The weeks of one-way Apple coverage on the Safari blocklist just cracked open. On October 5, an Apple engineer asked The Trade Desk to test a fresh iOS 27.2 build on a public WebKit bug tracker. Fifteen minutes and twenty-two seconds later, The Trade Desk confirmed it could see changes.
A public bug thread becomes a channel
The record is WebKit bug 324771, filed September 21 by Ian Meyers, The Trade Desk’s senior director of engineering. For about two weeks it sat with holding replies. Then John Wilander of Apple said a new iOS 27.2 beta had shipped that day and asked Meyers to test it. Meyers responded that he could see changes in build 24B5099f and would report back.
The bug status has not moved: priority P1, severity Major, still NEW. Nothing is confirmed. But it is the first two-way conversation between Apple and the ad industry over a blocklist that nobody outside Cupertino had seen explained.
Nine domains, two very different jobs
The underlying WebKit change, pull request 58670, added eleven lines that let Apple internal builds unconditionally block requests to certain domains before normal tracker checks run. Meyers named nine domains:
- tainted.example
- uidapi.com
- adsrvr.org
- id5-sync.com and eu-1-id5-sync.com
- rlcdn.com
- pippio.com
- permutive.com
- ad.gt
Eight are identity-related: Unified ID 2.0, ID5, LiveRamp, Permutive and Audigent. The ninth, adsrvr.org, is The Trade Desk’s core ad request and delivery domain. That is why Meyers argued the list looked aimed at identity while catching delivery as collateral.
Publishers move the call off the device
The strategic response is to stop exposing ad-tech calls to Safari at all. According to Digiday, publishers have gone back to IAB Tech Lab’s Trusted Server, launched in March 2025 and largely ignored since. Instead of a reader’s device contacting dozens of ad-tech companies, the device talks only to the publisher, which routes auctions server-side.
Rowena Lam, IAB Tech Lab’s senior director of privacy and data, described a big influx of publishers reaching out to understand Trusted Server. Publisher Paradium is already testing whether Permutive audience data flows again through Trusted Server after Safari blocked it.
The open question isn’t just technical. Apple’s Services division, which includes its ads business, reported record revenue of $30.7bn for the June quarter. So marketers should treat iOS as a commercial control point, not a neutral utility.
What to do this week
For advertisers and ad-tech teams, the task is simple but urgent:
- Map your own domains against the nine names above and test your tags on an iOS 27.2 build.
- Separate identity endpoints from delivery endpoints in your logs; do not assume they fail the same way.
- If you buy or sell programmatic, ask your vendors whether their signals are visible to Safari or moved server-side.
Apple has conceded nothing yet, and the blocklist may not loosen in the production release. But a fifteen-minute bug thread is enough to reset the industry’s next move.
Source: PPC Land
