First came the cookie apocalypse on Apple devices, then the consent apocalypse – on Apple and on web in the EU. Now we’re entering the next stage: the domain apocalypse.
iOS 27 ships with a WebKit mechanism that unconditionally blocks requests to a list of domains maintained privately by Apple (WebKit bug 324771). The first round is already live, and it’s a bloodbath. The Trade Desk’s adsrvr.org – its core ad serving and measurement domain – is blocked, which means TTD can neither serve ads nor run pixel-based attribution in Safari on iOS 27. So is uidapi.com, the domain behind its Unified ID 2.0. Identity providers are hit too: LiveRamp, ID5, Permutive and Audigent. Google’s ad.doubleclick.net, meanwhile, appears to be unaffected – at least for now.
To be fair to Apple, the first round targets mostly identity and data broker companies. TTD’s ad serving looks like collateral damage – or at least that’s TTD’s argument: adsrvr.org handles both ad delivery and identity matching, and Apple’s rule blocks the whole registrable domain, so it can’t tell match.adsrvr.org from the hosts that serve creatives. Then again, TTD is not an innocent bystander here – it also runs UID2, whose domain is on the list in its own right. Either way, the lesson for the rest of the industry is clear: keep ad delivery and data collection on separate domains.
The scope is not the main problem, though. The process is. Apple’s earlier anti-tracking measures – ITP, third-party cookie blocking, ATT – came with published rules that applied to everyone, and the industry could adapt its architecture to them. This time the mechanism was visible in WebKit’s source since February, but the list itself was not. And according to AdExchanger’s sources, the list is now fetched remotely and covers hundreds of CDPs, DMPs, DSPs and identity vendors. If that’s accurate, Apple can block or unblock any domain at any time – without an OS update, without published criteria, without an appeal process, and possibly without the vendor even knowing.
What does it mean?
Less cross-site identification, for a start. Publishers lose identity signals on iOS traffic, and unaddressable impressions sell at lower CPMs. Blocking a DSP is worse still: the impression doesn’t sell cheaper, it loses bidders altogether. Either way, it’s another blow to the open web and another tailwind for walled gardens – including Apple’s own growing ad business.
Technically, expect a further push towards server-to-server integrations. But don’t assume that moving to a new domain is a safe workaround: Safari 27 already blocks some ad servers by IP address.
In the EU, Apple is putting itself in the firing line. Safari is a designated gatekeeper service under the DMA, and national competition authorities have already fined Apple over ATT. If Google’s domains really are treated differently, regulators will notice. Either Apple’s grip loosens, or Google ends up on the list too.