iOS 27 Blocks Named Ad Tech Domains

What Changed

According to AdExchanger, iOS 27 expanded an existing WebKit policy of unconditionally blocking domains used for cross-site identity matching.¹ Safari, and every other iPhone browser built on WebKit, now refuses requests to a set of ad tech and identity domains.

A bug report filed with WebKit by The Trade Desk lists the domains affected: its own ad request and delivery domain, adsrvr.org; the domain for Unified ID 2.0, the identity initiative it backs; and domains used by ID5, LiveRamp, Permutive and Audigent.² The Trade Desk says adsrvr.org serves ads rather than identity and has asked for it to be removed from the list.^2,3 Its report includes a test in a normal Safari session where its bids were blocked while Google's went through.¹

On October 2, AdExchanger reported, citing two sources, that the short list had been replaced by a remotely updated one covering hundreds of companies, including customer data platforms, ad tech and martech vendors, data sellers and ID graph operators.⁴ The full list is held in a private repository. Because it is fetched remotely, Apple can add or remove companies without an iOS update, and companies may not know they are on it.

On October 5, Apple's WebKit privacy lead, John Wilander, posted on the bug report that a new iOS 27.2 beta had been released, and The Trade Desk said it could see the changes.² On October 9 he marked the report resolved.² According to AdExchanger, the beta removes adsrvr.org from the list.⁵ In hindsight the block seemed aimed at The Trade Desk's cookie-matching subdomain, but Safari blocks whole domains, so it took out ad serving too.

The fix reaches users only when iOS 27.2 is released; until then, iPhones on iOS 27 still block The Trade Desk's ads. The identity domains, including those of UID2, ID5, LiveRamp, Permutive and Audigent, remain blocked.⁵ Apple has not published its criteria for the list.

Why It Mattered

Every earlier step restricted techniques: identifiers, cookies, storage, fingerprinting. Any company could comply by changing how it worked. A list of named companies restricts who may operate in Safari at all, and is decided by Apple.⁶

For advertisers, blocked vendors can't serve ads or collect data in Safari on devices running iOS 27. Agency buyers told AdExchanger that some iOS 27 impressions bought through The Trade Desk were won and paid for but never rendered.⁵ Identity matching is the larger loss: marketers rely on LiveRamp, UID2 and similar identifiers to connect streaming, mobile and web activity, and those links no longer work in Safari on iOS 27. Questions about why some companies are blocked while others, including Google, appear not to be, are likely to reach competition regulators.