Apple's Safari 27 Blocks The Trade Desk and Major Identity Providers at the Network Layer

Apple released iOS 27 on September 14. Within a week, The Trade Desk could no longer serve any advertisements on Safari for users on affected Apple devices. The block was not announced, not documented in release notes, and not disclosed to ad tech partners in advance. It was discovered when campaigns stopped delivering.

The cause, traced by a WebKit bug report filed on September 21 by The Trade Desk's senior director of engineering Ian Meyer, is that Apple added adsrvr.org — TTD's core ad request and delivery domain — to a tracking blocklist maintained in a system library outside WebKit's open-source repository. Meyer emphasized that adsrvr.org handles ad delivery, not identity resolution: "Adsrvr.org is The Trade Desk's core ad request and delivery domain, not identity." The distinction matters because Apple blocked not just a tracking pixel but the entire ad-serving pipeline, effectively shutting down the DSP's access to Safari inventory for every device running the latest iOS.

Not Just The Trade Desk

The Trade Desk's ad delivery domain was the highest-profile casualty, but it was not the only one. iOS 27 expanded Apple's existing policy of blocking data broker domains that perform addressable ID matching and facilitate cross-site tracking. Four additional identity vendors joined the blocklist in September: ID5, Audigent, LiveRamp, and Permutive. Apple also blocked UIDAPI.com, the domain powering The Trade Desk-backed Unified ID 2.0 program, the industry's most prominent post-cookie identity solution.

The breadth of the block is striking. LiveRamp's Authenticated Traffic Solution, ID5's probabilistic identity graph, Permutive's cohort-based targeting, and Audigent's data activation platform collectively represent the core of the open web's alternative identity infrastructure — the systems the industry built specifically to replace third-party cookies. Apple blocked all of them in a single OS update.

Safari 27 also blocks LinkedIn and Bing ad trackers by IP address. The Bing Universal Event Tracking endpoint at bat.bing.com and the LinkedIn Insight Tag at snap.licdn.com are both affected, cutting conversion measurement for advertisers using those platforms to reach Safari audiences.

A New Kind of Blocking

What makes Safari 27 different from previous Intelligent Tracking Prevention updates is not just what it blocks but how it blocks it. Previous ITP iterations operated at the application layer — restricting what cookies a script could set, how long they persisted, or what data a page could read. Safari 27 moves part of the blocking to the network transport layer, intercepting connections before they complete by checking the destination IP address against a list of known ad network subnets.

This is a fundamental architectural shift. Application-layer blocking can be circumvented through server-side proxying, CNAME cloaking, or first-party domain delegation — techniques that the ad tech industry has used for years to work around ITP. Network-transport-layer blocking cannot, because it terminates the connection before any data reaches the destination server. The browser does not care which domain the script loaded from or what the HTTP request looks like. If the destination IP resolves to a blocked subnet, the connection dies.

Apple also expanded Link Tracking Protection to strip additional click identifiers, including twclid (X's primary click ID), si (YouTube share links), and xmt. The removal of these parameters creates attribution gaps identical to what Google Ads advertisers experienced when gclid stripping first appeared — campaigns that previously tracked conversions cleanly now report inflated cost-per-acquisition because a portion of the conversion path is invisible to the measurement platform.

Apple stores its tracking rules in a separate system library that updates independently of Safari itself. This means Apple can add new domains, IP ranges, or click ID parameters to the blocklist at any time without shipping a browser update — and without notifying the ad tech vendors affected.

The Measurement Math

Safari's market share makes this more than a niche concern. Safari holds approximately 26% of global mobile web page views as of August 2026, up from 20.3% a year earlier. On iOS devices specifically, Safari commands 74.4% of web traffic according to Cloudflare Radar data from June 2026. In the United States, where iOS adoption skews higher than the global average, the impact is even more pronounced.

For measurement teams, the immediate effect is a growing blind spot. When Safari blocks an ad-serving domain entirely, that impression is never delivered, never measured, and never enters the conversion funnel. When it strips click identifiers, the impression is delivered but the conversion cannot be attributed. Either way, the measurement system produces an incomplete picture that systematically understates campaign performance on Apple devices.

The compound effect is significant. Analysis from server-side tracking providers estimates that campaigns relying solely on client-side measurement see reported CPA inflated by as much as 66% when Safari's tracking prevention hides a portion of conversions. The actual performance may be fine — the ads may be working — but the dashboard cannot prove it.

KeyBanc analysts estimated that the Safari block could present a low-single-digit percentage annual revenue headwind for The Trade Desk if it persists, noting the situation is worth monitoring heading into the critical fourth-quarter advertising season. They suggested the block may have been unintentional and could be resolved, but as of September 28 — two weeks after iOS 27's release — Apple had offered no fix despite The Trade Desk's September 21 outreach to the WebKit team.

The Bigger Picture: Identity Infrastructure Under Siege

The Safari 27 blocks should be read alongside a broader pattern. Apple's App Tracking Transparency framework in iOS 14.5 disrupted mobile app measurement in 2021. The Private Click Measurement API constrained Safari attribution starting in 2023. Each successive iOS release has tightened the constraints on ad tech's ability to measure across Apple's ecosystem.

But Safari 27 marks an escalation. Blocking an ad-serving domain — not a tracking pixel, not a cookie, but the domain that actually delivers the ad creative — goes beyond limiting measurement. It prevents the ad from appearing at all. And blocking the identity providers that were purpose-built as privacy-respecting alternatives to third-party cookies suggests that Apple views the open web's identity infrastructure as fundamentally incompatible with its privacy architecture, regardless of the consent mechanisms or data-handling practices those providers employ.

The timing is also notable. The Trade Desk was removed from the S&P 500 on September 22, and its stock has fallen sharply amid broader concerns about ad tech market share. The Safari block adds operational uncertainty to a company already under financial pressure, and raises questions about the viability of any identity solution that requires browser-level cooperation from Apple.

What Measurement Teams Should Do Now

Quantify your Safari exposure immediately. Segment your analytics by browser and device to understand what percentage of your conversions flow through Safari. If Safari represents more than 15-20% of your measured conversions, the gap created by iOS 27 is material to your reporting accuracy.

Accelerate server-side tagging deployment. Server-side tracking sends conversion events from your server to ad platforms through server-to-server connections, bypassing browser-level restrictions entirely. Benchmarks from 2026 show server-side setups recovering 62% to 96% of conversions that client-side implementations miss. This is no longer optional infrastructure — it is the only reliable path for browser-based conversion measurement on Apple devices.

Diversify your measurement stack beyond browser-based attribution. The trajectory is clear: browser-based measurement on Safari is becoming structurally unreliable. Marketing mix modeling, geo-based incrementality testing, and media mix approaches that do not depend on user-level tracking are the measurement methods that survive regardless of what Apple does next. The IAB's State of Data 2026 report found that 60% to 75% of buy-side users already consider current measurement approaches inadequate — Safari 27 will push that number higher.

Do not assume this gets reversed. The WebKit code that enables the blocking was committed in February 2026 and shipped in a production OS release seven months later. Whether the specific block on The Trade Desk's ad-serving domain was intentional or an overly broad application of the tracking blocklist, the mechanism itself — network-layer blocking of ad tech infrastructure — is deliberate, mature, and expanding. Every measurement strategy that depends on browser-level access to Apple devices needs a fallback that does not.