Week 43: Safari blocks ID vendors, Google moves uploads

Apple confirmed that Safari 27 blocks, by domain, the vendors that turn an email typed into a form into a tracking ID. In the same week Google moved another piece of its stack onto the Data Manager API, so customer lists for DV360 now go through the same door as Google Ads uploads. Both changes are about where your first-party data goes after a customer gives it to you.

Published this week

• Primary demand advertising also sells your competitors’ product: 21 US checkoff boards grow whole categories and measure the return without clicks.
• Switching ad trackers? Test what it sends back to each ad platform: eight platforms, eight click ID fields and dedup keys, and five ways to hash one email.
• Your 90-day click window rests on a cookie that may last 7: five platforms’ credit windows against the cookies that hold the click.
• Apple confirms Safari 27 blocks identity resolution vendors: email-based IDs and match rates fall on Safari, with no error on the vendor side.
• Google brings finance ad verification to the US and Canada: the rule is keyed on the audience, and affiliates cannot verify alone.
• PMax ignores your image opt-out on new campaigns from Dec 4: the account switch stops covering new campaigns, and creation date becomes a creative variable.
• DV360 API v5 drops Customer Match uploads for Data Manager: six upgrade paths into one API, and three behaviour changes that move numbers.

Releases and changes

Apple Safari

19 October. Identity resolution blocked by domain. Safari 27 on iOS, iPadOS, macOS and visionOS blocks network access to identity resolution infrastructure, and because the block is on the domain, a vendor cannot route around it by changing the request. Apple names no domains, so the only check is to load your own login and signup forms in Safari 27 and watch which requests fail. (WebKit)

Google Ads

20 October. Financial Services Verification for the US and Canada. Google brings its verification program for financial advertisers to both countries in early 2027. Affiliates and lead generators that run finance offers should find out now which licensed brand will verify for them. (Google)

21 October. PMax image extraction on by default. From 4 December, new Performance Max campaigns pull images from your landing pages even when dynamic images are off for the account. Opt out per campaign, and send every other automation setting in the same update, or you clear them. (Google Ads Developer Blog)

Display & Video 360

22 October. API v5 beta removes Customer Match uploads. v5 drops the methods that create and fill Customer Match lists and points to the Data Manager API. v4 has no sunset date yet, so this is a migration to plan, not a fire, but the new API fails a whole request on one bad record. (Google Ads Developer Blog)

Meta

19 October. An audience for each creative. Advertisers can put several ads in one ad set and set the age range and gender each creative suits. Results by age and gender inside that ad set now reflect your choice of creative as well as delivery, so read the breakdown with that in mind. (Meta for Developers)

21 October. WhatsApp marketing messages leave the Cloud API. Marketing messages sent through the Cloud API sunset on 13 October 2027 and move to the Marketing Messages API. A year is enough time, but any campaign that sends WhatsApp marketing messages, and any reporting built on them, rides on that integration. (Meta for Developers)

Shopify

20 October. A warning before outbound links. Shopify stores now ask customers to confirm before sending them to a site outside the store. A domain you own but have not connected to the store can still trigger it, so a funnel that hands buyers to a separate domain gains a step, and that step can lose clicks. (Shopify changelog)

What to do

1. Load your forms in Safari 27 and check which third-party requests fail after someone types an email. Any vendor on that list stops returning IDs for Safari users.
2. Add the image opt-out to every PMax creation path before 4 December, if you want images off.
3. List every job that uploads to Google: audience syncs, offline conversions, CM360 and GA4 server events. Note which ones still use the old APIs, and test the Data Manager API’s error handling before you move them.

Safari’s block removes one way of recognising a returning customer. The other one, the first-party click cookie, was already capped by Safari. How long does each ad platform keep its click cookie, against how long it claims credit for the click? The click window and the cookie puts the two side by side for five platforms.