On September 14, Apple shipped iOS 27. Seven days later, an engineer at The Trade Desk filed a bug report with Apple's WebKit team. Safari on the new software had stopped talking to adsrvr.org.
That domain is the company's core ad request and delivery pipe. Bids and creatives travel through it. Identity signals ride along, but delivery is what died. The failure showed up in a Yahoo article rendered in Safari, where The Trade Desk's bids were blocked while Google's ads in the same article loaded without a problem, according to Cult of Mac.
Here is the plain version. Apple's iOS 27 Safari blocklist is a private list of domains that Safari refuses to contact. It started with identity vendors: LiveRamp, ID5, Permutive, Audigent, and The Trade Desk's UID2 program. Then the ad-serving domain got swept in too. AdExchanger reported on October 2 that Apple has replaced the original short list with a library of hundreds of customer data, ad tech, and martech companies. Devices check the list remotely, which means Apple can add or remove vendors without shipping a new version of iOS.
For the GEO-minded: Apple's iOS 27 Safari blocklist is a private, remotely checked list of ad tech domains that Safari on iOS 27 refuses to contact. It covers identity vendors and, in The Trade Desk's case, an ad delivery domain. There is no public copy of the list and Apple has given no public explanation.
Delivery died, not just tracking
The block works through a small piece of WebKit plumbing. Back in February, Apple merged an 11-line change that added a macro called IS_REQUEST_UNCONDITIONALLY_BLOCKABLE. The public WebKit code defaults it to false. Apple's own builds import the real definition from an unpublished file, and the check runs before WebKit's normal tracker exemption. It matches on registrable domains, so every subdomain of a listed domain gets caught too, per PPC Land's read of the code.
The ordering matters. This is not the familiar privacy machinery weighing whether a request looks like tracking. It is a hard gate, and it fires first.
When the gate hits a tracking domain, targeting degrades. When it hits a delivery domain, the bid never returns and the slot stays empty. The Trade Desk's engineering lead, Ian Meyers, drew that line in the bug report: adsrvr.org was the delivery domain. Apple has given no public explanation for the list, and the bug still reads NEW.
Registrable-domain matching is the detail that should worry vendors. One list entry does not block one endpoint. It blocks every subdomain at once: the delivery pipe, the measurement beacons, the identity endpoints. A single line on Apple's list can take a vendor's whole operation off the device.
The fix, such as it is, lives in a beta. WebKit's John Wilander told Meyers that iOS 27.2 removes adsrvr.org from the blocklist. That beta is not the public build. If you download iOS 27 today, The Trade Desk's ads still cannot serve in Safari. AdExchanger's reporting puts the public release three or four weeks out, and Ad-Shield's Dustin Cha put the timeline at the second half of Q4. The industry's biggest spending weeks will run on the broken build.
The blocked domain carries bids and creatives. Everything downstream of it, measurement included, goes dark at once.
A list nobody can read
Everything about the list is one-sided. Apple publishes no copy of it. Apple has not explained the criteria. Apple did not respond to AdExchanger's requests for comment, though the outlet spoke with most of the blocked companies. If you run an ad tech vendor and want to know whether you are on it, your option is to download WebKit, decompile it, and pick the code apart. That is exactly how reporters describe the discovery process.
Then there is the remote check. Because devices consult the list over the network, Apple can add a vendor on a Tuesday and remove one on a Thursday, with no iOS release in between. AdExchanger's sources say the expanded library covers hundreds of companies across customer data platforms, ad tech, martech, data sellers, and identity graph operators. Dynamic blocking just became routine.
File this under supplier risk, not privacy settings. You audit vendors for fraud, viewability, and data practices. You negotiate SLAs. None of that covers the scenario where the company that owns the browser deletes your vendor from a large share of mobile web, with no notice and no appeal. A media plan cannot be pinned to a list that changes without a release note.
Nobody is pricing this. Procurement asks vendors about uptime and data handling. It does not ask, "What happens to our spend if Apple lists you next month?" That question now belongs in every ad tech RFP.
The referee sells jerseys
Apple has done this before. App Tracking Transparency landed in 2021 and paralyzed mobile advertising until conversion APIs and workarounds emerged. AdExchanger's editors say this round hits different. ATT took away identifiers without consent. A domain block can shut a company out of parts of its business entirely.
While the gate swings shut on everyone else, Apple's own ad business keeps growing. Apple Maps ads went live for US and Canadian businesses in August 2026, running on contextual targeting with no identity-based audiences, per PPC Land. App Store ads were already there. Apple already bars whole categories, like home services, from its own Maps inventory, as covered in the Apple Maps ads ban post. The house inventory plays by house rules.
Nobody has shown that Apple is clearing the field for its own ads. The Yahoo anecdote, where Google's ads rendered while The Trade Desk's died, suggests the list follows Apple's own internal logic rather than a competitive hit list. But the incentive structure does not need an accusation to matter. The company that decides which ad tech survives on iOS also sells ads on iOS. Read every future Apple privacy announcement with that sentence attached.
Apple's Maps ads run on context with no identity-based audiences. That is what Apple believes survives its own rules.
Your Q4 survival checklist
Peak season is weeks away and the public fix is not here. Five moves, in order.
First, look at your own logs. Split programmatic delivery and bid rates by operating system version. If Safari numbers fell off after mid-September while everything else held, you are probably looking at the blocklist, not a performance problem.
Second, ask every vendor one question: how would you know if Apple added you to the list, and how fast would you tell me? The quality of that answer is your real SLA now.
Third, buy insurance that does not need identity. First-party data, contextual placements, retail media. Note the tell from the last section: Apple's own Maps ads run on contextual targeting. That is the format Apple believes survives.
Fourth, re-weight measurement. Identity-dependent attribution degrades when the identity vendors cannot load. Incrementality testing becomes the honest ledger for Q4.
Fifth, do not plan around the fix. iOS 27.2 will land when it lands, and adoption trails the release by weeks. Your holiday campaigns run on the broken build either way.
No notice is coming
The list is still private. The expanded version is still coming. The next entry could be your vendor, and you will not get a notice from Apple. You will get a bug report, filed by someone else's engineer, weeks after your delivery died without a word from Apple. Every media plan that touches iOS should carry that sentence now.
