement those signals. An anti-preferencing rule such as the ones in Connecticut and California would prohibit Apple from using a signal to advantage Apple’s other lines of business—or at least require that these opt-out signals represent an actual consumer's choice.

But here, Apple (and not Apple’s customers) is making that choice.

And let’s not forget that Apple’s attacks on third-party adtech come as Apple reportedly seeks to build out its own advertising program. Apple uses a number of techniques to be able to claim that it doesn’t engage in tracking via its ad products. All those privacy-enhancing technologies (PETs) appear to be the wave of the future—something I’ve touched on here.

In short, there are tradeoffs when using PETs, and their use does not necessarily meet consumer expectations. For example, I’ve read consumer research suggesting that consumers don’t draw distinctions between cohort advertising (i.e., the approach Apple favors) and the cross-site tracking that is often used by adtechs. They are pretty much creeped out by both.

There aren’t many answers. Part of the challenge is that Apple isn’t really under any obligation to explain itself. So that leaves us all guessing whether or not the blocking of adsrvr.org was just some horrible mistake or a shot across the bow at adtechs who dare operate on Safari.

My sense is that this wasn’t a mistake. And the honest truth is that I’m still working through potential solutions.

If you’re interested in combining forces and finding a collective solution, please reach out to me here.

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

The room every marketer wants to be in is returning to New York City.

On March 9-10, 2027, Marketecture Live will be back at The Glasshouse NYC for a two-day event that will convene leading executives across brands, agencies, publishers, and adtech.

Wondering what the hype is all about? Marketecture Live takes a different approach: expertise first, no panels, no filler, no fluff. Across more than 40 sessions and breakouts, every conversation is designed to be sharp, relevant, and worth your time.

The event has consistently sold out, so don’t wait to lock in your ticket at the best price you’ll find.