Apple's Privacy Changes in iOS 15: What They Are and How They Affect AdTech
In June 2021, Apple announced a new set of privacy changes to its iOS mobile operating system, and the programmatic advertising industry has been feeling the effects ever since. Those changes rolled out with iOS 15, iPadOS 15, macOS Monterey, and watchOS 8 in September 2021.
Below is a breakdown of the main features and an assessment of what each one means for programmatic advertising and AdTech.
New Privacy Features in iOS 15
iCloud+ Privacy Features
Apple separated its iCloud offering into a free tier (iCloud) and a paid tier (iCloud+), bundling the following new privacy features exclusively with the paid subscription.
Private Relay
Private Relay has been described variously as a "simple VPN service" or a "combination of DNS-over-HTTPS with proxy servers." The most accurate framing sits somewhere in between: it encrypts the traffic flowing between the Safari browser and any website the user visits, making the content of that traffic unreadable — not just to third parties, but to Apple and the user's network provider as well.
Apple's own explanation of the mechanism:
All the user's requests are then sent through two separate internet relays. The first assigns the user an anonymous IP address that maps to their region but not their actual location. The second decrypts the web address they want to visit and forwards them to their destination. This separation of information protects the user's privacy because no single entity can identify both who a user is and which sites they visit.
In short: the two-relay architecture ensures that no single party ever holds both pieces of the puzzle — identity and destination.
Mail Privacy Protection
Mail Privacy Protection blocks senders from using invisible tracking pixels to detect when a user opens an email. It also masks the user's IP address, preventing senders from inferring location or linking email activity to other online behaviour.
Hide My Email
Hide My Email lets iCloud+ subscribers generate unique, randomly created email aliases that forward to their real inbox. Users can create and delete as many aliases as they like, meaning they can interact with services without ever revealing their actual address.
Impact on Programmatic Advertising and AdTech
As with most privacy changes of recent years, the iCloud+ features cut into the data signals that advertising and MarTech platforms depend on.
Mail Privacy Protection undermines email open-rate reporting. Any email automation or MarTech platform that surfaces open-rate metrics will produce unreliable data for users on iCloud+, since opens can no longer be confirmed via pixel fires.
Hide My Email creates friction for identity graphs and ID resolution solutions built around email addresses as persistent identifiers. In theory, a hashed alias could still be ingested as an identifier, but whether those aliases behave consistently enough to be useful in practice remains to be seen.
The practical scope of the impact depends on one key figure: how many iCloud users are on a paid subscription?
According to a group of Barclays analysts, Apple had approximately 850 million iCloud users as of 2018, with roughly 170 million — about 20% — on paid plans. That 170 million figure represents the ceiling of affected users for iCloud+-gated features. It's a meaningful audience, though considerably smaller than Apple's total device install base.
Intelligent Tracking Prevention (ITP)
Intelligent Tracking Prevention has been evolving since its introduction in September 2017, with successive updates steadily narrowing the data signals available to advertisers in Safari. The iOS 15 cycle added another layer: ITP now hides users' IP addresses from trackers.
Impact on Programmatic Advertising and AdTech
ITP had already substantially curtailed what's possible in Safari for programmatic advertising — audience targeting and retargeting are largely non-viable in that browser at this point. Many advertisers shifted toward contextual targeting in Safari as a fallback.
The IP-masking update makes even that fallback harder. Location is one of the primary signals used in contextual targeting, and IP address is the dominant method for inferring location. Contextual signals like page URL remain usable, but losing location data meaningfully reduces the precision of contextual campaigns running in Safari.
SKAdNetwork
SKAdNetwork is Apple's privacy-preserving attribution framework for mobile app advertising. It works by sending postbacks to advertisers (i.e., app developers running campaigns) when an ad results in a conversion such as an app install, without exposing individual user-level data.
A notable detail in the evolution of SKAdNetwork: the version running on iOS 14 sends postbacks to only one ad network. With iOS 14.6, up to five ad networks can receive a notification that their ads did not result in a conversion.
Impact on Programmatic Advertising and AdTech
The original introduction of SKAdNetwork had significant implications for mobile advertising measurement. The iOS 15-era update is comparatively incremental. If anything, it leans positive: Apple is actively developing the framework, and expanding postback distribution gives advertisers a better ability to verify and validate conversion data independently. That kind of transparency is a meaningful improvement over the prior state.
App Privacy Report
The App Privacy Report gives users a window into how installed apps have been using device resources — location, photos, camera, microphone, and contacts — over the previous seven days. It also lists the third-party domains each app has been contacting, giving users a clearer picture of which companies may be receiving their data.
Users can act on this information by adjusting app permissions directly through settings.
Impact on Programmatic Advertising and AdTech
Of the iOS 15 privacy changes, this one carries the least immediate impact on the advertising ecosystem. The report surfaces information that was technically already governed by app permissions; it just makes that information more legible to users. Acting on it requires users to actively explore their settings — something most users are unlikely to do routinely. The longer-term risk is more reputational than technical: if a high-profile app's data-sharing partners become visible and spark user backlash, that could accelerate permission revocations. For now, though, this is the quietest of Apple's iOS 15 changes from an AdTech standpoint.