On Monday afternoon, a short comment landed on a WebKit bug ticket that most marketers will never read. “A new iOS 27.2 beta went out today. Please test with it,” wrote John Wilander, who runs privacy and ad tech for Apple’s WebKit team. Fifteen minutes later, The Trade Desk’s Ian Meyers answered that he could see the changes in build 24B5099f and would report back.
That exchange is the closest thing to good news The Trade Desk has had in three weeks. It is also a useful warning for everyone who buys media, because of what it says about who decides which vendors get to reach an iPhone, and how fast that can change.
What actually broke
Apple began rolling out iOS 27 on September 14. Bundled into it was a short list of domains that Safari now blocks outright when a page calls them from another site, and the ticket’s screenshot shows it happening in ordinary browsing, not just Private Browsing. According to the bug report Meyers filed on September 21, the list includes uidapi.com (Unified ID 2.0), id5-sync.com and eu-1-id5-sync.com (ID5), rlcdn.com and pippio.com (LiveRamp), permutive.com, ad.gt (Audigent, now part of Experian) and adsrvr.org.
Most of those are identity and data services. Blocking them fits a decade of Apple policy on cross-site tracking. The last one is different. Adsrvr.org is where The Trade Desk sends ad requests and delivers ads. “Adsrvr.org is The Trade Desk’s core ad request and delivery domain, not identity,” Meyers wrote in the ticket. AdExchanger, which broke the story on September 29, put it bluntly: WebKit had effectively shut a major independent DSP out of Safari inventory on updated devices.
Two technical details make this bigger than one browser on one phone.
First, the check runs on the registrable domain. PPC Land’s walk through the February WebKit commit behind the block shows that the hook receives adsrvr.org, not a specific host, so every subdomain under it is caught. The cookie-sync host and the hosts that carry bids and creative go down together.
Second, on iPhone, every browser is Safari underneath. Apple requires browsers on iOS to use WebKit (with an exception for alternative engines in the EU), so Chrome on an iPhone runs on the same engine. AdExchanger reports the block reaches other iOS browsers too, and Ari Paparo at Marketecture made the same point. Paparo, citing Statcounter, puts the affected surface at roughly a third of US web traffic.
There is one more detail that buyers noticed. Meyers attached a screenshot of a normal, non-private Yahoo article session in which The Trade Desk’s bids were blocked and Google’s went through. AdExchanger editor Allison Schiff was careful to say one example does not prove Apple is picking winners. It does show what the market looks like right now on an updated iPhone: one big DSP can bid, another cannot.
Why a beta does not rescue your Q4 flight
The October 5 comment is worth reading carefully. Wilander asked The Trade Desk to test against a developer beta. Meyers said he could see changes and would test. Nobody has said adsrvr.org is off the list, and the ticket still showed as open. Apple has not explained whether the domain was included by mistake or on purpose.
Even in the best case, look at the calendar. MacRumors and AppleInsider confirm the third iOS 27.2 developer beta shipped on October 5. MacRumors expects the public release shortly after the iPhone Duo arrives on October 23, which is a reasonable read but not an Apple date. After that, people still have to install it. Every Q4 flight you are pacing right now buys against the phones people already carry, and many of them will stay on iOS 27 for weeks after any fix ships.
So if your programmatic plan runs through The Trade Desk, treat mid-September until a public fix ships, and gets installed, as a period with a known hole in iPhone web delivery. The pacing algorithm will not leave the money unspent. It will push it to the impressions it can win, which means more Android, more desktop Chrome, more CTV, more in-app. Your reach report may look healthy while the audience underneath it has shifted. If your best customers skew toward iPhone owners, that shift matters more than any CPM change.
The list itself is the bigger change
The Trade Desk fix, if it comes, solves one domain. The structural news arrived on October 2, again from AdExchanger. Citing two sources with direct knowledge of the WebKit updates, James Hercher reported that the original short list has been replaced by a much longer library covering hundreds of CDPs, ad tech and martech companies, data sellers and ID graph operators. Devices reportedly check a remote list, so Apple can block or unblock a vendor without shipping an iOS update. Vendors may not even know whether they are on it.
That reporting comes from one outlet and anonymous sources, and Apple has not confirmed it. But the direction fits the public record. The February commit puts the real list in an Apple-internal file the open-source code cannot see. Whatever the final scope, the practical effect for a marketer is the same. Whether a vendor in your stack can reach an iPhone browser is now a variable you do not control and may not be told about.
Schiff drew the line that matters for budgets: “One limits what a company can know. The other limits whether it can operate.” Marketers spent the last five years adapting to the first kind of loss. Safari killed third-party cookies, App Tracking Transparency gated the ad ID, match rates fell, attribution became modeling. That was painful, but the pipes stayed connected. A delivery block is the second kind. The bid never leaves the phone, and nothing in your platform report says why.
Where this hits a marketing team
Start with media. If you buy through The Trade Desk, directly or through an agency, the first question is how much of your audience is iPhone web and how much of that disappeared after September 14. Search Engine Watch suggested the right cut for publishers, and it works for buyers too: separate iOS 27 Safari from older Safari versions and from other browsers, then look at the trend. A drop that is concentrated in iOS 27 Safari is the block. A drop everywhere is something else.
Then identity. UID2, RampID, ID5 and Permutive are the plumbing behind a lot of addressable buys and publisher audience deals. If those calls cannot fire on updated iPhones, you may be paying an addressability premium on Safari traffic that cannot carry the signal. Ask each identity and data vendor for its iOS 27 numbers in writing. If the answer is vague, that is information too.
Then measurement, which is where most teams will feel it without knowing it. Your tag manager is full of third-party pixels and beacons. Some feed attribution, some build audiences, some sync IDs. If one of those vendors lands on the list next month, the request fails silently on iPhone browsers, the platform reports fewer conversions, and someone in a budget meeting concludes the channel got worse. The Analytico consultancy published a useful pattern for this on October 4: write a first-party server receipt for every revenue event before it goes anywhere else, then compare client attempts, receipts and backend orders, segmented by iOS version. The backend count is the denominator, not the platform’s number. You do not need to hire anyone to do that. You need a data engineer and an afternoon.
Finally, contracts. Most media and data agreements cover viewability, invalid traffic and brand safety. Very few say anything about a platform-level block that takes a vendor offline in one browser for a month. Q4 renewals are a good moment to add notice and makegood language for exactly that case.
What not to do
Do not move everything to Google because of one screenshot. The Yahoo example is one session, AdExchanger was still checking whether any Google domain sits on the expanded list, and Apple has given no reason why one delivery domain was listed and another was not. Concentrating spend in the platform that happens to be unaffected this month trades one exposure for a bigger one.
Do not rebuild your entire tracking setup server-side before you test. Server-side routing can forward events your own endpoint already received. It cannot recover a request the browser never sent, and it will not restore a vendor’s ability to serve an ad. Spend engineering time on the paths that carry revenue and have no independent record.
And do not wait for the trade press to tell you whether your vendors are on the list. If the reporting is accurate, the vendors themselves may not know.
What to do this week
Pull last month’s delivery and conversion data split by OS version and browser, with September 14 marked on the chart. Look at iOS 27 Safari separately. If you run programmatic through The Trade Desk, ask your rep or agency for iOS 27 Safari delivery since mid-September and where the pacing moved that money.
List every third-party domain your site and campaigns call from the browser: DSP pixels, identity syncs, CDP and data partners, audience tags. Next to each, write what breaks if it disappears on iPhone and whether you have a first-party record of the same event. That list is your exposure map. It takes a few hours.
For every revenue event (purchase, lead, trial start), make sure your own server writes a receipt before forwarding anything to ad platforms. Start a weekly reconciliation of receipts against backend orders, split by iOS version. If the gap opens on iOS 27 and nowhere else, you will see it within a week instead of at month-end.
Email your identity and data vendors and ask three things: whether they are affected on iOS 27, whether they know their status on Apple’s list, and what they will tell you if it changes. Put the answers in the renewal file.
Then write one line into your Q4 plan that was not there last month: browser-level vendor blocks are a planning risk, owned by a named person, checked weekly. Apple may well clear The Trade Desk in 27.2. The next domain on the list will not come with a bug ticket you can read.
