Apple iOS 27 WebKit Block List Threatens Programmatic Ad Ecosystem

Apple's Safari Block List Is Real, Partially Walked Back, and Still Dangerous

Apple shipped a block list inside WebKit, Safari's browser engine, that prevents named ad-tech and identity companies from collecting data or serving ads. The Trade Desk (the largest independent ad-buying platform), its Unified ID 2.0 cookie-replacement identity solution, ID5, LiveRamp (which sells web identity infrastructure), Audigent, and Permutive all appeared on the first version. Apple then quietly removed The Trade Desk's ad-serving block in the next test build. A second, broader list covering whole categories of ad-tech remains, and operators can't see it without decompiling Apple's source code. iOS 27's general release is the deadline. When it ships, test-build behavior becomes live behavior on hundreds of millions of phones.

The partial walk-back on The Trade Desk is meaningful evidence. That is not the move of a company sure of its legal footing. Apple is already under EU Digital Markets Act scrutiny, and a secret list that excludes named competitors while Apple Search Ads grows is a legally exposed position. The contrarian case is that 80% of this gets walked back or lands in regulatory limbo before iOS 27 ships broadly. Both things can be true: Apple folds on named, well-lawyered targets and holds on category-level blocks where there's no single plaintiff with standing.

Who loses

LiveRamp is the most exposed public name. Scott Howe's company sells web identity as infrastructure, and that infrastructure only works if Safari stays addressable. There is no consent pathway for users to opt back in, which is what makes this different from Apple's 2021 tracking prompt. In 2021, users could say yes. Now there is no yes to give. Wall Street's multiple on LiveRamp was built around ignoring a ceiling that the no-consent mechanism just made real. Private names like ID5 and Permutive face the same structural problem, which becomes the first question in the next funding round.

The quieter victims are publishers. Once DSPs start systematically discounting Safari bids because audience addressability is unreliable, CPMs fall for any publisher leaning on Safari traffic. Safari's audience skews older and higher-income. That is the exact demographic publishers charge a premium for, and the CPM compression hits regardless of which identity vendors survive the legal fight.

Who is fine

The Trade Desk's business runs on connected TV and open-web display bought through its DSP, not on Safari web impressions, which buyers had already discounted through years of Apple's earlier tracking limits. Apple also already removed its ad-serving block. For The Trade Desk to take a meaningful revenue hit, Safari web identity would have to be a much larger share of DSP spend than any public evidence suggests, and Apple would have to hold the block against the exact company it already exempted.

The call

The Trade Desk's full-year 2026 revenue, reported in February 2027, will be higher than its 2025 revenue despite the iOS 27 block list. Confidence is medium. CTV scale and the partial Apple retreat make the bear case hard to construct. We're right if The Trade Desk reports 2026 revenue above 2025 on its Q4 earnings call. We're wrong if it comes in flat or below.

The structural point stands independent of that call: Safari web identity is impaired regardless of how the legal fight resolves. Pulling one vendor off the list doesn't restore addressability across the board, and the undisclosed second list means you cannot plan around rules you cannot read. Verify your own Safari impression exposure by vendor before the general release. Stop building roadmap bets on cookie-adjacent Safari identity.

Apple shipped a block list inside Safari's engine in iOS 27 that stops named ad-tech and identity companies from collecting data or serving ads at all. The Trade Desk, its Unified ID 2.0 (the cookie replacement that stitches a user to an encrypted email), ID5, LiveRamp, Audigent, and Permutive were on the first list. Apple then quietly pulled The Trade Desk's ad-serving block in the next test build. A second, broader list covering whole categories of ad-tech and marketing-tech remains, and nobody can see it without decompiling Apple's source code.

What's actually being decided here isn't Apple's policy. That's Apple's call and it's hard for anyone else to undo. What operators are deciding is how much of their Safari-dependent business to keep betting on, and how fast to move revenue and roadmap elsewhere. The deadline is set by the iOS 27 general release, when the test-build behavior becomes the behavior on hundreds of millions of phones.

The Market Analyst starts with the obvious trade: The Trade Desk's stock. It's the wrong one. Jeff Green's DSP has the scale and the CTV business to eat Safari deterioration. LiveRamp is the exposed name. Scott Howe's company sells web identity as plumbing, and that plumbing only works if Safari stays addressable. No consent pathway means no release valve, so the revenue line tied to Safari-touchable audiences has a ceiling the market built its multiple around ignoring. In plain terms: Wall Street is pricing this like a rerun of Apple's 2021 tracking prompt, where users could still say yes. This time there's no yes to give. Private names like ID5 and Permutive feel it in the next funding round, where "what's your Safari plan" becomes the first question.

The Skeptic notes that Apple already pulled The Trade Desk's ad-serving block in the next beta. That is not the move of a company sure of its legal footing. Apple is under the EU's Digital Markets Act microscope right now, and shipping a secret list that excludes named competitors while it grows Apple Search Ads is either reckless or a negotiating chip. Safari's open-web ad share is already degraded from years of Apple's earlier tracking limits; smart buyers have discounted it for ages. The undisclosed second list may be a developer artifact from internal testing, not declared policy. The contrarian read: this is 80% walked back or stuck in legal limbo before iOS 27 ships broadly, and the revenue hit lands as a rounding error.

The Operator puts it plainly: the nightmare is that you don't know you're blocked. Revenue on Safari starts bleeding and your team burns two weeks ruling out bid problems, DSP config, and publisher setup before anyone thinks to decompile WebKit. Yield and traffic teams need Safari impression monitoring by vendor, broken out, now. For buyers running UID2 audiences, Safari targeting goes unreliable in ways that don't show up cleanly in a dashboard. At 90 days the second-order move hits: DSPs start systematically discounting Safari bids, which pushes down CPMs for any publisher still leaning on Safari share. And Safari share skews older, higher income, premium. The exact audience premium publishers charge for.

The Strategist sees Apple doing what Apple always does: using control of the platform to starve a competing ecosystem while feeding its own. The 2021 tracking prompt was opt-out theater. A domain block list is exclusion at the infrastructure level with no consent, no appeal, no disclosure. Over two to three years this accelerates two shifts. Buyers consolidate into walled gardens because open-web Safari inventory gets too unpredictable to model. And identity built on cookie-adjacent signals on Safari drifts toward zero practical value, shrinking the addressable market for ID5, LiveRamp's web layer, and UID2 on Apple devices. The winner isn't Google. It's Apple Search Ads and contextual players that never needed a user ID in the first place.

Where they split

The real disagreement is enforcement. The Skeptic thinks Apple blinks, because it already did on The Trade Desk and because Brussels is watching. The Strategist and Market Analyst think the architecture is the point, and that even partial, category-by-category enforcement permanently reprices Safari web identity. Both can't be right.

The second split is who absorbs the hit. The Market Analyst says The Trade Desk is fine and LiveRamp is exposed. The Operator says the quiet victims are publishers, who eat lower Safari CPMs no matter which vendors survive, and the smaller identity firms that can't afford the fight.

What it hinges on

Two things. First, does Apple hold the line or fold under DMA pressure? The partial walk-back on The Trade Desk is real evidence it folds under named-competitor scrutiny. Second, does the hit concentrate on a few identity vendors or spread to publisher CPMs broadly? The no-consent mechanism is what makes this different from 2021, and it's the one fact analysts anchored on the old playbook are underweighting.

The council leans one way on the thing that matters for operators: Safari web identity is structurally impaired regardless of how the legal fight ends. Apple pulling one block doesn't restore the addressability, and the secret second list means you can't plan around rules you can't read. Verify your own Safari exposure by vendor before the general release, and stop underwriting roadmap bets on cookie-adjacent Safari identity.

The call

Prediction: The Trade Desk's full-year 2026 revenue, reported in February 2027, will be higher than its 2025 revenue, despite the iOS 27 Safari block list.

Confidence: Medium. CTV and DSP scale swamp Safari web exposure, and Apple already pulled The Trade Desk's ad-serving block.

Why: Apple named The Trade Desk on the first list, which is what spooked the market, but then removed its ad-serving block in the next test build. That partial retreat is the behavior of a company that knows a secret competitor-exclusion list is legally exposed under the EU's Digital Markets Act, and it tells you enforcement against the largest, best-lawyered name is the hardest for Apple to hold. More to the point, The Trade Desk's business runs on connected TV and open-web display bought through its DSP, not on Safari web impressions, which were already degraded by years of Apple's earlier tracking limits and discounted by buyers accordingly. For 2026 revenue to come in below 2025, Safari web identity would have to be a bigger chunk of the DSP's spend than any public evidence suggests, and the block would have to hold against the exact company Apple already exempted. Both have to be true, and neither looks likely.

Revisit by 2027-02-28: We're right if The Trade Desk reports full-year 2026 revenue above its 2025 figure on its Q4 2026 earnings call. We're wrong if 2026 revenue comes in at or below 2025.

The exposed name is still LiveRamp, whose web identity line has no CTV cushion to hide behind. But the cleaner, gradeable call is that the company everyone pointed at on day one comes through the year growing.