Apple blocks requests to identity providers, including UID2, ID5, LiveRamp, Permutive and Audigent, starting with iOS 27 on 2026-09-14. WebKit confirmed the Apple identity block on 2026-10-19 for Safari on iOS, iPadOS, macOS and visionOS 27. The Trade Desk's ad delivery domain was on the block list and is released in the iOS 27.2 beta. Apple has not published the list.
Few readers run iOS 27 yet, so the revenue hit so far is small and the early numbers disagree. Use the time to measure, test and fix.
This is Beeler.Tech's reading of the sources below, and it changes as the story does. Steps 3 and 6 draw on recommendations from Daniel B. Rosenzweig of DBR Tech Law, used with his permission. Not legal advice.
Daniel B. Rosenzweig of DBR Tech Law recommends reviewing whether test results call for changes to privacy notices, vendor disclosures or consent settings (not legal advice).
From Daniel B. Rosenzweig, Founder and Principal Attorney, DBR Tech Law, DBR Tech Law
Keep in mind: From a note to clients, shared by email on 2026-10-20 and used with the author's permission. Not legal advice. The same review applies after a vendor changes its setup.
Daniel B. Rosenzweig of DBR Tech Law recommends checking any vendor workaround against Apple's tracking prevention rules and privacy requirements (not legal advice).
From Daniel B. Rosenzweig, Founder and Principal Attorney, DBR Tech Law, DBR Tech Law
Keep in mind: From a note to clients, shared by email on 2026-10-20 and used with the author's permission. Not legal advice.
Daniel B. Rosenzweig of DBR Tech Law recommends asking vendors whether their domains are affected, what breaks, and whether fixes have shipped (not legal advice).
From Daniel B. Rosenzweig, Founder and Principal Attorney, DBR Tech Law, DBR Tech Law
Keep in mind: From a note to clients, shared by email on 2026-10-20 and used with the author's permission. Not legal advice.
Daniel B. Rosenzweig of DBR Tech Law recommends testing identity and ad workflows in Safari 27 and in native apps built on WebKit (not legal advice).
From Daniel B. Rosenzweig, Founder and Principal Attorney, DBR Tech Law, DBR Tech Law
Keep in mind: From a note to clients, shared by email on 2026-10-20 and used with the author's permission. Not legal advice. He advises checking for blocked requests and whether they break anything.
Daniel B. Rosenzweig of DBR Tech Law recommends that publishers list the identity tools, tags, pixels and SDKs on login, registration and newsletter pages (not legal advice).
From Daniel B. Rosenzweig, Founder and Principal Attorney, DBR Tech Law, DBR Tech Law
Keep in mind: From a note to clients, shared by email on 2026-10-20 and used with the author's permission. Not legal advice. He also advises reviewing the domains those tools contact.
Beeler.Tech recommends that publishers keep personalizing with their own first-party data, which WebKit says is not tracking and leaves in place.
From Beeler.Tech, based on WebKit blog
Keep in mind: WebKit still counts a third party that resolves identity for a single publisher as tracking. One community member expects Apple to go further.
Beeler.Tech recommends that publishers start testing server-side identity now, and treat Trusted Server as a test until it ships a release.
From Beeler.Tech, based on PPC Land
Keep in mind: No publisher has reported results from a server-side setup yet. Server-side work helps but does not fully solve a block like this, one community member said.
Beeler.Tech recommends against counting on a vendor's move to a new domain, because WebKit blocks whole domains and says changed requests will not get through.
From Beeler.Tech, based on WebKit blog
Keep in mind: Vendors that moved domains have called it a temporary fix. Reports that Apple can update its list remotely are unconfirmed.
Beeler.Tech recommends that publishers check which vendors on their pages load from blocked domains, using a network test in Safari 27.
From Beeler.Tech, based on FASilytics
Keep in mind: Apple has not published the list, so a test shows only what is blocked on the day you run it.
Beeler.Tech recommends that publishers measure Safari revenue on Apple 27 devices separately now, while few users have upgraded.
From Beeler.Tech, based on Digiday
Keep in mind: Early numbers disagree. One vendor put the hit near 1% of revenue; a second reading of the same figures gets about 0.1%; several publishers saw no impact.
On 2026-10-13, EMARKETER's Asa Hiken advised advertisers to consider cutting spend on Apple devices until Safari's tracking situation is resolved.
From Asa Hiken, EMARKETER, EMARKETER
Keep in mind: Advice to buyers, not a report that any buyer cut spend. Subscriber article. Its facts on the block come from AdExchanger.
IAB Tech Lab chief executive Anthony Katsur urged publishers on X to move ad requests to Trusted Server, and called it production ready on 2026-10-08.
From Anthony Katsur, IAB Tech Lab, PPC Land
Keep in mind: On 2026-10-10 PPC Land found no published release in the Trusted Server code repository. Tech Lab's Rowena Lam told AdExchanger she expects production tests early next year.
The Trade Desk set up a backup domain, TTDCDN.org, to serve ads if Apple blocks adsrvr.org, AdExchanger reported on 2026-10-20.
From The Trade Desk, AdExchanger
Keep in mind: AdExchanger names no source and gives no exact date. It says the domain came soon after its 2026-09-29 report. Event date is the publish date. A source familiar with Permutive called new domains a temporary fix. The Trade Desk is an In View client.
WebKit's 2026-10-19 post says the block covers iOS, iPadOS, macOS and visionOS 27. The Trade Desk's bug named only iPhone and iPad.
From WebKit (Apple), WebKit blog
Keep in mind: The post gives no dates per platform. One independent test found the block running on macOS 27.2 (see ST-046).
On 2026-10-19, WebKit published a blog post that explains why Safari 27 blocks identity providers.
From John Wilander, Charlie Wolfe and Matthew Finkel, WebKit (Apple), WebKit blog
Keep in mind: The post names no companies and does not publish the list.
On 2026-10-09, WebKit's John Wilander marked The Trade Desk's bug 324771 resolved and fixed.
From John Wilander, WebKit (Apple), WebKit Bugzilla
Keep in mind: The fix is in the iOS 27.2 beta. Its public release date is not known.
After Safari blocked permutive.com, Permutive moved to a new domain, AdExchanger reported on 2026-10-08, citing a source familiar with the decision.
From Permutive, AdExchanger
Keep in mind: The source called it a temporary fix while Permutive moves some clients to a first-party setup. Event date is the publish date. Permutive is an In View client.
After the block, Paradium moved Permutive's code to run through IAB Tech Lab's Trusted Server and began testing whether audience data flows again, Digiday reported on 2026-10-08.
From Paradium (owner of Men's Journal and Parade), Digiday
Keep in mind: A test, not a result. Digiday gives no date for the move; event date is the publish date. Paradium was an early Trusted Server adopter. Stephanie Mazzamaro of Paradium.AI said viewability, verification and buyer acceptance remain open work. The tie is Permutive, an In View client.
On 2026-09-21, Ian Meyers of The Trade Desk filed WebKit bug 324771. It asks Apple to take adsrvr.org off Safari's unconditional block list.
From Ian Meyers, The Trade Desk, WebKit Bugzilla
Apple began rolling out iOS 27 on 2026-09-14. Safari on iOS 27 blocks requests to a private list of ad tech domains, AdExchanger reported.
From Apple, AdExchanger
On 2026-02-13, WebKit engineer Charlie Wolfe landed code that lets Safari block a private list of domains unconditionally, PPC Land reported.
From Charlie Wolfe, WebKit (Apple), PPC Land
Keep in mind: The public code blocks nothing. The list sits in an Apple file outside the public repository.
Observations and reported facts, newest first.
WebKit says Safari blocks identity providers at the domain level, so they cannot avoid the block by changing their requests.
From WebKit (Apple), WebKit blog
WebKit names its target: third parties that collect email addresses at login or newsletter sign-up and turn them into lasting tracking IDs.
From WebKit (Apple), WebKit blog
On 2026-10-13, FASilytics reported that Safari 27.2 on macOS sends requests to adsrvr.org. Seven hosts from UID2, ID5, LiveRamp, Permutive and Audigent stayed blocked.
From Laurent Fidahoussen, FASilytics, FASilytics
Keep in mind: One tester, one build, macOS only. The test did not cover iOS. One ID5 host result was inconclusive.
Index Exchange chief executive Andrew Casale said Index is largely unaffected because it is not in the identity business, Digiday reported on 2026-10-12.
From Andrew Casale, Index Exchange, Digiday
Keep in mind: The company's own assessment. No numbers given.
Two senior commercial executives at news publishers told Digiday they had seen no impact from the block, Digiday reported on 2026-10-12.
From Two unnamed news publisher executives, Digiday
Keep in mind: Unnamed sources. One credited a mostly subscription business. No numbers given.
Scott Messer of Messer Media said publishers he advises saw little immediate impact from the block, Digiday reported on 2026-10-12.
From Scott Messer, Messer Media, Digiday
Keep in mind: No numbers given. Messer expects the impact to grow as more people install the update.
On 2026-10-12, Digiday reported Aditude data on the Apple identity block. eCPMs fell 10.5% among readers on the new iOS update. Aditude put the total revenue hit near 1% so far.
From Aditude, Digiday
Keep in mind: Vendor data across Aditude customers. Digiday gives no date range or sample size. The 1% total reflects that only about 8% of users had upgraded. Safari on iPhone and iPad was 11.7% of Aditude customers' ads and 11.4% of their ad revenue. Aditude is a vendor, not a publisher.
Aditude's Justin Wohl said its Prebid Server runs ad requests outside the browser and connects to ID5, UID2 and LiveRamp, Digiday reported on 2026-10-08.
From Justin Wohl, Aditude, Digiday
Keep in mind: The vendor's own claim about its product. No results published. Aditude is an In View client.
Two agency buyers told AdExchanger their clients' Trade Desk win logs held iOS 27 ads that never served, AdExchanger reported on 2026-10-08.
From Two unnamed agency buyers, AdExchanger
Keep in mind: Unnamed sources, on background. No count of campaigns. Whether spend comes back depends on contracts between publishers, SSPs, DSPs and advertisers; none reported repaid.
Intent IQ told the Beeler.Tech community on 2026-10-02 that it had seen no material impact on Bid Enhancement from the block.
From Intent IQ, Beeler.Tech community
Keep in mind: The vendor's own statement. On 2026-10-08 a community member said Intent IQ may simply not be on the list yet. Intent IQ is an In View client.
AdExchanger reported on 2026-10-02 that Apple devices call a remote block list, so Apple can change it without a new iOS release.
From AdExchanger (James Hercher)
Keep in mind: AdExchanger's own reporting, drawing on two unnamed sources. Apple has not confirmed.
AdExchanger reported that the block also reaches other browsers on Apple devices, because those browsers must use WebKit.
From AdExchanger
Keep in mind: Apple allows other browser engines in the EU. The report does not address them.
AdExchanger reported on 2026-10-02, citing two unnamed sources, that Apple replaced the short list with a list of hundreds of data and ad tech companies.
From AdExchanger
Keep in mind: Two unnamed sources. Apple has not confirmed.
A Beeler.Tech community member said on 2026-10-01 that LiveRamp plans to move its ATS product server-side.
From Beeler.Tech community (one member)
Keep in mind: A web search on 2026-10-19 found no public LiveRamp announcement. The member said one was coming.
On 2026-10-01, an app publisher in the Beeler.Tech community reported no impact on in-app Trade Desk delivery or identity fetching.
From Beeler.Tech community (one app publisher)
Keep in mind: One publisher. Another member noted that in-app web views built on WebKit can still be affected.
Permutive's August 2026 data shows 41% lower CPMs on impressions with no identity signal, PPC Land reported.
From Permutive, PPC Land
Keep in mind: Vendor's own number, no method published. Permutive's domain is on Safari's list.
The Trade Desk's bug report lists nine entries Safari 27 blocks: tainted.example, uidapi.com, adsrvr.org, id5-sync.com, eu-1-id5-sync.com, rlcdn.com, pippio.com, permutive.com and ad.gt.
From Ian Meyers, The Trade Desk, WebKit Bugzilla
Keep in mind: Apple has not confirmed the list. The bug does not say how The Trade Desk built it.
Named views and readings, newest first. A view is not a fact.
IAB Tech Lab's Anthony Katsur wrote on LinkedIn on 2026-10-20 that the block's bigger long-term risk is weaker measurement, which pulls budgets toward large platforms.
From Anthony Katsur, chief executive, IAB Tech Lab, LinkedIn
Keep in mind: His reading, in a LinkedIn article. He gives no data. He says the audience keeps its value, but the evidence to prove it weakens. The article ends by promoting IAB Tech Lab's Trusted Server, left out here.
WebKit says first-party personalization is not tracking, and Safari's protections leave it in place.
From WebKit (Apple), WebKit blog
WebKit says a third-party identity resolver does tracking even when it holds one company's data, because it can match users across parties.
From WebKit (Apple), WebKit blog
Mediovsky's Mikołaj Salecki wrote on 2026-10-13 that Aditude's three figures multiply to about 0.1% of revenue, not the 1% Aditude gave.
From Mikołaj Salecki, Mediovsky, Mediovsky
Keep in mind: His own arithmetic on Digiday's figures. He says the report does not make clear what the 8% refers to, which would explain the gap.
Raptive's Paul Bannister wrote on LinkedIn on 2026-10-08 that the block looks like an Apple test of control over ads at the source.
From Paul Bannister, chief strategy officer, Raptive, PPC Land
Keep in mind: His reading, posted on LinkedIn. He pictured Apple charging DSPs to be unblocked within 18 to 24 months, as a scenario with no source.
A Beeler.Tech community member said on 2026-10-08 that Apple will likely block any client-side identity passing, possibly including publishers' own domains.
From Beeler.Tech community (one member)
Keep in mind: The member's reading, not a report of a change. WebKit says first-party personalization is left alone (ST-052).
Eric Seufert of Mobile Dev Memo wrote on X on 2026-10-02 that every workaround to Apple's privacy rules has an expiration date.
From Eric Seufert, Mobile Dev Memo, X
Keep in mind: His reading. The post quotes his own subscriber article, which Beeler.Tech did not read in full.
Several Beeler.Tech community members said on 2026-10-01 and 2026-10-02 that publishers should move identity work server-side, with Trusted Server the likely route.
From Beeler.Tech community (several members)
Keep in mind: One member said server-side serving would help but not fully solve a block like this.
What nobody can answer yet. These are what the daily check looks for.
Does the block run in every macOS 27 release, or only from 27.2? One tester found it running on macOS 27.2. Apple has not said.
Raised Oct 19, 2026, WebKit blog
Based on one independent test (ST-046).
How much Safari ad revenue do publishers lose to the block? No publisher had reported a number by 2026-10-19.
Raised Oct 13, 2026, CWire
Can a listed company ask Apple for review? Apple has published no rules, timeline or appeal process, CWire reported.
Raised Oct 13, 2026, CWire
The Trade Desk got its delivery domain released through a public bug report.
Which domains are on Apple's full block list? Apple has not published the list.
Raised Oct 13, 2026, CWire
Why are Google's ad domains not blocked, when they collect similar signals? Community members raised this on 2026-10-01 and 2026-10-08.
Raised Oct 8, 2026, Beeler.Tech community
Apple has not explained how domains are chosen.
Add https://mcp.beeler.tech/mcp to Claude or ChatGPT as a custom connector, once. Then ask: “What does the Apple identity block change for publisher revenue?” It answers from these statements, with every source named and linked.
Every statement links to its source and says when Beeler.Tech has a tie to it, such as an In View client. Community observations are anonymous; here is how we use them. Corrections are made in public.
