The iOS 27 Safari ad blocking story started on September 21, when The Trade Desk filed WebKit bug 324771. Safari on updated iPhones was refusing network requests to nine domains. One was adsrvr.org, which the company's engineering lead, Ian Meyers, called its core ad request and delivery domain. Not a tracking pixel. The pipe the ads come through.
AdExchanger confirmed the block on September 29. On October 2 it reported, citing two anonymous sources, that the original list had been replaced by a longer one Apple's devices call on remotely, covering hundreds of ad tech, martech and data companies. Apple has announced none of it. On October 5, its WebKit team asked The Trade Desk to test an iOS 27.2 beta that appears to unblock adsrvr.org.
Tidy ending. Bug filed, bug fixed, everyone goes home. That reading is wrong, and the reason matters more than the fix.
TL;DR
- Safari on iOS 27 blocks the network request itself, not the cookie. A listed domain fails before any exemption logic runs, and every subdomain fails with it.
- The nine entries in bug 324771 map to The Trade Desk, Unified ID 2.0, LiveRamp, ID5, Permutive and Audigent, plus a placeholder. AdExchanger's sources say the list now covers hundreds of vendors and updates remotely. Apple has not confirmed that.
- No Google domain is on the list. In one Yahoo session The Trade Desk shared, its bids died in Safari while Google's went through.
- iOS 27 was roughly 3% of US mobile iOS traffic in September, per StatCounter, while Safari is about 46% of US mobile browsing. That gap is your grace period, not your all clear.
- The failure is silent. Buyers told AdExchanger that win logs show iOS 27 impressions that never served, meaning advertisers paid for ads nobody saw.
A Blocklist You Cannot See, Appeal, or Get Notified About
PPC Land traced the enforcement hook to a WebKit pull request merged February 13, 2026. Eleven lines in a file called WebPrivacyHelpers.mm. In the public source, the macro deciding whether a request is unconditionally blockable returns false for everything, so nothing appears to happen. Apple's internal builds supply the real list.
App Tracking Transparency, in 2021, was at least published. You could read it, hate it, build around it. Every agency did.
This is a different object. No document. No list to check your vendors against. No process for arguing that your domain delivers ads rather than tracks identity, which is what The Trade Desk spent two weeks doing in a ticket marked priority P1 with an assignee of "Nobody."
Whether or not the remote list AdExchanger describes is live, the hook is permanent. The patch covers one domain. The switch stays in the code, and Apple decides what it covers.
Why iOS 27 Safari Ad Blocking Is Worse Than the 3% Suggests
Today's damage is small, and AdExchanger reads it the same way. Then extend the line. Safari is about 46% of US mobile browsing, per StatCounter, about a point behind Chrome. Apple's point releases land every few weeks, and vendors told AdExchanger that iOS 27.2 alone may take three to four weeks to reach live installs. The iOS 27 install base in January will not be 3%.
You are not looking at a current loss. You are looking at a dated bill. One of those needs a refund conversation. The other needs an architecture change, ideally toward a funnel that does not depend on one channel, and you have about a quarter to make it.
Google Wasn't on the List. That Is Not Good News.
Meyers shared a Yahoo session where his company's bids were blocked while Google's went through. Nobody has shown Apple is deliberately protecting Google, and we do not know why the lists differ. Apple has never published criteria.
The effect is clear enough. The independent identity and measurement vendors on that list just became unreliable on updated iPhones. The two platforms that need no third-party domain to deliver or measure did not. If you followed what Google actually announced at Marketing Live 2026, you know where that leaves the walled gardens. If your plan for reaching customers outside Google and Meta ran through programmatic display, it now has a dependency Apple controls.
The Failure Mode Is a Bad Month, Not an Error Message
When a request is blocked, nothing breaks visibly. The page loads. The campaign stays live. The dashboard still renders a number. The number is just lower, and you read it as soft demand, weak creative, or a slow October.
Two agency buyers told AdExchanger, on background, that The Trade Desk's win logs show iOS 27 ads that were bought and clearly did not serve. Whether anyone recovers that money depends on contracts between publishers, exchanges and demand platforms, which is a polite way of saying probably not.
Search Engine Watch proposed the right diagnostic. Compare Safari 27 delivery against older Safari and against Chrome. A browser-version-shaped hole is delivery. A flat decline everywhere is demand.
What To Do This Week
Most businesses we talk to in Boca Raton do not buy from a demand-side platform directly. They buy a programmatic display package from a local media rep, running on somebody else's platform, rarely named in the proposal. So the exposure is not in your tag manager. It is in a contract. Your leverage is that you are the one being invoiced.
- Inventory the third-party domains your site loads. Open your site in desktop Chrome, go to DevTools, Network tab, reload, sort by domain. Flag anything that is not yours, Google, or Meta, and look for adsrvr.org, id5-sync.com, rlcdn.com, pippio.com, permutive.com, uidapi.com and ad.gt. Ask whoever installed each what happens when Safari drops the request.
- Send every media partner the same two questions, in writing. Which demand-side platform does my inventory run through, and can you send delivery and conversion numbers for the last 30 days split by browser and iOS version? A partner who cannot answer the first in a day cannot tell you whether you paid for impressions that never rendered.
- Move conversion measurement off the browser. Server-side tagging, the Meta Conversions API and Google Ads enhanced conversions report from your server rather than from a request Apple can refuse. It is the only item here that is permanent instead of defensive, and buying the tool is not shipping the system.
FAQ
Are my Google Ads and Facebook ads blocked on iPhones?
Not by anything reported so far. None of the nine domains in WebKit bug 324771 belong to Google, Meta, or a standard analytics product. The block hit independent demand-side platforms and identity vendors including The Trade Desk, LiveRamp and ID5. If Google and Meta are your only paid channels, nothing public shows your delivery being blocked.
Do I need to do anything if I only run Google and Meta?
Two things. Check what else loads on your website, because identity and data platform scripts get installed by vendors and then forgotten. And move conversion measurement server-side, because browser-based measurement now sits on infrastructure a browser maker can switch off without notice.
Should we wait for iOS 27.2 before changing anything?
No. The beta appears to unblock one domain belonging to one company, it had not reached general release as of October 8, and vendors told AdExchanger it may take three to four weeks to reach users. The blocking mechanism itself is still shipping.
The Real Takeaway
Apple did not break programmatic advertising this month. It demonstrated that it can: selectively, without notice, without saying who is on the list.
That is a dependency story, not a privacy story. Every piece of your marketing that runs through a domain you do not own is rented, and the landlord does not publish the rules. That is the operations shift behind all of this.
Book a 30-minute strategy call. No pitch, just a straight read on how much of your measurement sits on domains you do not control. Get a free strategy call.