A bug filed by The Trade Desk’s Ian Meyers has put a quiet WebKit change from February back in the spotlight. Safari 27 on iOS now refuses to load adsrvr.org, the domain The Trade Desk uses for ad requests and delivery, which means demand-side platform buyers lose access to Safari inventory on up-to-date iPhones and iPads.
What Safari 27 actually changed
The public WebKit diff is tiny: 11 inserted lines in a privacy helper. A macro called IS_REQUEST_UNCONDITIONALLY_BLOCKABLE checks a domain and returns true before Safari consults its normal tracker-exemption logic. In open-source builds the macro always returns false. The actual list of domains that returns true ships only in Apple’s private WebKitAdditions file.
There is one technical detail that matters a lot. The check receives a registrable domain, not a hostname, so every subdomain under adsrvr.org is covered. That includes match.adsrvr.org, which Meyers says operates on legacy third-party cookies. In one quoted line from the bug report:
adsrvr.org is The Trade Desk’s core ad request and delivery domain, not identity.
The list reproduced in the ticket has nine entries covering five companies: The Trade Desk, ID5, LiveRamp, Permutive and Audigent. The first entry, tainted.example, looks like a test fixture.
Why this hits harder than cookie loss
Apple has blocked third-party cookies in Safari since 2020, so identity vendors have already been fighting for reach. This is different. Identity loss lowers what a DSP will bid; a blocked delivery domain removes the bid entirely. Cloudflare data for Q3 2025 put Safari at 15.1% of global browser traffic, against Chrome’s 66.3%.
The timing is also rough for The Trade Desk. It reported $715 million in Q2 revenue, up just 3%, guided to at least $650 million for Q3 and cut about 575 jobs in September.
What marketers should do now
- Audit every ad-serving, sync and delivery domain your stack touches, not just identity endpoints.
- Test campaigns from iOS 27 devices in non-private browsing before shifting spend.
- Diversify demand and identity partners so one platform change does not wipe out Safari reach.
- Watch WebKit Bugzilla and Safari beta reviews; the blocklist itself is not published, so behaviour is the signal.
The outlook
Apple’s John Wilander said the team is investigating and will let Meyers know if and when changes are available to test. No ETA has been given. Because the list lives in a private Apple file, removing adsrvr.org is something only Apple can do. A narrower fix that blocked only cookie-syncing hosts would require a visible change at the call site.
The public evidence right now is a patch, a bug report, a screenshot and a promise of notice. For media buyers, that is enough reason to treat Safari 27 as a checklist item before the next campaign flight.
Source: PPC Land
