Apple’s iOS 27 update has pushed ad tech into a new kind of failure: a core ad delivery domain stopped resolving in Safari, meaning ads may not render at all. For marketers, this is no longer a third-party cookie debate.
What happened
Apple released iOS 27 on September 14, 2026. Within a week, The Trade Desk could no longer serve advertisements on Safari for affected devices. By late September, Apple had begun investigating why.
Two domains are involved. adsrvr.org carries The Trade Desk’s ad requests and delivery and sets third-party cookies. UIDAPI.com is tied to its Unified ID 2.0 identity programme. Ian Meyer, Senior Director of Engineering at The Trade Desk, raised the issue on GitHub and drew a sharp distinction: adsrvr.org is “The Trade Desk’s core ad request and delivery domain, not identity.”
Meyer asked WebKit engineers for an urgent review and then asked again for an estimate. John Wilander, who manages WebKit privacy and ad tech at Apple, acknowledged the flag and promised an investigation. His last update before September 29 was narrow, promising only to report back “if and when any changes are available” for testing. Neither Apple nor The Trade Desk commented publicly before AdExchanger reported the story.
Why this is different from a cookie block
Safari has blocked third-party cookies outright for years, and the industry built alternatives such as Unified ID 2.0 in response. A browser rejecting an identity domain is a familiar policy decision. A browser declining to resolve the domain that physically delivers the creative is something else: the advertisement doesn’t render, the impression doesn’t happen, and no workaround at the identity layer helps.
Four further vendors joined Apple’s blocklist in September 2026: ID5, Audigent, LiveRamp and Permutive. Each sits somewhere on the identity and data spectrum, which makes the pattern legible. The outlier is that Google’s delivery through ad.doubleclick.net kept working over the same period. Nobody outside Apple has said whether that reflects deliberate scoping, a classification difference or an error.
What performance teams should do
- Audit every delivery and tracking domain your ad stack depends on.
- Separate identity failures from delivery failures when diagnosing Safari performance.
- Monitor WebKit GitHub threads and vendor status pages around OS releases.
- If you buy Safari inventory through The Trade Desk, check delivery and attribution now.
The bigger picture
Safari has spent recent release cycles tightening scripts, storage and private browsing, and it has also broken things by accident before. Advertisers have found click identifiers quietly stripped without an announcement. The practical difference between an intentional block and a bug is close to zero for buyers while it lasts.
The Trade Desk has spent 2026 arguing that the open internet needs fewer chokepoints. An operating system release is a chokepoint that supply-path optimization cannot reach. Companies cannot appeal it, cannot bid around it and cannot detect it in advance. They can file an issue and wait, which is what happened here.
Source: PPC Land
