Safari's iOS 27 blocklist hit The Trade Desk and the identity vendors. Which of your programmatic line items lost what?

KEY TAKEAWAYS

1. Delivery, identity and browser measurement are three losses with three different lifespans.
2. The Trade Desk's delivery block ends when devices reach iOS 27.2. The identity block stays and grows with adoption.
3. Ask for won versus rendered impressions by OS version. Valid impressions count on begin to render.
4. ID-matched line items lose Apple reach without losing spend, so watch audience mix, not delivery totals.

Since iOS 27 began rolling out on 14 September 2026, Safari has refused connections to a short, private list of ad tech domains. For a programmatic buyer that is three problems with three lifespans. One is about to end, one is permanent and one has mostly not happened. Sort them before you move budget.

What did Apple block, and what has it said?

The list became public through a WebKit bug that Ian Meyers of The Trade Desk filed on 21 September. It named nine domains. One is a test entry. Seven belong to identity and audience services: Unified ID 2.0 (uidapi.com), ID5 (two domains), LiveRamp (rlcdn.com and pippio.com), Permutive and Audigent. The last, adsrvr.org, carries The Trade Desk's ad requests and ad delivery. Apple has not confirmed the list.

PPC Land traced the mechanism to an 11-line WebKit change merged on 13 February 2026. It matches the registrable domain, so every subdomain is caught too.

On 19 October Apple explained the policy on the WebKit blog. As PPC Land and Relevant Audience report it, Safari and WebKit in iOS, iPadOS, macOS and visionOS 27 now block network access to third parties that turn email addresses collected at login or sign-up into persistent tracking IDs. The post names no company, publishes no list and does not mention The Trade Desk.

The block lives in WebKit, so it is not only Safari. Unified ID 2.0's documentation says the uidapi.com block applies to all browsers on iOS 27, Chrome included, and to Safari on macOS 27.

Is this one problem or three?

Three. They hit different line items and last for different lengths of time.

Delivery. With adsrvr.org blocked, The Trade Desk could not serve ads in Safari on updated iPhones and iPads. Meyers called it the company's "core ad request and delivery domain, not identity." AdExchanger later reported that the rule seemed aimed at match.adsrvr.org, the cookie-sync host, and the root-domain match took ad serving down with it. On 5 October Apple asked The Trade Desk to test an iOS 27.2 beta. FASilytics and Mediovsky report the bug was marked resolved on 9 October. Apple released the 27.2 release candidate on 19 October, and MacRumors expects a public release before the end of the month. Until a device updates, it stays blocked.

Identity. The identity domains stay blocked. UID2 changed its documentation on 9 October: in affected browsers its JavaScript SDK cannot load, generate or refresh tokens, and publishers should generate tokens on a server instead. For a buyer, audiences matched through UID2, RampID, ID5 or Permutive segments cannot be recognised on those devices. RTBlint notes the failure is silent. Bid requests still arrive, just without the ID, so a line item that requires UID2 simply does not bid. This loss grows as people update.

Browser measurement. Less damage than feared. Laurent Fidahoussen of FASilytics tested 15 hosts from a Safari 27.2 beta on macOS. Seven identity hosts failed in under 5 milliseconds, the sign of a refusal inside the browser. Eight went through, including google-analytics.com, ad.doubleclick.net, connect.facebook.net, bat.bing.com, snap.licdn.com and match.adsrvr.org. That is one device and not iOS. It does fit Digiday's test of more than 70 ad tech domains, which found only the first handful blocked.

Was the delivery block a mistake?

The sources split. The Trade Desk's case, echoed in Cult of Mac's headline, is that a delivery domain was caught by a rule meant for identity. Jay Friedman of Cartograph told Digiday the move was clearly no mistake. Andrew Casale of Index Exchange asked whether the 27.2 change is a restoration or an admission of error.

The record supports a split answer. Apple's post defines the target as identity resolution. The delivery domain came off in a beta. The identity domains did not, and UID2 rewrote its guides around a lasting block. Plan as if delivery is temporary and identity is policy.

Two disputes remain open. First, AdExchanger reported on 2 October, citing two unnamed sources, that a far larger list covering hundreds of vendors can be updated remotely. Digiday reported on 7 October that the remote-update code had not shipped. FASilytics points to a 25 September change that moves the list into a rule list updated outside OS releases. Assume the list can change without an iOS update. Second, TAGGRS's July review of the Safari 27 beta reported that Bing's tracking domain was blocked by IP range. FASilytics could not reproduce that on 27.2. Test your own tags rather than trust either.

How exposed is each line item?

Use one product per line item:

Exposed share = Apple web share × version 27 share × dependence

Apple web share is the share of the line item's impressions served in browsers on iPhone, iPad and Mac. Take it from your DSP's browser and OS report, not from a market chart. Published figures use different bases. FASilytics cites StatCounter at 18.27% of worldwide browser use in September 2026. Aditude's publishers saw Safari on iPhone and iPad carry 11.7% of impressions, per Digiday.

Version 27 share is the share of those impressions on version 27 or later. It is small for now. Aditude estimated about 8% of users had updated by 12 October. It will not stay small. Apple's own count put iOS 26 on 79% of all iPhones by 7 June 2026.

Dependence is 1 for Trade Desk delivery before 27.2, 1 for an audience matched only through a blocked ID, and close to 0 for contextual buying.

The same arithmetic settles a small dispute about size. Aditude put the publisher revenue hit at about 1%. Mediovsky multiplied Aditude's own inputs and got about 0.1%, reaching 1% only at full adoption. Both can be right. The first describes where this ends up, the second where it is today.

Did you pay for ads that never showed?

Possibly. Two agency buyers told AdExchanger that Trade Desk win logs included iOS 27 impressions that never rendered. Whether anyone paid depends on contract terms along the chain from publisher to SSP to DSP to advertiser.

The counting standard helps you here. The IAB, MRC and MMA guidelines finalised in 2017 count a valid impression when the ad begins to render, and dropped the notion of a served impression. An ad blocked before it began to render does not meet that bar. Ask for won and rendered counts split by OS version, and check them against your verification vendor's measured impressions.

A worked example

The numbers here are hypothetical. An advertiser ran three Trade Desk line items from 14 September to 19 October:

• A: retargeting on a UID2 and RampID audience, $20,000.
• B: contextual open web, $25,000.
• C: connected TV, $15,000.

For A and B, 35% of impressions were in Apple browsers. Across the period, an average of 6% of those were on version 27. Delivery exposure for the web lines is 35% × 6%, or 2.1% by our arithmetic. That is $420 on A and $525 on B, $945 in total, to check against rendered counts. None of the reports we read covers connected TV apps. Check C's logs anyway.

Once 27.2 is installed, B's exposure falls to near zero, because contextual buying needs no ID. A's does not. At 8% adoption, 2.8% of A's impressions cannot be matched. If version 27 reaches the 79% that iOS 26 reached by June, 35% × 79% is about 28%. Spend will not fall by that much. The line item will re-pace onto users it can still match, mostly outside Apple browsers. Apple reach falls, frequency elsewhere rises, and the delivery report still looks full.

Which line item needs which action?

A seven-step audit

1. Pull the split. Export impressions by browser and OS version for each line item from 14 September. Record the Apple web share.
2. Label dependence. Mark each line item contextual, ID-matched, partner-matched CRM, site-tag retargeting or connected TV.
3. Query unrendered wins. Ask The Trade Desk for won versus rendered impressions by iOS version. Compare with your verification vendor and raise the gap under begin-to-render counting.
4. Test your tags. Load a blank local page in Safari 27 that calls each host cross-site. A refusal within a few milliseconds is the browser, not the network. This is the FASilytics method.
5. Get partner plans in writing. UID2 has published one, server-side token generation. Ask every other identity partner whether its route still needs the browser to reach a listed domain.
6. Watch the mix weekly. A falling Apple share on ID-matched lines with flat spend is the sign of silent loss. Rebuild from a baseline rather than the broken report, as we did when ChatGPT traffic showed up as Direct.
7. Judge moves with a holdout. Attribution paths now miss updated Apple users. Use a geo test before shifting budget between DSPs or tactics.

Where the evidence stops

Apple has published no list and no criteria for choosing domains. The only measured loss figures come from one publisher vendor, reported without sample or method. No buyer-side study of reach or frequency exists yet. The plain reading is the safe one: delivery is coming back, identity is not, and your own logs are the only exposure figure that counts.

Identity rented from third parties is getting harder to use. Signals a brand owns are not. If you want to see how we measure brand presence in AI answers, join the waitlist.

Questions

What does the iOS 27 Safari blocklist block?

Network requests to a private list of domains. A WebKit bug filed by The Trade Desk named nine: a test entry, seven tied to identity services such as Unified ID 2.0, ID5, LiveRamp, Permutive and Audigent, and The Trade Desk's ad server, adsrvr.org. Apple's 19 October post says it targets third parties that turn emails into tracking IDs.

Can The Trade Desk serve ads in Safari again?

On devices running the iOS 27.2 beta, yes. Apple asked The Trade Desk to test a 27.2 beta on 5 October and the bug was marked resolved on 9 October. The release candidate came out on 19 October. Devices on earlier iOS 27 builds stay blocked until they update.

Are Google Analytics, Meta and Google Ads tags blocked by Safari 27?

Not in the one published test. Fasilytics found google-analytics.com, ad.doubleclick.net, connect.facebook.net, bat.bing.com and snap.licdn.com went through on a macOS 27.2 beta, while seven identity hosts were refused. It was one device and not iOS, so test your own tags.

How do I work out how exposed a programmatic line item is?

Multiply three shares. The line item's impressions in Apple browsers, the share of those on version 27, and how much the line item depends on a blocked domain. Contextual buying scores near zero. An audience matched only through UID2, RampID or ID5 scores one.

Sources

1. PPC Land, Safari 27 blocks The Trade Desk's ads via 11 lines WebKit merged in February ppc.land
2. PPC Land, Trade Desk to test iOS 27.2 beta as Safari ad-domain ticket stays open ppc.land
3. PPC Land, Safari 27 blocks identity firms that turn email addresses into tracking IDs ppc.land
4. PPC Land, Safari 27 blocks LinkedIn and Bing ad trackers by IP address ppc.land
5. Relevant Audience, Safari 27 blocks identity resolution. What Apple said relevantaudience.com
6. AdExchanger, Apple's Latest Operating System Blocks The Trade Desk From Serving Ads On Safari adexchanger.com
7. AdExchanger, Apple Has Far-Reaching Plans To Block Hundreds Of Programmatic Data Companies From iOS adexchanger.com
8. AdExchanger, How Data And Ad Tech Vendors Are Preparing For The iOS 27 Fallout adexchanger.com
9. Digiday, Ad industry tallies early losses from Apple's Safari tracking block digiday.com
10. Digiday, Apple's secret blocklist is the talk of Advertising Week New York digiday.com
11. Unified ID 2.0, Client-Side Integration Guide for JavaScript unifiedid.com
12. Unified ID 2.0, SDK for JavaScript Reference Guide unifiedid.com
13. Unified ID 2.0, Documentation Updates unifiedid.com
14. FASilytics, Safari 27 Blocks Adtech Domains at the Network Layer fasilytics.fr
15. TAGGRS, Safari 27 tracking protection. What it means for conversion measurement taggrs.io
16. IAB, IAB, MRC and MMA Propose Updates to Ad Measurement Guidelines iab.com
17. Marketing Dive, Focus shifts from served to rendered for counting mobile impressions marketingdive.com
18. Mediovsky, Safari 27 eCPM impact. How to calculate your exposure mediovsky.com
19. RTBlint, Safari 27 can shrink user.eids on web bid requests while impression counts stay flat rtblint.org
20. MacRumors, Apple Releases iOS 27.2 Release Candidate macrumors.com
21. MacRumors, Apple Reveals How Many iPhones Were Running iOS 26 Before WWDC macrumors.com
22. AppleInsider, Apple's escalating crackdown on ad vendors is catching some innocent victims appleinsider.com
23. Cult of Mac, iOS 27 Safari update reportedly blocks ad vendors by mistake cultofmac.com
24. PPC Land, ID5 faces Apple's iOS 27 Safari block as CEO says regulators should look ppc.land

NEXT STEP

See where your brand stands.

Your Digital Authority Score, who AI recommends for your target questions, and the placements that close each gap. Your first report is free.

Get your free report →