Your dashboard didn't bark.

An iPhone on iOS 27 can't reach the servers behind UID2, ID5, LiveRamp, Permutive or Audigent, the ones that turn a login email into a tracking ID, so its bid request arrives with no ID. Your segments find nothing to match. Most DSPs skip a request they can't target rather than fail on it, so the budget flows to the browsers the ID layer can still see. Pacing holds. CPMs may even improve. The audience you lost was never recorded as lost. It was recorded as not there.

Sherlock Holmes once cracked a case on a dog that didn't bark. It stayed quiet because nothing unfamiliar had happened. Your dashboard is quiet for the same reason. The system did its job: skip the people it can't identify, bill you for the ones it can.

The Trade Desk took the loudest hit. Its ad server shared a domain with its cookie sync, so for about three weeks it couldn't render an ad in Safari on iOS 27 at all. Two agency buyers told AdExchanger their win logs show iOS 27 impressions that were won, paid for, and seen by no one.

1. Sept 14

   iOS 27 ships. Safari, and every WebKit browser on an iPhone, stops talking to an unpublished list of domains.

2. Sept 21

   The Trade Desk's Ian Meyers files WebKit bug 324771. On the list: UID2, ID5, LiveRamp, Permutive, Audigent (now part of Experian) and adsrvr.org, The Trade Desk's own ad server.

3. Sept 29

   AdExchanger breaks the story. The industry finds out from the trades, two weeks late. On October 2, AdExchanger reports a private list of hundreds more vendors, updatable without an OS release. Apple has not confirmed it.

4. Oct 19

   Apple's WebKit team explains itself: Safari blocks “identity resolution infrastructure,” the companies that turn the email you type into a login or newsletter form into a cross-site tracking ID. Domain level. iPhone, iPad, Mac and Vision Pro. No exceptions under Apple's policy, hashed email or not. No company named. No list published.

Apple has since handed The Trade Desk an iOS 27.2 beta that frees adsrvr.org. The identity domains stay blocked.

A company EMARKETER expects to book $8.85 billion in US ad revenue this year, which requires every browser on an American iPhone to run on its engine, and whose explanation points readers to Hide My Email, an iCloud+ feature from 99 cents a month, has ruled that other people's identity infrastructure is the privacy problem.

And it has a point. An email address is personal data whether or not you hash it; the FTC said so in July 2024. The hook behind the block sat in WebKit's public repository from February 13: eleven lines, one file, in plain sight for seven months. Google called off the cookie's execution in 2024. Apple then executed its replacement. The industry spent four years hedging the wrong platform.

The old joke: “Did you drop them here?” “No, but this is where the light is.” An ID-based campaign in October optimizes toward the browsers it can still see, then reports the keys were under the light all along. Three checks:

Why nothing here barked

You can't block a request we never make.

AMAP has never asked anyone for an email address. It reads the data signature of places: search listening, social listening, and public data like the Census and the CDC, aggregated at the census block group into cohorts of 100 or more households. No cookie, device ID, hashed email or mobile location panel enters the pipeline. A segment is a map. Maps don't sync.

On iOS 27 your DSP does with an AMAP cohort what it always did: checks whether the request is standing inside the geography, then bids or doesn't. Apple's list is a list of domains Safari refuses to call. We aren't on it. We were never called.

Frequently asked questions