A week of coverage of Safari’s iOS 27 blocklist has produced three different stories about what it cost. Digiday counted publisher revenue, AdExchanger counted attribution and unrendered impressions, and PPC Land counted how much of the proposed fix exists. Read together, they show that the damage depends on whose tags run in the browser, and that the answer to that question is not published anywhere.
The background is in our earlier reporting. Safari 27 Blocks Ad and Identity Domains, per a WebKit Bug Report covered the block itself, and WebKit Marks Trade Desk Domain Bug Resolved After iOS 27.2 Beta covered the status change on the one domain Apple has publicly revisited. This piece asks a different question: what do the trade press accounts add up to, and where do they disagree?
Three outlets, three measurements
Digiday’s Oct. 12 tally is a revenue story. It cites Aditude, a company that helps publishers sell ad space, reporting that Safari on iPhones and iPads accounts for 11.7% of the ads its customers show and 11.4% of their ad revenue. Among readers who had installed the update, eCPMs fell 10.5%. Only about 8% of users have upgraded, so Aditude puts the overall revenue effect at about 1% for now.
AdExchanger’s Oct. 8 report on vendor preparations is a measurement story. It says the original list included LiveRamp, Permutive, Audigent, the Unified ID 2.0 program and The Trade Desk’s adsrvr.org, and that iOS 27.2 beta removes adsrvr.org. It then argues that the initial focus on The Trade Desk obscured the effect on analytics and attribution, because marketers rely on identity providers for cross-channel matching. It also reports that two agency ad buyers saw win logs containing iOS 27 ads that did not serve, so some budget paid for impressions nobody saw. Its Oct. 9 Big Story adds that the domain block list is separate from a wider WebKit list spanning ad tech and martech categories.
PPC Land’s Oct. 10 analysis is a remedy story. It follows IAB Tech Lab chief executive Anthony Katsur’s posts urging publishers to move ad execution to Trusted Server, and it checks the claims against the project’s public repository.
Where the accounts disagree
On size. Digiday’s own sources do not agree with each other. Aditude measured a 10.5% eCPM drop among updated readers. Messer Media, a consultancy that advises publishers, noticed little immediate impact, and two senior commercial executives at news publishers told Digiday they had seen none. Andrew Casale, chief executive of Index Exchange, told Digiday his company has been largely unaffected because it is not in the identity business. The pattern across these sources is that the exposure follows the vendor stack, not the publisher’s size.
On what to count. Digiday counts ad revenue per thousand impressions. AdExchanger counts the things that sit behind a bid: identity matching, win logs, and who gets refunded when an ad was bought but not rendered. AdExchanger asks whether advertisers get paid back and answers only that it depends on the contract chain between publishers, SSPs, DSPs and advertisers. Neither outlet’s number can be added to the other’s, because one measures sell-side price and the other measures buy-side proof.
On readiness of the fix. Digiday’s Oct. 8 report quotes Rowena Lam, senior director of privacy and data at IAB Tech Lab: “Certainly, in this week, we’ve seen a big influx of publishers reaching out to get a better understanding of Trusted Server and or committing to deploying it to test.” Katsur, as quoted by PPC Land, described the software as “production ready TODAY!” The Tech Lab’s own Trusted Server page uses a more modest sentence: “Trusted Server is ready for Publishers to start testing.” PPC Land reports that the public GitHub repository, captured on Oct. 10, showed 343 commits and no published releases. Those three descriptions (production ready, ready to test, no release) can all be true at once, but they are not the same claim.
On timing. AdExchanger says iOS 27.2 might take three or four weeks to become the live install version, and that anyone downloading iOS 27 today still has The Trade Desk’s ads blocked. Digiday reports the fix is not expected to reach current users until the end of the month at the earliest. Both put the resolution of the one visible case weeks away, which means the early revenue numbers describe a small slice of devices running the original list. The size disagreement above is partly a disagreement about when each source looked.
Digiday also reports a second route. Justin Wohl, a vice president at Aditude, said its Prebid Server can process ad requests outside the browser and connect through APIs to identity providers including ID5, UID2 and LiveRamp. AdExchanger describes a third: vendors moving web publisher and ecommerce customers from third-party subscription software to a first-party native implementation, with Permutive rotating to a new domain as what a source described as a temporary patch.
What the coverage adds up to
All three outlets describe the same mechanism. Safari checks a request against a list of domains, and a domain on the list does not load. None of them can say what is on the full list, because Apple has not published it. PPC Land notes that Apple has not explained the list publicly, and AdExchanger reports that no Apple executive responded to its requests for comment.
That shared gap is the finding. Each outlet is measuring a symptom through a different instrument, since nobody outside Apple can see the cause. Aditude sees it as lower eCPMs. Agency buyers see it as unrendered wins. Publishers see it as a vendor that stopped working. The three symptoms will grow at the pace iOS 27 adoption grows, and Digiday’s 8% upgrade figure says the sample is still early.
The second thing the coverage shows is that every proposed fix has the same structure. Trusted Server, Prebid Server and first-party implementations all move a function from a third-party domain in the browser to a domain or server the publisher or vendor controls. Each one reduces the number of third-party domains a browser can refuse. None of them removes the dependency on a list nobody outside Apple can read, and none has yet reported results at scale. Stephanie Mazzamaro, head of revenue and data at Paradium.AI, told Digiday that an early Trusted Server adopter’s work remaining sits in “Viewability, verification, and getting buyers to accept our numbers.” That sentence locates the open problem on the buy side, which is where AdExchanger’s reporting also lands.
What it means for the marketing leader
The practical consequence is for people who buy and measure, not only for publishers.
- Ask for the domain list. Ask every vendor in your stack which domains its tags and identifiers load from on Safari, and whether any are among those reported as blocked (adsrvr.org, pippio.com, permutive.com and others named in the WebKit bug and in the trade reports).
- Audit win logs. AdExchanger’s reporting says wins can be recorded for ads that never rendered. Compare delivery reports against server-side or first-party logs for iOS 27 traffic before the quarter closes.
- Split reporting by OS version. Aditude’s 10.5% figure applies only to readers on the update. A blended Safari number will hide it until adoption grows, then show it all at once.
- Ask what “ready” means. When a vendor says its workaround is production ready, ask whether it has a tagged release, a live customer and published results.
Fourth quarter is when most budgets move, and the update is rolling out during it. The first two checks cost an afternoon. The cost of finding out in January is a full quarter of Safari spend measured with the wrong instrument.
Source: WebKit Bugzilla, bug 324771 and IAB Tech Lab, Trusted Server
