Apple's iOS 27 Blocklist Isn't ATT 2.0. It's Worse.
When Apple blocked IDFA access, advertisers adapted. When Apple blocks ad serving domains entirely, the only adaptation is to use a different ad server—one Appl
When Apple's App Tracking Transparency framework landed in April 2021, the ad industry treated it like a five-alarm fire. Targeting got harder, measurement got fuzzier, and attribution became an exercise in modeling. But the pipes stayed connected. Advertisers adapted. Meta rebuilt its measurement stack. Small e-commerce firms absorbed a 37% revenue hit and kept running campaigns.
What Apple shipped in iOS 27 is a different animal entirely.
AdExchanger reported last week that Apple's WebKit blocklist now prevents The Trade Desk from serving ads in Safari on any device running the latest iOS. Not from tracking users. From serving ads at all. The company's core ad request and delivery domain, adsrvr.org, is on the list. So are identity providers like LiveRamp, ID5, Audigent, and Permutive. When Safari refuses every request to those domains, bids and creatives simply don't load.
For CMOs running programmatic budgets through TTD and targeting Apple device users, the math changed overnight. Your reach and frequency data are likely off right now. Your CPMs may look efficient because you're not reaching the audience you think you are.
The Mechanism Is the Message
ATT stopped apps from using identifiers to track a person across other sites and apps without an opt-in. Mobile measurement companies scrambled, but they accommodated themselves. The data got messier, but advertisers could still run their businesses.
As AdExchanger's Allison Schiff put it, what Apple did with ATT and what it appears to be doing now create very different kinds of headaches for ad tech. By adding adsrvr.org to a WebKit blocklist, Apple is preventing The Trade Desk from serving ads in Safari for Apple device owners who have updated to iOS 27. That's not a targeting limitation. That's a delivery blackout.
The blocklist mechanism itself is worth understanding. PPC Land traced the behavior to WebKit bug 307853, committed on . The code added 11 lines to a single file. In the open-source build, the check exists but the domain list is empty. Apple keeps the actual list in a private repository, invisible to the companies it affects.
Apple has also written new code into WebKit that will let it add companies whenever it likes without waiting for a software update. Digiday reported that once this ships, Apple can expand the list dynamically. The sword can fall on any domain, at any time, with no notice.
The Competitive Asymmetry
Here's where the board-level conversation gets uncomfortable. In The Trade Desk's own bug report, a Yahoo browsing session showed TTD bids blocked while Google's ad.doubleclick.net bids went through. Whether that's coincidence or architecture is a question worth sitting with.
Apple is not exactly a neutral party. Apple's advertising business set a June-quarter revenue record, according to comments made during the company's latest earnings call. Services revenue reached $30.7 billion, up 12% year-over-year, with CFO Kevan Parekh citing advertising as a key growth driver alongside cloud services. eMarketer forecasts Apple will bring in $8.85 billion in US ad revenues this year, growing to $11.06 billion by 2030.
Apple recently rolled out ads for Maps and launched Apple Business across more than 200 countries. The company that built ATT on privacy principles is now running a scaled advertising business. The same company that blocks The Trade Desk's ad serving domain lets its own ads through.
"An attack against the business model of the web and in favor of mobile applications, where Apple can apply a 30% tax on everything."
Mathieu Roche, CEO of ID5
The toggle that launched a thousand workarounds is about to look permissive.
That framing may be self-serving, but the structural incentive is real.
The Regulatory Backdrop
Apple's privacy moves are already under regulatory scrutiny. On , Germany's Bundeskartellamt concluded that Apple's own apps enjoyed a more favorable consent flow than third-party iOS apps under ATT. The wording, icons, and visual design of the ATT prompt created a bias: Apple's "Personalized Ads" prompt looked less alarming than the third-party tracking prompt, which featured warning symbols and the word "track."
Apple accepted seven-year binding commitments in the EU, including neutral wording, extended purpose strings, and the ability for developers to re-prompt users once per year. France fined Apple €150 million earlier this year over similar concerns.
The iOS 27 blocklist raises the same competitive questions in a different context. If Apple can block any ad tech domain at any time, with no transparency about the criteria, while running its own advertising business, regulators will eventually ask whether that constitutes self-preferencing.
What This Means for Your Forecast
For marketing executives, the immediate question is exposure. If a meaningful portion of your programmatic budget runs through The Trade Desk and targets Apple device users, your reach data is likely understating delivery gaps right now.
AdExchanger reported that Apple has removed The Trade Desk's ad serving problem from a new beta version of iOS 27, saving the DSP from a nightmare scenario. But the identity providers remain blocked. And Apple has another list that spans multiple categories of ad tech and martech, meaning there's a potential expansion from a handful of scaled vendors to the entire ecosystem.
Three actions for the next two weeks:
Audit your DSP mix. Understand what share of your Safari inventory is served through TTD versus alternatives. If you're running significant spend through a blocked domain, your impression data is understating the problem.
Revisit your measurement setup. Impression data from affected campaigns may be understating delivery gaps. If your attribution model assumes delivery happened, your CAC calculations are off.
Accelerate your first-party data strategy. Platform-level blocks like this will keep coming regardless of how this specific case resolves. The teams that win are the ones with the clearest picture of their audience built on first-party signals, not third-party infrastructure that can be switched off by an OS update.
The Longer Game
Apple has always been willing to act as a Sword of Damocles over the ad tech industry. iOS 27 is a reminder that the sword can fall on delivery, not just targeting.
The industry adapted to ATT. It will adapt to this. But the adaptation path is narrower. When Apple blocked IDFA access, advertisers could still reach users through contextual targeting, probabilistic models, and first-party data. When Apple blocks ad serving domains, the only adaptation is to use a different ad server, one that Apple hasn't blocked yet.
That's not a privacy policy. That's a chokepoint. And the company controlling the chokepoint is now a scaled advertising business with $8.85 billion in US ad revenue and a record-setting services quarter.
Your CFO will ask what this means for CAC payback. The honest answer: we don't know yet. But the structural risk just increased. Model accordingly.
Your Safari inventory just became a variable you can't control. If you're running programmatic spend through The Trade Desk or any vendor Apple quietly blocked in iOS 27, your reach and frequency numbers are wrong right now, not 'slightly off,' wrong.
OpenAI's ad platform just went from $200K enterprise experiments to self-serve CPC bidding for any US business. I've pulled apart the mechanics, pricing, and measurement infrastructure, here's what the math actually looks like for your pipeline.
OpenAI's ad pilot hit $100 million in annualized revenue in under two months, with CPCs dropping from $60 CPM to $3-5 per click. The question isn't whether ChatGPT ads matter—it's whether you can afford to wait while competitors figure out the math.
