Apple is implementing a broader, remotely updateable enforcement campaign within WebKit, potentially disrupting access for hundreds of ad-tech and data firms on iPhones and Macs amid increasing opacity and categorisation-based restrictions.
Apple is widening a quiet enforcement campaign inside WebKit that could cut off access for a far larger swathe of ad-tech and data firms on iPhones and Macs, according to AdExchanger and people familiar with the browser engine changes. What began as a small set of named companies now appears to have become a broader, dynamically updated system that can place hundreds of ad-tech, martech and data businesses into a state of uncertainty over whether they can operate on Apple devices.
The initial scrutiny fell on companies including The Trade Desk, LiveRamp, ID5, Permutive and Audigent. AdExchanger reported that those firms were placed under restrictions in iOS 27, affecting data collection and ad delivery in Safari and, because all browsers on Apple devices must use WebKit, in other mobile browsers as well. Separate reports from ad-tech outlets said The Trade Desk’s adsrvr.org domain was among those blocked, disrupting ad requests for Safari users on updated devices.
According to AdExchanger’s latest reporting, Apple has since replaced that narrower approach with a much larger private list that can be updated remotely. That change matters because Apple no longer needs to issue a new iOS build each time it wants to add or remove a company. Instead, devices appear to consult a server-side list, allowing Apple to alter access on the fly and, in effect, keep vendors guessing about whether they are merely flagged for review or already blocked.
The internal logic visible in the WebKit code suggests Apple is using a more category-driven assessment than before. AdExchanger said the code includes checks such as “isRequestToKnownCrossSiteTracker” and tests for whether a service supports fingerprinting-related requests or tracking-prevention content-rule requests. That points to a policy that could extend beyond a handful of large names and into wider classes of identity, data and audience businesses, including customer data platforms, data-management platforms and demand-side platforms. The publication also said it was still trying to determine whether any Google properties, including ad.doubleclick.net, are on the list, although that remains unconfirmed.
For advertisers and vendors, the practical problem is not just blocking but opacity. Companies may not know whether they are on the provisional list, whether they have been fully blocked, or what change would restore access. The Trade Desk and others have been reported as having raised the matter with Apple’s WebKit team, but no public resolution has emerged. If Apple is indeed moving towards category-wide exclusions, the immediate issue is less about one company’s access and more about a broader reordering of who can reach users through Apple’s browser stack.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
