Apple iOS 27 Safari Blocklist: Should Programmatic Buyers Worry?

Apple released iOS 27 on September 14, 2026. Within days, The Trade Desk’s ads stopped loading in Safari on updated iPhones. Several identity and data vendors were also affected. Apple has since explained the change and partly reversed one part of it, while keeping the rest in place.

But there’s no reason for programmatic players to panic just yet. The block targets specific domains, not programmatic advertising as a whole. Several alternative approaches, including contextual targeting, publisher first-party data and server-side identity calls, are already available.

This article breaks down what’s confirmed, what’s still being reported, and what media buyers should check in their own campaigns to understand the actual impact.

TL;DR

• iOS 27 and Safari 27 block network requests to certain domains linked to identity resolution and data vendors, including Unified ID 2.0 (UID2), ID5, LiveRamp, Permutive and Audigent.
• The Trade Desk’s ad request and delivery domain, adsrvr.org, was also caught in the block. Apple later removed it from the blocklist in an iOS 27.2 beta. However, users will benefit from this fix only when that version is officially released.
• Apple says the change targets companies that turn email addresses collected during login or sign-up into persistent identifiers. These identifiers help recognize the same person across different websites.
• Aditude data shows that WebKit browsers account for 30% of its customers’ ad impressions. It also reports that eCPMs have fallen by 4% on iOS and 11% on Macs.
• Buyers should track Safari delivery, bid rates and match rates separately for each OS version before assessing campaign performance.

What did Apple change in Safari with iOS 27?

With iOS 27, Safari and WebKit block network requests to a list of third-party domains that Apple has classified as identity resolution services. These services combine different pieces of information about a person, such as email addresses, phone numbers, IP addresses and device details. They use this information to recognize the same person across websites and devices. Apple published an explanation on October 19, 2026, after a month of silence while the advertising industry tried to understand what had happened. Apple’s explanation mainly focuses on email addresses collected when people log in or sign up.

Which companies and domains are affected?

On September 21, Ian Meyers, a senior director of engineering at The Trade Desk, filed a bug report with WebKit. The report listed nine blocked entries. Based on report, these domains are linked to the following companies and services:

AdExchanger has also reported that Apple’s blocklist could eventually cover hundreds of vendors through a remotely updated list. However, this report is based on information from two unnamed sources, and Apple has not published the full list.

Why did The Trade Desk’s ads stop loading?

Safari blocks requests based on domains. The Trade Desk said that adsrvr.org is its main domain for handling ad requests and delivery, not an identity domain. During a test on a Yahoo page, Safari blocked The Trade Desk’s bids while allowing Google’s bids to go through.

In early October, Apple partly restored The Trade Desk’s ad server. However, UID2 and the other identity vendors remained blocked. Apple has not confirmed whether The Trade Desk’s domain was blocked intentionally or added by mistake.

How much programmatic traffic runs on WebKit?

According to data from Aditude’s publisher customers, WebKit-based browsers account for 30% of ad impressions and 28.5% of ad revenue. WebKit is used by Safari across all platforms. It also powers every browser on iPhones and iPads. This means Chrome on iOS is included in these figures as well. These figures come from one publisher-side dataset. The actual share of WebKit traffic can vary depending on a publisher’s audience.

What has the block cost publishers so far?

For devices where the update has been installed, the same report says that eCPMs have fallen by 4% on iOS and 11% on Macs. Revenue per ad opportunity has also dropped by 6% and 20%, respectively. The overall impact is still limited because only a small share of ad impressions currently comes from devices running the new WebKit version.

However, reports state that adoption was increasing quickly and that new iPhone purchases during the holiday season could push it higher. Some publishers have reported no impact so far, particularly those that rely more on subscriptions than advertising for revenue.

Does this affect Chrome, Android or Connected TV?

The reported block applies to WebKit on Apple’s operating systems. Chrome on Android and Connected TV inventory are not affected by this reported change. However, all browsers on iOS must use WebKit. This means Chrome and other browsers on iPhones are affected in the same way as Safari. WebKit’s statement says the change also covers iPadOS, macOS and visionOS 27.

How is this different from App Tracking Transparency?

App Tracking Transparency (ATT), introduced in 2021, restricted the use of Apple’s device identifier unless users gave their consent. The new Safari block works differently. Instead of asking for user consent, it blocks requests to specific domains. As a result, some vendors can lose access to parts of their business altogether.

Does this mean programmatic advertising no longer works on Safari?

No. The reported block targets specific domains, not programmatic advertising as a whole. Ad servers, exchanges and SSPs that do not depend on cross-site identity are not the intended targets. The impact is also narrower than it first appeared. Apple partly restored The Trade Desk’s ad server in early October. Safari was already a restricted environment for tracking, as Apple’s Intelligent Tracking Prevention has limited cross-site tracking there since the late 2010s. Some publishers also say they never expected much revenue from tracking on Safari anyway.

There are several alternatives available today, including contextual targeting, publisher first-party data and server-side identity calls. The main concern is how widely the block will affect the industry as more devices adopt iOS 27. Adoption is still at an early stage, so current results may not show the full impact once more Apple devices are updated.

What should media buyers check now?

Media buyers can get a clearer picture of the impact by checking four things:

1. Compare DSP delivery and spend by browser and OS version
Look at the data from September 14 onward. If Safari impressions on iOS 27 have dropped while spend has shifted to other browsers, it could be linked to the reported block.

2. Check audience match rates
Compare match rates for UID2, ID5 and RampID audiences on Safari against other browsers to see whether identity matching has been affected.

3. Review your dependence on third-party audience segments
Check how much each campaign relies on these segments and test alternatives such as contextual targeting and publisher first-party data. Digiday cites OpenX data showing that the share of U.S. ad spend using third-party audience data fell from 78% in 2022 to around 40% in 2025.

4. Check with your SSP and publisher partners
Find out whether their identity calls run client-side (within the browser) or server-side (outside the browser). This will help you understand whether their setups are affected by the block.

Is this connected to Apple’s own advertising business?

Some industry sources suspect there could be a connection, particularly as Apple’s ad revenue is forecast to grow. However, Apple has not made any such statement, and no source has provided evidence of this being the company’s intention. For now, this remains an open question rather than a confirmed finding.

FAQs

What is WebKit?

WebKit is Apple’s browser engine, which is the technology used to run web browsers. Safari uses WebKit, and Apple requires all browsers on iOS to use it.

What is UID2?

Unified ID 2.0 is an identity framework backed by The Trade Desk. It uses hashed or encrypted email addresses or phone numbers to help recognize users across websites and devices.

What is identity resolution?

Identity resolution is the process of matching different data points, such as email addresses, IP addresses and device details, to recognize the same person across websites and devices.

Is The Trade Desk still blocked on Safari?

Yes, on devices running iOS 27, until the removal of adsrvr.org is included in an update released to users. Check the latest iOS release status for the current position.

Does the block affect Chrome on Android?

No. The reported block applies to WebKit on Apple platforms, not Chrome on Android.

Can Apple add vendors without an iOS update?

According to sources, yes. Apple can update the list remotely without requiring users to install a new iOS version.

Final Takeaway

The confirmed facts are fairly specific: Apple blocks certain identity and data domains in WebKit, The Trade Desk’s ad server was caught in the block and later partly restored, and early publisher data shows lower eCPMs on devices where the update has been installed.

Other claims, such as the possibility of hundreds of blocked vendors and Apple’s reasons for making the change, have been reported but are not yet backed by public documentation.

For media buyers, the next step is to measure the impact rather than make assumptions. Track WebKit traffic by OS version, compare identity match rates and reduce dependence on browser-side identity wherever possible. The impact could increase as more devices adopt iOS 27.