S07, E32: The CAPI revolution

Let's [music] get real. Half the time you're not sure if your campaigns work. You just kind of hope they do. Attribution numbers look good, but what if those conversions would have happened anyway? Incremental [music] helps you find out for real. No tracking people, no guessing games, just clear answers on which [music] campaigns actually move the needle. If you want to stop guessing and start knowing, go to Incremental. Because good marketing isn't about getting clicks, [music] it's about getting results. Check them out at incremental.com. That's i [music] n c r m n t a l dot com, or click the link in the show description.
The problem is that the distinction needs to be drawn [music] between the competence of the economists and the correctness of their analysis.
In November 2021, I published a piece titled Everything is an ad network. The term ultimately became something of

a meme. In the original article, I argued that the disruption of digital advertising by Apple's App Tracking Transparency, or ATT, privacy policy created a commercial opportunity for companies that previously had little reason to run advertising businesses. ATT had weakened the advantage that Meta derived from aggregating behavioral data across its base of advertising clients. Companies with first-party purchase data of their own, collected directly on their platforms, could now monetize that data in a competitive environment that had become considerably more accommodating to them. Meta's advantage had been formidable because its enormous user base was complemented by knowledge of what those users did outside of Facebook and Instagram, across nearly the entire expanse of the internet, both on the web and in mobile apps. An advertiser could tell Meta that someone purchased its product, and Meta could use that information to improve the targeting of subsequent ads with deterministic precision, anchored to the Identifier for Advertisers, or IDFA, on iOS. This was the so-called hub-and-spoke model that I had written extensively about. Advertisers supplied commercial

feedback to a platform whose targeting capabilities made that feedback valuable. The everything is an ad network phenomenon followed from the restrictions on that feedback loop. A retailer might have a fraction of Meta's audience, but much more reliable knowledge of what its customers purchased in a particular category. A home improvement retailer like Lowe's, which launched its retail media network the month before I published everything is an ad network, knew which customers were renovating their houses because it sold them the materials. As Meta's ability to connect external purchases to its users deteriorated, that retailer's native commercial data became more valuable relative to what Meta could access. Advertisers had a reason to explore these smaller and more specific environments, especially as the performance of their established channels became less dependable. I explored the resulting disruption in the app tracking transparency recession, published in January 2023. That piece acknowledged the concurrent return to pre-pandemic consumption patterns, while arguing that ATT explained an important part of the divergence between social media advertising and less exposed advertising

businesses. ATT restricted access to the iPhone's advertising identifier and imposed broader consent requirements on cross-company tracking. The resulting loss of signal impaired the feedback that made behavioral targeting productive, creating an opening for companies whose commercial knowledge originated with their own products. But ATT reached the majority of iOS devices more than 5 years ago now. It's old news. And Meta's ad platform has recovered from ATT in spectacular fashion, as I detail in a podcast published in January 2025 titled Meta's Renaissance. So, why is everything still an ad network? And how can the continued proliferation of new ad platforms coexist with the renewed advantages of the largest platforms? I believe the answer requires unpacking a development that predates ATT, which is poorly understood, but instituted a profound transformation of the underlying mechanics of the digital economy. The Conversions API, or CAPI. To appreciate its significance, it helps to consider how old the preceding infrastructure is. Web beacons were already documented in the 1990s, including their use in

collecting browsing information that could inform advertising. A pixel is a tiny image embedded in a webpage. Displaying the page causes the browser to request that image from a server. And the request communicates information to the server that receives it. The image can be effectively invisible while the request provides a record of the page being viewed accompanied by information about the browser and its network connection. Over time, the term pixel came to encompass more elaborate JavaScript tags that could observe actions within a website and transmit information about them. As I explained in Cookie Deprecation in Chrome: Who Is Impacted, published in January 2024, a tag can read or set cookies and communicate with an external server. An advertiser could place a platform's tag on its website and report purchases alongside identifiers, like click IDs, that let the platform recognize the relevant browser or user, as well as the provenance of their visit to that site. The economic significance was that activity on an advertiser's property could improve the selection of ads somewhere else. This feedback served purposes beyond counting transactions. When the platform learned which people

purchased an advertiser's product, it could improve its predictions about who else might purchase it. This relationship underpinned Meta's effectiveness as a direct response advertising channel, particularly for businesses whose potential customers were dispersed across the internet and difficult to identify through broad demographic categories or observed on platform interests. The browser nevertheless occupied a consequential position in this arrangement because it executed the code and controlled the storage on which continuity of identity often depended. And Apple, which controls not just the Safari browser, but outside of the EU, all browsers that operate on iOS, since all global iOS browsers must use WebKit, Safari's rendering engine, began imposing increasingly restrictive conditions on that process with its Intelligent Tracking Prevention or ITP program introduced in 2017. The original iteration of the framework limited when cookies could support tracking across websites, and subsequent revisions progressively narrowed the opportunities available to advertising companies. Moving identifiers into first-party cookies offered an adaptation, since

those cookies were associated with the advertiser's own website. Apple subsequently restricted that approach, too. In February 2019, ITP 2.1 capped the lifetime of a persistent cookie set through JavaScript at 7 days. In April of that year, ITP 2.2 reduced the cap to 1 day under specified conditions involving navigation from a domain classified as capable of cross-site tracking, and a destination URL containing additional parameters, known as link decorations. Those parameters could carry a click identifier that connected the advertiser's visitor to a known interaction on an advertising platform. In March 2020, Safari introduced full third-party cookie blocking, alongside additional restrictions on script writable storage. For an advertiser, these changes affected whether a purchase could be connected to the advertising interaction that preceded it. Someone might click an ad and purchase several days later, after the identifier needed to connect those events had expired. The transaction still occurred, but the platform could lose the ability to recognize its relationship to the campaign. That loss impaired reporting and deprived the targeting system of

feedback about the people its ad had reached, particularly when the decision to buy required more time than the browser permitted the identifier to persist. Advertising technology companies responded with further adaptations, including methods that made third-party infrastructure appear to operate within a website's first-party environment. Apple responded by extending its restrictions to those methods, too. I describe this history in a piece titled Apple's latest cookie restriction is ad tech whack-a-mole, published in April 2023, because each successive intervention demonstrated the vulnerabilities, if not frailty, of measurement infrastructure operating within an environment controlled by another company. The article also described a development that changed the nature of that dependency. Quote, "But Meta offers advertisers another conversion measurement solution, the Conversions API or CAPI, which allows advertisers to instrument specific conversion events and to transmit them to Meta through a server-to-server process. This server integration sits entirely outside of the purview of a browser or mobile operating system. End quote. Facebook's modern CAPI tool emerged in

2020, as I noted in a piece titled Is CAPI future-proof? published in June 2023. Server-side conversion reporting already existed. Facebook offered offline conversion infrastructure as far back as 2016. But ITP made the value of a direct server connection increasingly obvious. An advertiser could record a purchase in its own systems and send information about that purchase directly to Facebook outside of the browser. This is the architectural change that makes CAPI so meaningful. Apple can change how Safari handles a cookie, whether a browser permits a tracking request, or whether a mobile advertising ID is available to an app or SDK, but these operating environments don't participate in and can't mediate an exchange between an advertiser's server and Meta's server. Restricting the information available to those parties can still affect what they accomplish, and rules can govern how they use it, as ATT attempted. But the transmission itself has moved outside browser and operating system execution, removing the direct technical dependency that made the pixel vulnerable to successive platform changes. Realizing that benefit required

deliberate advertiser adoption, with implementation often reaching further into the company's own data systems. As I wrote in Small Platform Syndrome, published in November 2024, quote, and there's a very acute challenge facing smaller ad platforms now, retail media and social alike, the necessity of collecting conversion data through new tools that require deliberate advertiser integration. In the paradigm prior to Everything is an Ad Network, data collection was mostly standardized around pixels and SDKs, which required effort on an advertiser's part that was mostly rote. The new frontier of data collection tools comprise conversion APIs and data clean rooms, which can impose more cumbersome integrations. End quote. The CAPI was fairly new when ATT was instituted, and its availability did not mean advertisers had integrated it or that platforms had learned to fully ingest and capitalize on the resulting feedback. ATT made that work urgent, elevating a deeper integration into the advertisers' own data systems from an optional infrastructure project to a commercial priority. Once an event arrives, a platform still needs to connect it to something it can use in making advertising decisions. A

supplied email address may match an authenticated account directly. Where that identifier is unavailable, the combination of IP address and timing, supplemented with other device or browser information, can narrow the potential match considerably when the platform knows its own user and has a direct connection to the advertiser. In that setting, my argument is that the assemblage can deliver near deterministic fidelity for advertising purposes, even recognizing the necessary loss of precision. The direct relationships on both sides make that proposition materially different from trying to recognize an unknown person across unrelated inventory. This creates two routes to commercially useful advertising data. A retailer can observe purchases within its own product and use that knowledge to sell relevant advertising. And a media platform can instead receive commercial feedback from advertisers, connecting what happens on their properties to the audience it already serves. Its product need not be a shopping destination for its advertising to reflect purchase behavior, provided the platform can establish the relationships that make the feedback available and useful. The advertiser's decision to establish that connection is therefore a vital

artery of commercial value. The incentive is to supply a complete stream of relevant conversion events, including purchases acquired through other channels, because that broader history gives the recipient more information from which to learn. Many companies will only entrust that breadth of commercial data to their most important platform partners, placing a practical ceiling on the number of CAPIs they're willing to support. The ability to secure those relationships helps explain why everything can continue to become an ad network, while the advantages enjoyed by the largest platforms become more imposing, more disproportionate, and seemingly more insurmountable. This is the dynamic I explore through the lens of what I've called small platform syndrome.
AI is changing everything, but it's only as good as the signals behind it. Branch connects [music] customer interactions across paid, organic, offline, email, web, [music] and app touchpoints, and turns them into the trusted context you need with links and attribution that capture the full user journey.

Learn more [music] at branch.io. And while you're there, check out Branch's AI search and discovery report covering insights [music] from more than 300 enterprise marketing, growth, and digital leaders to understand how the industry is responding [music] to the rise of AI search. That's branch.io.
The everything is an ad network dynamic persists to this day. In April 2024, Chase introduced Chase Media Solutions using its transaction data to connect brands with consumers on the basis of their spending behavior. This is financial media. The commercial knowledge comes from purchases made across merchants, giving Chase a perspective that any individual retailer would struggle to replicate. United followed in June with Connective Media, a travel media business that uses information about travelers to reach audiences through United's app and in its seatback screens. And more conventional retailers continue to bring advertising products online, too. Ace Hardware launched Red Vest Media in August 2025, drawing on its shopper relationships and Ace Rewards program to give brands access to relevant customers. Academy Sports introduced

Academy Retail Media in July 2026, connecting advertising with purchase information from its sporting goods business. Between those launches, OpenTable introduced OpenTable Media in February 2026, using dining and reservation information to support advertising opportunities that include what it calls bookable brand experiences. Each of these businesses possesses commercial knowledge generated through existing relationships with consumers, and each can offer advertisers access to that knowledge within a particular domain. These announcements established that the theme hasn't been extinguished, but they tell us relatively little about whether any particular network will achieve appreciable scale. Further, they leave open the question of how and really why these nascent app platforms can coexist with Meta's recovery, given that Meta's disruption helped create the opportunity in the first place. I examined Meta's recovery in the podcast episode Meta's Renaissance, including the investments that helped Meta improve conversion measurement and make advertiser integrations more accessible. From that episode, quote, "When ATT was introduced, Meta expanded CAPI to app advertisers and built what

it calls the CAPI gateway, which reduces the amount of engineering resources required for integration. Meta's CAPI accepts a number of different identifiers that can be used to match a conversion to a user in its own user base, such as the user's email address, the click ID attached to a specific ad, the user's phone number, the advertiser's unique identifier for the user, and the user's IP address." End quote. That work accompanied changes to Meta's engagement model, as well as improvements to campaign optimization through products like Advantage Plus. CAPI contributed to a broader reconstruction of the advertising business, and its contribution should be interpreted alongside those changes. I would encourage anyone interested in the full account to listen to that episode. For the purposes of this discussion, the relevant point is that Meta invested in rebuilding the connections through which advertisers could supply commercially useful feedback. Although Meta's Renaissance, as I point out in the podcast, was multifaceted and also relied upon the transition to an open graph and better access models to drive engagement and thus impression volume. But the CAPI architecture provided a robust data foundation for the entire strategy, and the CAPI approach is becoming available in surface areas far

beyond the social feed. In Netflix introduces a CAPI, published in March 2026, I discussed the company's addition of a direct conversion connection as part of its broader emphasis on advertising measurement and performance. A streaming service can receive information about purchases without operating the stores in which those purchases occur, potentially allowing advertising relevance to to well beyond the subject of the program being watched. I covered a similar development in ChatGPT launches a CAPI, a pixel and self-serve, published in May 2026. As I explained then, advertisers could measure downstream conversions, but could not yet optimize bids against those events in ChatGPT's advertising product, which matters when distinguishing the opportunity from the capabilities available at launch. In the privileged position of chatbot advertising, published last month, I expanded upon that implication. Commercially motivated conversations provide native intent, while advertiser supplied data could support relevant advertising during usage that contains no commercial intent. CAPI gives platforms a route to commercial knowledge generated elsewhere, but acquiring enough of that

knowledge introduces its own competitive limitations. Thus, small platform syndrome. The general problem encapsulated by small platform syndrome is the circular dependency between the performance an advertising platform can deliver and the advertiser participation it needs to improve that performance. Returning to the article, quote, "In this generalized form, small platform syndrome is a circular dependency or a chicken and egg scenario. An advertising platform scales the data it uses for targeting from advertiser spend, but advertisers won't allocate additional dollars to a platform if performance dips below some standard, usually a ROAS target." End quote. An audience can therefore support an advertising business before that business develops particularly sophisticated targeting. Brands may pay to reach that audience because they value the association with the product or because its users fit a broad demographic profile. But scaling direct response spending requires a more reliable connection between the money an advertiser spends and the commercial outcomes it generates. Advertisers that treat advertising as a cost of revenue need confidence that additional spending will produce

acceptable returns, and the platform needs conversion feedback to improve the predictions that deliver those returns. CAPI makes this dependency more imposing because the advertiser must actively establish the data connection that allows the platform to demonstrate its potential. Again, from small platform syndrome, quote, "But measurement requires more sophisticated approaches to attribution now that necessitate new integrations with tools like CAPI's and data clean rooms. This is friction for initial adoption that didn't exist in the pre-everything-is-an-ad-network era, and it aggravates the opportunity cost incurred by an advertiser of working with additional channels." End quote. A smaller platform can ask an advertiser to integrate its CAPI on the promise that the connection will improve performance, but the advertiser may reasonably want evidence of performance before prioritizing the integration. That creates a problem with the test itself. The advertiser evaluates the channel using a limited data connection, sees results that fail to justify further investment, and declines to provide the feedback that could have improved those results. A large consumer audience helps make the case for taking that risk in the first place, but

audience scale alone cannot force the advertiser's implementation into an already crowded engineering queue. There's also a more meaningful decision embedded in that integration than the engineering work alone. A CAPI transmits all conversion events. If an advertiser had attribution knowledge itself, it wouldn't need to integrate with the CAPI. So, the events transmitted through a CAPI tell the recipient something about who buys the advertiser's products, even when the recipient had no role in producing those sales. Subject to the information supplied and the platform's ability to use it, that knowledge can improve predictions about which of its own users might become customers. But the data relationship is expansive and can introduce leakage risks and overlapping measurement concerns. Those create a practical ceiling on the number of CAPI's that an advertiser will reasonably be willing to support. A company may be willing to share comprehensive conversion information with the platform responsible for a substantial portion of its customer acquisition, while declining to provide comparable access to an unfamiliar channel that might eventually become useful, or even a known but much smaller channel. The API can technically accept a narrow selection of events, but that limits the

information available for learning. This forces a commercial decision about how much of the advertiser's data the recipient should be allowed to observe, and many advertisers will reserve that access for their largest partners. So, the scale advantage compounds. Larger platforms have a stronger claim on integration resources and a more credible justification for receiving that expansive stream of commercial data. They can then use that feedback to make their advertising more productive, reinforcing the advertisers reason to prioritize them. A smaller platform can build the same kind of endpoint, investing the same engineering resources, without securing the same depth of participation. The existence of a CAPI does little to level the efficiency playing field when advertisers make highly selective decisions about which platforms receive the data that gives it value. The recipient's consumer relationships also determine how much it can extract from that access. A platform with authenticated users can compare advertiser supplied information with activity it observes directly, giving the remaining identity signals a much more useful context. This is the setting in which I believe the combination of IP address and timing, supplemented by

other available information, can approach deterministic fidelity for advertising purposes. The same stream of events can be less useful to a company that has no comparable relationship. So, even when a smaller platform can demonstrate competitive campaign performance, another constraint remains. As I write in Small Platform Syndrome, quote, "One fundamental reality of digital advertising makes Small Platform Syndrome painful to overcome. Advertisers face opportunity costs and diminishing returns in growing their portfolio of channels and might prefer a larger channel by total spend to a smaller one, even if the smaller channel could deliver better returns. So, a smaller channel by spend doesn't simply have to prove performance parity with a larger channel, but it may have to demonstrate better performance to win an advertiser budget." End quote. Reported return on ad spend captures the revenue associated with a campaign relative to its media cost, but the advertiser operates a business with additional demands on its resources. Introducing a channel requires work and maintaining it consumes attention that could be directed toward improving a larger proportion of revenue. A smaller platform might report an attractive ROAS

on a modest budget while contributing too little absolute dollar profit to justify the ongoing effort. Equal campaign ROAS therefore doesn't imply equal commercial value, particularly when the larger platform can absorb substantially more spending without requiring the advertiser to establish another operating relationship. The article identifies ways to ease these constraints. Partnerships with data platforms such as Snowflake can make conversion connections easier to establish within the systems advertisers already use as Snap and Pinterest have pursued. Automation can also reduce the work required to adapt advertising creative to a platform's native formats, making those placements more accessible without demanding a separate production process. These approaches can improve the economics of testing a channel, although building effective automation requires investment, and easier implementation doesn't alter the priority calculus. The advertiser still needs a reason to devote attention to the platform with confidence that sharing more data will produce a worthwhile return. Small platform syndrome therefore helps explain how continued entry and concentrated performance spending can coexist. A retailer may sustain a

valuable advertising business within the category it understands particularly well while a much smaller group of platforms secures the advertiser relationships needed to aggregate commercial feedback across categories. CAPI expands the range of media that can support behavioral targeting while rewarding the platforms best positioned to obtain the necessary integrations. That creates a further question for the rest of the ecosystem. Where does it leave advertising intermediaries that can receive conversion data but lack comparable direct relationships with consumers? And so the position of independent advertising intermediaries follows from that tension. A DSP can operate a CAPI, The Trade Desk offers a real-time API for instance. The question is how effectively that feedback can be connected to addressable inventory across independent publishers, particularly when the intermediary has no direct relationship with consumers to utilize for interpretation and probabilistic matching. In cookie deprecation in Chrome, who is impacted, I walked through the historical infrastructure supporting that connection. Cookie syncing allows participants in the programmatic supply chain to associate their different identifiers

for the same browser, building reference tables that make an audience recognizable across transactions. A DSP can use those connections when evaluating an impression offered by a publisher with which the advertiser has no direct relationship. Google abandoned its planned removal of third-party cookies in July 2024 and confirmed in April 2025 that Chrome would retain its existing approach to user choice, so the cookie deprecation bullet was dodged, but that history nonetheless remains helpful for understanding the dependence of intermediaries on identity infrastructure that spans properties they don't own. A CAPI can receive conversion data without facilitating commercially valuable attribution. A DSP still needs usable identifiers on the conversion side and corresponding signals in the inventory it can buy. Publisher partnerships and authenticated identity systems can supply that, but coverage depends on participation elsewhere in the ecosystem. Independent DSPs can still create value by helping advertisers buy and optimize across publishers, particularly when advertisers value access beyond any one platform. Their challenge is to make those connections productive enough to offset the advantages of an owned

consumer audience. An owned and operated platform with its own consumer accounts and first-party conversion data begins with a different identity foundation, which is why treating every DSP as occupying the same competitive position misses something fundamental about Amazon. In Amazon's advertising advantages, published in May 2026, I wrote, quote, Amazon's advertising advantages have always been somewhat obvious. As a retail platform and through its Prime subscription, it benefits from a massive bank of first-party logged-in purchase data that it can leverage to target on-site ads across its sponsored products, sponsored brands, and display placements. Amazon also utilizes this data to target ads on off-site third-party placements through its Amazon DSP, as I discussed in Amazon, the Advertising Behemoth. When Amazon announced that it would introduce ads to its Prime Video service in 2023, I noted that the expansion represented a greenfield opportunity to capitalize on that data. End quote. Amazon brings commercial knowledge to outside inventory that an intermediary without its consumer business must

obtain through other relationships. Amazon announced in May of this year that its authenticated reach spans 90% of US households with deterministic identity. That coverage matters. An advertiser supplied email address that corresponds to a platform account, in this case a Prime account, is incredibly valuable. An IP address supports inference. Several people may share it and its usefulness depends on context and other data. When a platform has direct relationships with both the advertiser and the consumer, the combination of IP address and timing, supplemented by remaining signals, can narrow the possibilities enough to approach deterministic fidelity for advertising purposes. That is my argument about the practical value of those relationships, with some loss of precision acknowledged. Modeled campaign outcomes represent a different exercise, estimating conversions that cannot be observed or attributed directly without necessarily establishing who converted. Reporting a modeled purchase therefore does not establish an individual match. In Google Embraces IP-Based Fingerprinting, published in December 2024, I positioned Google's policy

change to explicitly allow for the use of IP addresses for marketing measurement as an acknowledgement of how pervasive that practice is, particularly in connected television. And in The Privacy Shuffle, published in January 2025, I extended that interpretation to Apple. Quote, "What Apple may have achieved with privacy manifests and the required reasons API is a lack of precision with IP-based advertising attribution that it deems acceptable. In other words, there may be a threshold of fingerprinting inaccuracy where the practice simply can't be considered fingerprinting." End quote. This was an interpretation of Apple's behavior whose published rules continue to prohibit fingerprinting. In The Privacy Shuffle Part 2, published in May 2025, I argued that Google's retreat from cookie removal and the growing regulatory scrutiny of platform privacy policy, like ATT and Google's at the time planned deprecation of cookies in Chrome, made the realignment more acute. Commercially useful measurement that tests strict privacy boundaries appeared more durable, some might say indomitable, than the direction of

policy immediately after ATT might have suggested. Apple does possess a mechanism that could substantially weaken IP-based matching. In Apple's privacy nuclear option published in April 2024, I described it this way, quote, Apple could pursue a quote-unquote nuclear option if it wanted to upend the practice of device fingerprinting entirely, expand its iCloud private relay feature to all iOS devices and turn it on by default, obfuscating device IP addresses for most web and in-app network traffic. If private relay were expanded to encrypted app traffic and turned on for all iOS users, the IP address would no longer constitute a reliable source of identity. The true IP addresses of all participating devices would be obscured, belonging to a private relay proxy, end quote. Private relay already routes protected traffic through separate relays with destination servers seeing a proxy address. The extension would cover encrypted app traffic by default, preventing advertisers and platforms from routinely observing the same original IP address in their separate consumer interactions. A copy could continue transmitting

events, but those events would lose a widely available matching tool. Account identifiers could still support matches where available, and campaign modeling would remain possible, so the effect would depend on how heavily each platform relied on IP-based inference. Implementing that expansion would create substantial operating costs beyond the subscription-supported service Apple currently offers, alongside the practical difficulty of routing traffic at that scale. Perhaps more disqualifying, an intervention that impaired independent measurement while increasing dependence on Apple-controlled alternatives would invite scrutiny related to competition. Recent European proceedings around ATT renders those risks more germane. Germany's competition authority secured binding commitments last month requiring closer alignment between Apple's own advertising consent requests and those it mandates for third-party apps. The changes include more neutral presentation and greater flexibility to connect Apple's request with consent required under data protection law. Apple received 4 months to implement the commitments, which remain binding for 7 years. France imposed a 150 million euro

penalty in March 2025, and Italy imposed a penalty of approximately 99 million euros in December 2025. Proceedings in Poland and Romania remain ongoing. In Apple forced to restructure ATT, which I published last month, I wrote, "So ATT will survive, but Apple's ability to impose asymmetric rules on third parties under the banner of privacy without meaningful constraint will not." End quote. The implication I'm submitting there is that ATT represents a ceiling on another sweeping intervention of this kind, at least in the immediate term. Regulators have demonstrated a willingness to examine whether Apple's privacy architecture disadvantages competing advertising businesses and to require changes when they have found that it does. A broader intervention would face those questions from its inception, which makes universal IP obfuscation much less likely in the near-term future from my perspective. My assessment of the controls Apple has already introduced also has evolved. In Privacy Manifests, Fingerprinting, and Apple's Intentions, I noted that I expected the combination of disclosure obligations and restrictions on device signals to impose much tighter

constraints on fingerprinting. Privacy Manifests document data practices, including those of integrated SDKs, and help developers prepare accurate App Store disclosures. Required Reasons APIs, on the other hand, demand an approved justification for accessing specific functionality, with the resulting data to those permitted purposes. By December 2025, when I published Does Apple Police Fingerprinting, I had changed my mind. These requirements could establish a level of transparency and restrict enough device information that Apple accepts the remaining lower-resolution measurement environment as consistent with its practical objectives. That interpretation does not demand that Apple endorse IP-based identity. It would never do that. But per my Privacy Shuffle series, my current view is that the controls already implemented may represent the extent of the fingerprinting restrictions Apple intends to implement combined with the regulatory pushback on ATT, I think the company may have gone as far as it's willing to go. This brings us back to the age of the pixel and the significance of moving beyond its dependence on the browser. Pixels have supplied behavioral feedback data since the '90s and the economic

value of learning from an advertiser's customers is well established. CAPI changes the durability of that connection. An advertiser can transmit conversion information directly from its own systems to the platform servers outside of the purview of browsers and operating systems. That architecture can sustain behavioral advertising across different kinds of addressable media provided the platform can secure the integrations and interpret the data productively. Retailers retain an advantage within the domains they observe directly while large and open-ended media platforms can aggregate behavioral data sourced directly from their advertisers. This is why everything can remain an ad network even as scale becomes more consequential. And it's why I regard CAPI as a revolutionary development in the landscape of the digital economy. CAPI makes the capacity to secure and use direct conversion connections a central component, possibly the most consequential component, of advertising competition extending commercially informed targeting into more media while concentrating the benefits within the platforms that can achieve the broadest participation.

[music]