Online advertising is under siege from an unlikely coalition of privacy campaigners: Apple and European regulators. The only long-term solution may be for websites to be more explicit about how they make money from customer data.

Citing privacy concerns, Apple launched a feature on its Safari browser in September called Intelligent Tracking Prevention, which limited the use of cookies to track users’ browsing histories. These cookies are heavily used by ad-tech companies, which maximize the value of online ads by matching them with internet users most likely to click on them.

Alphabet and Facebook dominate this business, with 84% of all digital-ad spending outside China, according to WPP media agency GroupM. For them, however, the impact of the Safari update will be cushioned by their daily contact with consumers. Apple only blocks intermediaries from planting cookies; website owners like Google and Facebook can still use them to track users, including during a 24-hour period after they leave their sites.

The big victims of Apple’s move are therefore independent ad-tech players, particularly Paris-based Criteo. It specializes in so-called retargeting: showing ads to consumers who have already looked at a product online. Its Nasdaq-listed shares, previously among the best performers in a sector with more than its fair share of dogs, have more than halved since the start of June, when Apple announced the update.