Trusted Server is suddenly the most talked about fix in publisher ad tech. On October 28, 2026, Digiday reported that ID5 is moving more of its identity infrastructure server-side after Apple’s Safari block, while others rally behind IAB Tech Lab’s open source Trusted Server framework. The idea is simple: move ad requests off the reader’s device and onto servers the publisher controls. The hard part is the cost, especially for smaller sites. This guide explains how it works, where it stands today, what it costs and seven proven steps to get ready without overspending.
We stick to what the sources say. Product details come from IAB Tech Lab and the project’s public code repository. Market context comes from Digiday, AdExchanger and Privacy Daily, and the Safari exposure figures come from Aditude via Digiday. Where a claim comes from a vendor or from early testing, we say so.
Table of Contents
What Is Trusted Server?
IAB Tech Lab describes Trusted Server as an open source, edge based reverse proxy, orchestration framework and runtime for publishers. It manages ad requests, auction execution and creative delivery in a server-side environment, which removes reliance on third party tools that browsers keep restricting. It plugs in at your current CDN layer or as a backend behind it.
The project’s public code repository adds useful detail. Every page and ad request passes through it, so it sees the content and the ad stack in the same request path. It is written in Rust, compiled to WebAssembly and can run on Fastly Compute, Cloudflare Workers or Akamai, or as a native server in containers. The code is licensed under Apache 2.0.
IAB Tech Lab announced the framework in March 2025. For most of the time since, few publishers acted on it. Digiday noted the benefits were hard to price, the software was close to a prototype and publishers would need engineers to run servers their ad sales teams had never managed.
Why Safari 27 Put It Back on the Agenda
Apple changed the math. In its 27 releases, Safari blocks network access to what Apple calls identity resolution infrastructure, and vendors including ID5, LiveRamp, Permutive, Audigent and The Trade Desk’s UID 2.0 were affected. We covered the revenue impact in our guide to identity resolution after the Safari block.
The exposure is large. Across Aditude’s customers, as reported by Digiday’s In Graphic Detail analysis, browsers built on WebKit account for 30% of ad impressions and 28.5% of ad revenue. Where the update has landed, eCPMs are down 4% on iOS and 11% on Macs. That is why a server-side route suddenly looks worth the effort.
In Digiday’s report on the blocklist, Rowena Lam, IAB Tech Lab’s senior director of privacy and data and product lead for the framework, said the lab had seen “a big influx of publishers reaching out” in a single week. She did not give a number, but said Tech Lab was getting ready to go live with its first publisher.
How Server-Side Ad Delivery Works
Today, when someone opens a news site in Safari on an iPhone, the device does not just load the article. Digiday explains that it also contacts dozens of ad tech companies directly, sharing data and asking for bids. Safari can see those calls and block any company on Apple’s list.
A trusted server setup takes the device out of that loop. The phone talks only to the publisher’s domain, and the publisher’s server handles the ad tech partners behind the scenes. As Digiday put it, Apple can’t stop what it can’t see, and its only option would be to block the news site itself, which would break the site for every Safari user.
IAB Tech Lab’s framework is not the only server-side option. Aditude offers its own Prebid Server, which VP Justin Wohl said can process ad requests outside the browser and connect via APIs to identity providers such as ID5, UID2 and LiveRamp. If you are new to the auction side, our explainer on header bidding vs waterfall covers the basics of client and server auctions.
ID5’s plan follows the same logic. Under its approach, identity functions that used to run through calls to third party domains would instead run through publisher controlled infrastructure. “Going server-side is more resilient because you’re not on the device anymore, so there’s nothing the device can do to block you,” CEO Mathieu Roche told Digiday.
Where the Project Stands Today
IAB Tech Lab’s 2026 roadmap said it delivered Version 1.0 earlier this year and expected first pilots in Q2. In March, Privacy Daily reported that The Arena Group was the first publisher signed up for live production testing, then expected in late 2026 or early 2027. Digiday reports the company rebranded as Paradium in August.
The project page lists three phases. The proof of concept is completed. The MVP for publishers, which lets a publisher run a share of its inventory through the framework with ID providers, audience providers and server side tagging, is ready for publisher testing. Ad fraud, brand safety and measurement plugins are planned, with priorities still to be set by the project’s task force.
Paradium is already testing. Digiday reported that its team routed its Permutive code through the framework after the Safari block and is watching to see whether audience data starts flowing again. Stephanie Mazzamaro, head of revenue and data, said it “should help some signals much more than others, such as ID longevity, ad-block resilience, and clean auction data.”
The Benefits IAB Tech Lab Claims
IAB Tech Lab’s page says publishers using it can grow revenue by monetizing traffic from browsers that restrict signals, double page load speed and minimize data leakage so they can charge a premium for their audience. At its Signal Shift event in March 2026, CEO Anthony Katsur shared initial testing that saw up to 70% faster page loads.
Treat these as early, best case results from the project’s backers, not production benchmarks. Still, speed is a real lever. Fewer third party scripts on the page can improve user experience and viewability, as we explain in our guide to how ads impact Core Web Vitals.
The Real Cost for Smaller Publishers
Here is the catch. Roche acknowledged that implementation would be harder for smaller publishers, particularly those that outsource ad operations, though he said larger organizations could finish the technical work in days rather than months, Digiday reported. AdExchanger added that publishers without in-house engineers could struggle with the added infrastructure costs.
A trusted server deployment means running and paying for edge compute, configuring auctions and partners and keeping it all maintained. Digiday also recalled that publishers who previously moved auctions onto their own servers earned less, because advertisers lost the cookies they used to recognize readers and bid lower without them. Most were in no hurry to try again.
Quick fixes exist, but they are short lived. AdExchanger reported that some blocked vendors, including Permutive, spun up new domains that were not on Apple’s blocklist, which it called a temporary Band-Aid. TeqBlaze, a member of the project’s working group, also warned against technology providers exploiting the disruption to impose extra costs on publishers seeking help.
The Open Questions
Critics raise three concerns. Added infrastructure may increase complexity and dependence on cloud providers. Some worry about fingerprinting and about preserving identity practices Apple has already said it opposes. And skeptics ask whether Apple will see the shift as a privacy fix or a dodge, which could start another round of cat and mouse.
Even supporters are careful. “There is no absolute guarantee that any single solution will permanently solve the challenges posed by Apple’s ecosystem updates,” TeqBlaze CEO Anastasia-Nikita Bansal wrote in an emailed response to Digiday. Mazzamaro added that viewability, verification and getting buyers to accept publisher numbers are where most of the work remains.
7 Proven Steps to Get Ready
You do not need to deploy a trusted server this quarter to benefit from the shift. These steps help you decide, budget and test without betting the business on a framework that is still in publisher testing.
1. Measure your Safari exposure first
Split impressions and revenue by browser and OS version. If WebKit traffic is a small share of your revenue, the urgency is lower. If it looks like Aditude’s customers, where WebKit makes up 30% of impressions, the case for a server-side plan is stronger.
2. List every third party call on your pages
Audit which identity, audience and bidding scripts load in the browser and which are already blocked in Safari 27. This is the list any server-side setup would need to replace, and it shows how much work a migration involves.
3. Ask your ad management partner for a plan
If you outsource ad ops, you are the publisher Roche says will find this hardest. Ask your partner whether it supports IAB Tech Lab’s framework, runs its own Prebid Server or plans another route, and what it will charge. Get the answer in writing.
4. Check your CDN
Trusted Server runs on Fastly Compute, Cloudflare Workers or Akamai, or as a native server in containers. If you already use one of these CDNs, a pilot is easier. If not, price the edge compute before you commit.
5. Start with a share of inventory
The MVP is designed to let publishers run a percentage of inventory through the framework. Begin with a small test, compare revenue per session and page speed against a control group and only scale if the numbers hold.
6. Track the right metrics
Watch revenue per ad opportunity, not just eCPM, along with page load time, viewability and identity match rates in Safari. Mazzamaro’s warning about viewability and verification means you should confirm buyers accept your numbers.
7. Strengthen first party relationships
Whatever the infrastructure, logged in readers and consented data are the most durable signals. Keep growing newsletters and registrations, and package context based deals that do not depend on recognizing readers across sites.
Trusted Server will not suit every publisher, but the direction is clear. More of the ad stack is moving off the device, and the publishers who measure their exposure now will make a calmer decision when the first production results arrive.
Trusted Server FAQ
What is Trusted Server?
It is an open source, edge based reverse proxy and runtime from IAB Tech Lab. It moves ad requests, auctions and creative delivery from the reader’s browser to servers the publisher controls.
Why are publishers looking at Trusted Server now?
Safari 27 blocks identity resolution infrastructure. Aditude data reported by Digiday shows WebKit browsers account for 30% of ad impressions and 28.5% of ad revenue across its customers.
Is the framework ready to use?
The proof of concept is completed and the MVP is ready for publisher testing. Version 1.0 was delivered earlier in 2026, and production results have not yet been published.
How much faster can pages load?
IAB Tech Lab CEO Anthony Katsur shared initial testing that saw up to 70% faster page loads. These are early results from the project’s backers, not production benchmarks.
Is it hard for small publishers to adopt?
Yes. ID5’s CEO said it would be harder for smaller publishers that outsource ad operations, and AdExchanger noted sites without in-house engineers could struggle with infrastructure costs.
Which platforms can run it?
It runs on Fastly Compute, Cloudflare Workers or Akamai, or as a native server in containers. It is written in Rust and compiled to WebAssembly.
Related posts:
Which Ad Networks Will Go Bankrupt Next
Why And When The OSI Model Can Be Used For Tech Companies
Seasonal RPM Trends: When Do Publishers Earn the Most?
Best DFP Implementation Services for Small Publishers (2026 Guide)
Top Lightweight WordPress Themes for High Ad Density Sites in 2026
