Oh, what a tangled WebKit we weave.
Earlier this week, AdExchanger reported that Apple’s iOS 27 update from two weeks ago quietly blocked a handful of programmatic data players – including The Trade Desk and its Unified ID 2.0 initiative, LiveRamp, ID5, Permutive and Audigent – from collecting data or serving ads on Safari. (They were also blocked on other mobile browsers, since browsers must use WebKit to launch on Apple devices.)
Now, according to two sources with direct knowledge of the WebKit updates, the initial list has been scrapped in favor of an expansive library of hundreds of CDPs, ad tech and mar tech companies, data sellers and ID graph operators.
These companies will exist in a purgatorial state of potential exclusion from advertising to or accessing people on Apple phones and computers, according to the sources. And only Apple seems to know what will get an ad tech vendor blocked or unblocked.
The full list of potentially blocked companies exists in a private GitHub repo, so it cannot be observed without access. One person with access to the full list did briefly allow AdExchanger to observe the list and read names off of it, but would not share it or allow it to be documented. Okay.
AdExchanger has reached out to the companies initially blocked by WebKit for comment and to see if they were aware of the update, but did not hear back in time for publication.
New kids on the block list
The sources who spoke to AdExchanger said Apple’s original list of blocked ad tech and data vendors is now moot, having been replaced by a longer list of companies that can be dynamically blocked by Apple.
The new dynamic process that WebKit uses to identify and block vendors relies on a remote list that Apple devices regularly call upon. Previously, Apple would need to roll out a new version of iOS to add or remove vendors from its list of blocked companies; now, it can just happen on the fly.
And vendors may not even be aware that they have been added to the list, or whether they have graduated from the intermediary “potentially blocked” list to being actively blocked.
The two sources with knowledge of the matter believe that the original vendors (TTD, LiveRamp, ID5, et al.) remain in essentially the same boat as they were earlier this week. As in, they are still blocked for Apple devices with iOS 27 installed.
But, while Apple’s new privacy mandate may have begun by blocking a handful of scaled, bigger-name companies, this new list suggests it has in mind potentially much broader, category-wide bans on CDPs, DMPs, DSPs and all of the other three-letter acronyms of ad tech.
Dip into the Apple WebKit GitHub update that is pertinent to the recent change, and one can see buried in the code the assignations Apple’s engineers are making.
A few of the calls made to the WebKit’s new blocking “ContentRuleList” to discriminate between vendors include: “isRequestToKnownCrossSiteTracker,” “!supportsFingerprintingScriptRequests” and “!supportsTrackingPreventionContentRuleListRequests.”
So, put the word out. Apple is coming, and not just for The Trade Desk.
However, AdExchanger is trying to confirm whether any Google property, including “ad.doubleclick.net,” which is still the domain name for Google’s cookie ID pool, is listed among Apple WebKit’s probationary list of hundreds of data vendors. It could be the case that Google is exempt.
Watch this space for more developments.
