Apple’s iOS 27 release is doing something different from its earlier tracking restrictions: it is cutting off Safari requests to ad tech domains before they leave the device. Mathieu Roche, co-founder and CEO of identity company ID5, went public today, calling the move an attack on the open web and urging regulators to examine Apple’s power.
What changed in iOS 27
Apple began rolling out iOS 27 on September 14, 2026. Within a week, The Trade Desk could no longer serve ads in Safari on updated iPhones. AdExchanger later reported that ID5, Unified ID 2.0, Audigent, LiveRamp and Permutive were on the blocklist.
The mechanism is not the old cookie-storage ITP. A WebKit commit from February added an unconditionally blockable switch to the network layer. Safari checks a registrable domain, the eTLD+1, and blocks every subdomain under it. That is why adsrvr.org cuts off both The Trade Desk’s ad delivery and its cookie matching.
Why this hits marketers now
Safari is where identity vendors are supposed to earn their fees because third-party cookies have been blocked there for years. ID5’s own scale makes the block material: after acquiring TrueData, Roche put the combined graph at about 1.5 billion users across 665 million households, with deployment near 100,000 sites. OpenX and ID5 previously reported a 58% desktop Safari reach lift when the ID5 ID was present, and 37% on mobile web. Permutive’s August data put the penalty for carrying no identity signal at 41% lower CPMs, with roughly 30% of web traffic addressable.
Roche’s argument is structural:
This move is not against ID5.io or any other adtech company, it is an attack against the business model of the web.
He frames Apple’s push toward apps as self-serving, pointing to App Store fees that can reach 30% for digital goods. He also cites European enforcement, though the EU’s DMA fine concerned anti-steering and the national cases targeted App Tracking Transparency, not WebKit’s network rules.
What to do now
The biggest operational risk is uncertainty. AdExchanger’s sources say Apple replaced the short list with a private library of hundreds of vendors that can change remotely. A media plan built on a fixed blocklist is already out of date.
- Audit which demand, identity and measurement domains your campaigns depend on.
- Test delivery and frequency capping in Safari on iOS 27 devices specifically.
- Diversify identity vendors rather than relying on one blocked domain.
- Monitor WebKit commits and bug tickets; the February commit shipped seven months later.
Treat platform risk as a media-planning variable, not a one-off news event. Roche’s post is an opening position, not a resolution. The next move belongs to Apple, regulators and ad tech engineers.
Source: PPC Land
