For years you could treat iPhone traffic as a slightly weaker version of everything else: fewer cookies, softer bids, but steady money. iOS 27 changes that math for Safari ads. Since the update began rolling out on September 14, 2026, Apple's browser engine has refused to talk to a short, unpublished list of ad tech and identity domains, including The Trade Desk's ad server, Unified ID 2.0, ID5, LiveRamp, Permutive, and Audigent. The first publisher data shows a 10.5 percent eCPM drop among readers who have installed the update, landing right at the start of the fourth quarter.
The revenue hit is still small because few people have updated. It will not stay small. This guide explains what changed, what the early numbers say, and a six step plan to protect your iPhone ad revenue before adoption climbs.
What Changed for Safari Ads in iOS 27?
The short answer: Apple added a domain level blocklist to WebKit, the engine behind Safari, and requests to listed domains are simply refused. AdExchanger reported on September 29 that The Trade Desk could not serve ads to Safari users on iOS 27, and that the same update blocked UID2 (which runs on the uidapi.com domain), ID5, Audigent, LiveRamp, and Permutive.
Three details matter for publishers:
- The block works at the domain level. PPC Land's review of the WebKit code found the rule applies to the registrable domain, so every subdomain is covered. That is why The Trade Desk's ad delivery was caught along with its cookie sync endpoint: both live on adsrvr.org.
- The list is private. Apple has not published or explained it, and there does not appear to be an appeal process. Most of what the industry knows comes from a public WebKit bug report filed by The Trade Desk, which listed nine affected domains.
- It is not only the Safari app. In most markets, iPhone browsers are built on WebKit, so the same rules generally reach Chrome and other browsers on iOS too.
Apple has long said it opposes fingerprinting and cross site tracking. What is new is enforcement at the network level, with no warning to the companies affected. As AdExchanger reported, blocked vendors were left to figure it out themselves, usually after a publisher client or partner asked why ads had stopped rendering.
Who Is Blocked From Safari Ads, and Who Is Not
Here is where things stood on October 18, 2026.
The Trade Desk: a fix in beta, not yet for your readers
Apple's WebKit privacy lead replied to The Trade Desk's bug report and, on October 5, pointed the company to an iOS 27.2 beta that removes adsrvr.org from the blocklist. That helps only once iOS 27.2 ships to the public. AdExchanger said on October 8 that might take three or four weeks, and Digiday reported on October 12 that anyone on the current version of iOS was still blocked. Until then, a DSP that many open web buyers rely on cannot render ads to updated iPhones.
Identity providers: still blocked
UID2, ID5, LiveRamp, Audigent, and Permutive remained affected in the latest reporting. Permutive rotated to a new domain, which a source told AdExchanger was a temporary patch while some clients move to its first party setup. AdExchanger also reported, citing sources, that Apple is working on a far larger potential list covering hundreds of ad tech, martech, and identity vendors. Apple has not confirmed that.
Exchanges that do not depend on identity: mostly fine
Index Exchange chief executive Andrew Casale told Digiday his company had been largely unaffected because it is not in the identity business. In the ad call The Trade Desk attached to its bug report, Google's bids went through cleanly while The Trade Desk's were blocked.
What the Early Revenue Data Shows
The best public numbers so far come from Aditude, a company that helps publishers sell ad space, via Digiday on October 12. Across Aditude's customers, Safari on iPhones and iPads accounted for 11.7 percent of ads shown and 11.4 percent of ad revenue. Among readers who had installed the latest update, eCPMs fell 10.5 percent. Because only about 8 percent of users had upgraded, Aditude put the overall revenue impact at about 1 percent at that point.
Other publishers told Digiday they had seen little impact yet. Consultant Scott Messer said his clients noticed little immediate change but expected that to shift as more people update. Two news publishing executives said they had not seen an impact and were not concerned, one of them citing a mostly subscription business. One anonymous publisher executive made the sharper point: the block "will hurt publishers that have low levels of direct-sold inventory more than established brands" that sell much of their inventory directly.
Your exposure is probably larger than Aditude's average. StatCounter data shows iOS accounted for 53.5 percent of US mobile web page views in September 2026, and it has been at or above 58 percent in every other month of the past year. If your audience skews to iPhone readers, the share of revenue running through WebKit is far bigger than 11 percent.
A quick way to estimate your own risk
You can size the problem with three numbers from your own reporting: the share of your ad revenue that comes from iPhone browsers, the share of those readers on iOS 27 or later, and the eCPM gap between updated and older iOS versions. Multiply them together. As a purely hypothetical example, if 40 percent of your ad revenue comes from iPhone browsers, half of those readers have updated, and a 10.5 percent eCPM gap holds, the hit is about 2.1 percent of total ad revenue (0.40 x 0.50 x 0.105). Use your own inputs and rerun the math every two weeks.
One more data point shows why identity matters to price. PPC Land cited Permutive data from August putting the CPM penalty for impressions without an identity signal at 41 percent. That is a vendor estimate, not an independent measurement, but it shows how much buyers have been paying for addressable Safari traffic.
Why the Blocklist Matters More Than the Numbers So Far
Three reasons this deserves your attention even while the hit looks like a rounding error.
- Adoption only goes up. AdExchanger noted that Apple eventually pushes updates to laggards. Every week, more of your iPhone readers move behind the new rules.
- The timing is bad. The fourth quarter is when publishers and ad tech vendors make most of their money, and this landed at its start, as Digiday pointed out.
- The rules can change without notice. IAB Tech Lab's Rowena Lam wrote on October 13 that an unreleased WebKit update would let Apple add domains remotely without a new iOS release. PPC Land noted Apple has not confirmed that capability, but the industry is planning for it.
How to Protect Safari Ads Revenue: A Six Step Plan
1. Split your reporting by browser and iOS version
Averages hide this problem. In your ad server or network dashboard, break out revenue, impressions, fill rate, and eCPM for Safari and other iOS browsers, and compare iOS 27 against older versions where your tools allow it. Check weekly through December. Blended RPM will show the damage weeks late.
2. Audit your page for blocked domains
Load a few article pages on an iPhone running iOS 27, connect it to Safari's Web Inspector on a Mac, and look for failed requests. The domains named in public reporting include uidapi.com, id5-sync.com, rlcdn.com and pippio.com (LiveRamp), ad.gt (Audigent), permutive.com, and adsrvr.org. A failed identity call usually does not break the page, but it means the bid request goes out without the signal you are paying for.
3. Ask each partner for its iOS 27 plan in writing
Ask every identity provider, SSP, and wrapper vendor in your stack: are any of your domains blocked on iOS 27, what is the fix and timeline, and does it rely on a domain switch or a first party deployment? A domain rotation is a patch, not a plan, because the next list update can catch it.
4. Build first party signals you control
Apple's block targets cross site recognition, not your own relationship with readers. Registration, newsletter signups, and logged in experiences give buyers a consented signal that does not depend on a third party domain. Digiday reported one publishing executive saying rates on registered users can be as much as eight times higher. Our guide on how to monetize first-party data covers the setup.
5. Lean harder on contextual and direct deals
Contextual targeting and directly sold campaigns do not need a cross site ID, which is why publishers with strong direct sales are worried least. Package your iPhone heavy sections by topic for direct buyers, and make sure your page level content signals reach programmatic bidders. Our explainer on cookieless advertising walks through the options.
6. Evaluate server side options carefully
IAB Tech Lab argues advertising should move off the browser to publisher controlled servers through its open source Trusted Server project, where WebKit never sees the bids. Lam told AdExchanger she expects production level tests by early next year. It is worth tracking, but PPC Land pointed out that the speed and privacy benefits have not been backed by published figures yet. Test before you migrate.
One thing not to do: do not try to dodge the block with fingerprinting tricks or by quietly re routing identity calls through new domains. That is exactly the behavior Apple's policy targets, and it puts your whole iPhone audience at risk.
Should You Worry About Safari Ads Right Now?
Worry enough to measure, not enough to panic. Today the loss is about 1 percent for Aditude's network, and some publishers see nothing. But with iPhones at about half of US mobile web traffic and Apple controlling the list, the publishers who split their reporting now will spot the slide early and shift revenue toward first party, contextual, and direct deals before it compounds. Track the effect on your website RPM every week until iOS 27.2 ships.
Quick Answers
Does iOS 27 block Google ads in Safari?
Not in the public evidence so far. In the ad call The Trade Desk filed with its bug report, Google's bids went through while The Trade Desk's were blocked. Apple has not published its list, so there is no guarantee either way.
When will The Trade Desk's ads work on iPhones again?
When iOS 27.2 is released to the public. Apple removed adsrvr.org in a beta on October 5, but has not given a release date. AdExchanger estimated three to four weeks from October 8.
Is the Mac affected too?
IAB Tech Lab said the WebKit change shipped with both iOS 27 and macOS 27. PPC Land said the macOS impact had not been confirmed. Check your desktop Safari numbers as well, just in case.
How many iPhone users have the update?
Aditude estimated about 8 percent of users as of mid October. StatCounter's September data put iOS 27 at roughly 3 percent of US iOS traffic, a figure that covers only the first half month after release.
Sources
We keep outbound links to a minimum. The facts above come from these named sources, checked on October 18, 2026.
- AdExchanger, Apple's Latest Operating System Blocks The Trade Desk From Serving Ads On Safari, September 29, 2026. Read the AdExchanger report
- AdExchanger, How Data And Ad Tech Vendors Are Preparing For The iOS 27 Fallout, October 8, 2026. Read the follow up
- Digiday, Ad industry tallies early losses from Apple's Safari tracking block, October 12, 2026. Read the Digiday report
- Digiday, As AI search shifts referrals, publishers revisit registration walls, October 8, 2026. Read the briefing
- PPC Land, ID5 stays on Safari blocklist as Trade Desk gets 13-day fix, October 14, 2026. Read the PPC Land analysis
- StatCounter Global Stats, Mobile Operating System Market Share, United States. View the StatCounter data