The Update That Finishes What ATT Started

App Tracking Transparency was a popup. iOS 27, by the reporting so far, is a wall. That is the whole argument, and it is worth sitting with before the trade press moves on to the next platform update, because the difference between a consent screen and a structural block is the difference between asking an industry to behave and removing its ability to operate at all.

AdExchanger's reporting on Apple's plans describes something blunter than another privacy prompt: Apple intends to block hundreds of programmatic data companies from iOS outright. Not throttle. Not require a toggle. Block. That is a different category of action from ATT, and the trade's own coverage says as much, flagging that this latest move "hits different" than the change the industry spent years adapting around.

What ATT actually did, and didn't do

It is easy to forget, this far on, what ATT actually was. It was not a ban on tracking. It was a requirement that apps ask first. The IDFA, Apple's device identifier for advertisers, remained available to any app whose user tapped "Allow" on the prompt. The entire programmatic data industry spent the years since optimising prompt copy, timing the ask, and building probabilistic workarounds, fingerprinting, server-side matching, for the users who tapped "Ask App Not to Track" anyway.

That workaround economy is precisely what made ATT theatre rather than enforcement. The permission structure existed, but the pipe underneath it never fully closed. Programmatic data companies adapted their collection methods rather than their business models, because the business model, acquiring and reselling identity-linked behavioural data, was never actually prohibited. It was just made marginally harder to do without asking first. A company that could not get a direct "Allow" from the device still had routes: probabilistic matching across signals that fell outside the prompt's scope, server-to-server data transfers that never touched the on-device permission layer, and aggregation techniques designed specifically to reconstruct what the identifier used to provide outright.

None of that was illegal under ATT's own terms, because ATT was never built to prohibit it. It was built to insert a moment of friction and let the market sort out the rest. The market, predictably, sorted it out by building an entire sub-industry around minimising that friction. Consent rate optimisation became its own discipline. Agencies ran split tests on prompt wording. None of that activity would have existed if the underlying data pipeline had actually been closed rather than gated.

What iOS 27 does instead

According to AdExchanger, Apple's approach this time is structural: hundreds of named programmatic data companies blocked from iOS, not a prompt that data companies' clients might ignore or route around. If the reporting holds, there is no consent screen to optimise, no probabilistic fallback to build, because the block operates at a level the companies themselves cannot negotiate with a better user-facing pitch. You cannot A/B test your way past a company-level exclusion the way you could A/B test your way past a permission dialog.

That is the detail that should worry anyone whose stack depends on third-party data brokers feeding programmatic bidding systems on iOS. ATT was a user-facing friction point that sophisticated operators learned to minimise. A platform-level block on named companies is not a friction point. It is a closed door, and closed doors do not respond to better copywriting, better onboarding flows, or better explanations of value exchange to the end user. There is no end user in this transaction to persuade. The decision sits entirely with Apple, and Apple's own reporting suggests it has already made it.

Why the scale matters

The word "hundreds" is doing real work in AdExchanger's reporting. A block aimed at a handful of the worst offenders would read as enforcement against bad actors, the kind of targeted action that leaves the rest of the ecosystem room to argue it was never the real problem. A block that names hundreds of companies reads as something closer to a judgement on the category itself: that programmatic data brokerage, as a business model built on acquiring and reselling identity-linked signal from mobile devices, is the thing Apple has decided it no longer wants running on its platform, not the handful of companies that got caught doing it badly.

Why "theatre" is the right word for what came before

Calling ATT theatre is not a dismissal of its real effects. Opt-in rates did change the inventory available to advertisers who relied on device identifiers, and plenty of campaigns had to be rebuilt around that reality. But theatre is the right description because the structure of ATT always left the underlying transaction, data company collects signal, data company resells signal, intact for anyone willing to keep asking. Apple built a gate with a visible latch. The industry's job, for the years since, was simply learning which hands could still open it, and plenty of hands found a way.

iOS 27, as described in AdExchanger's reporting, removes the latch rather than making it stiffer. Blocking hundreds of programmatic data companies by name is not an invitation to design around; it is a list of companies who no longer have a route onto the platform at all, regardless of what any user taps, regardless of how well a consent flow is designed, regardless of whether the data in question is collected first-party or bought from a reseller three steps removed from the original app.

The attribution industry already sees it coming

There is a useful signal in how the attribution side of the industry is behaving right now, independent of Apple's announcement. Digiday's reporting on how TikTok is helping app advertisers rethink attribution describes an industry already moving away from dependence on the kind of granular, device-level signal that programmatic data brokers exist to supply. That shift did not start because of iOS 27 specifically, but it shows that the smartest operators in app advertising have already concluded that the old attribution model, built on exactly the data flows Apple now appears ready to block structurally, was not a stable foundation to keep building on.

That is worth noting because it undercuts the argument, which will inevitably surface from parts of the programmatic trade, that this block is an overreaction or a disruption nobody saw coming. The attribution side of the business has been quietly hedging against this exact outcome by building alternatives that do not depend on third-party broker data. Apple's move does not blindside an industry that was caught unaware; it confirms a direction plenty of serious operators were already moving in.

What this means for anyone downstream of the pipe

App advertisers who have spent the ATT years rebuilding attribution around aggregated, privacy-safe measurement are closer to being insulated from this than those who still lean on third-party data brokers for audience enrichment. The companies most exposed are precisely the ones Apple appears to be naming: the programmatic data firms whose entire function was acquiring and reselling signal that ATT's consent model never fully stopped. For those firms, there is no optimisation path left to run. A prompt can be rewritten. An exclusion list cannot be charmed.

Publishers who sold inventory through programmatic pipes feeding on that broker data will feel this indirectly, through thinner bid density and lower effective rates on iOS traffic, even if their own first-party data practices were never implicated in the block. That is the nature of a structural cut rather than a targeted penalty: it does not stay contained to the companies named on the list, it ripples through everyone who transacted with them.

The honest reading of this week's reporting is not that Apple has found a cleverer privacy prompt. It is that Apple has decided prompts were never going to be enough, and has moved to simply remove the companies from the platform. ATT asked the industry to behave. iOS 27, on the evidence so far, does not ask.