Developing
The essay promotes IAB Tech Lab's own Trusted Server project, and several claims go beyond the public record.
In 60 seconds
- Rowena Lam of IAB Tech Lab wrote on October 13 that a WebKit change in iOS 27 and macOS 27 added a domain-level blocklist aimed at ad tech and identity vendors.
- She says the list is not public, added domains are not notified, and there is no formal appeal.
- PPC Land notes that WebKit bug 324771 lists nine domains (one a test fixture), covers Safari 27 on iPhone and iPad, and says nothing about macOS.
- Apple has not commented, and the code for a remotely updated list had not shipped, per Digiday.
Impact Layer
- What changed
- The ad industry's standards body is arguing publicly that bidding and identity should move out of the browser.
- Why it matters
- If Safari blocks requests to ad and identity domains, those vendors lose reach on a large share of web traffic and buyers lose signal.
- Who is affected
- Publishers, DSPs, identity providers and anyone who sells or buys Safari inventory.
- Martech stack area
- Advertising, Data
- Stack impact
- Test your ads and identity calls on iOS 27 devices, and check whether any of your vendors' domains appear in the public bug report.
- Business impact
- Moderate PPC Land's analysis of an opinion essay by an author whose employer sells the proposed remedy. Evidence for the macOS and remote-update claims is missing from the public record.
- Related technologies
- What to watch
- Apple's response, the iOS 27.2 release and whether a remotely updated list ships.
On October 13, 2026 Rowena Lam, senior director for privacy and data at IAB Tech Lab and lead on its Trusted Server project, published an essay titled “Apple’s WebKit Updates Mean Advertising’s Future is Server-Side”. PPC Land analysed it on October 14.
What the essay claims
- A WebKit update with iOS 27 and macOS 27 added a domain-level blocklist aimed at major ad tech players, DSPs and identity providers.
- An unreleased WebKit change would let Apple add vendor domains remotely, without a new OS version.
- The list is not public, added domains are not notified and no appeal process appears to exist.
- Her proposed answer is to move bidding and identity into a publisher-controlled edge runtime.
What the public record shows
- WebKit bug 324771, filed by The Trade Desk’s Ian Meyers on September 21, 2026, lists nine domains. One looks like a test fixture; the others map to Unified ID 2.0, The Trade Desk, ID5, LiveRamp, Permutive and Audigent.
- The bug documents Safari 27 on iPhone and iPad. It says nothing about macOS.
- On October 5 Apple’s John Wilander asked Meyers to test an iOS 27.2 beta. The DSP has since been removed from the list in that beta; identity vendors remain blocked.
- Apple has not publicly commented. Digiday reported on October 7 that the code for a dynamic list had not shipped.
Not stated
Any evidence that macOS is affected, any speed or privacy measurement for the server-side approach, and any hosting cost estimate. The essay also does not mention that Trusted Server is an IAB Tech Lab project.
Our read
The block is real for the vendors named in the bug. The larger claims are not yet backed by public evidence, so treat the essay as an argument, not a finding.
Sources
- PPC Land: IAB Tech Lab says Apple can block ad vendors remotely with no appeal (opens in a new tab)
Source for the essay's claims, the WebKit bug record, the timeline and the gaps.