Apple's secret blocklist lands on identity vendors

Apple's iOS 27 updates, released in mid-September, cut off companies that track people around the web: once installed, Safari stops talking to them altogether, so they cannot collect data or serve ads. The first names caught are among the biggest in identity: The Trade Desk, LiveRamp (soon to be owned by Publicis Groupe), ID5, Permutive and Experian's Audigent. Digiday ran its own test of more than 70 ad tech domains and found only that first handful blocked; Zeta's LiveIntent, Publicis Groupe-owned Lotame and Yahoo's ConnectID got through untouched. Apple has also written code into WebKit, the engine powering Safari, that will let it add companies whenever it likes without waiting for a software update, and because Apple requires every browser on iPhone and iPad to run WebKit, Chrome and Firefox are caught up too. Rowena Lam, senior director of privacy and data at IAB Tech Lab and product lead for its Trusted Server initiative, said: "What this will allow Apple to do is make this block list dynamic." The blocklist is reportedly held in a private GitHub repository, and it has already been edited: The Trade Desk's ad server has been removed from the list in a test version of iOS, though users on the current version will not see the fix until the end of the month at the earliest. Tipsheet separately reported the same fix, noting Apple shipped an update to reinstate ad serving on the Trade Desk's adsrvr.org domain while its UID2 domain remains blocked. The news broke too late for the Advertising Week New York agenda, a four-day conference drawing nearly 20,000 people, so it was picked apart off the record all week. Scott Messer, principal and founder of the publisher ad tech consultancy Messer Media, told Digiday the impact on the sell side has been limited by low adoption of the latest Apple software, but asked: "You have to ask yourself: 'Was this a mistake, or was this intentional, and Apple knew exactly what they were doing?'" Jay Friedman of Cartograph was blunter: "This was clearly not a mistake [from Apple], because mistakes tend to be random... all this does is begin a massive game of cat and mouse as all these companies adapt."

The crux

The gatekeeper has shifted from blocking trackers to blocking companies, and a browser-level blocklist that is neither published nor appealable removes a publisher's ability to negotiate its own addressability on Apple devices at all.

Sell-side read

Treat iOS addressability as a variable you no longer control. The sell-side hedge is first-party, logged-in and contextual inventory that does not depend on a named identity vendor resolving in WebKit, and any deal whose yield model assumes a specific ID partner carries a platform risk you did not price.

Watch

whether Apple publishes the list or a vendor obtains a reversal in the next two quarters; any confirmation turns an off-the-record storm into a documentable scope change for 2027 rate cards.