iOS 27 and the Deal That Never Touches the Browser
Apple's Safari 27 blocklist, and the WebKit post that now explains it, make the practical case for agentic advertising: a deal that never touches the browser cannot be switched off by the browser.
On October 19, 2026, Apple's WebKit engineers published their rationale. Safari 27 blocks network access to what Apple calls identity resolution infrastructure: third-party services that collect an email address at login or newsletter signup, link a persistent tracking ID to it, and build identity graphs across sites and devices. Apple's position is that blocking cross-site cookies six years ago was not enough.
What did iOS 27 block in Safari?
Safari 27 refuses every request to domains Apple classifies as identity resolution infrastructure. Apple says the block applies in Safari and WebKit across iOS, iPadOS, macOS and visionOS 27, and works at the registrable-domain level, so a vendor cannot restructure requests around it. iOS 27 began rolling out on September 14, 2026. Domains reported blocked include The Trade Desk's adsrvr.org and domains belonging to Unified ID 2.0, LiveRamp, ID5, Permutive and Audigent.
The Trade Desk's cookie-matching subdomain and its ad-serving hosts share the registrable domain adsrvr.org, so the entry took ad delivery down with it. The company filed a bug with WebKit on September 21, and in early October Apple asked it to test an iOS 27.2 beta. As of this writing that release is still in beta, and the identity vendors stay blocked whatever happens to adsrvr.org.
One entry can stop a campaign because, on the web, the browser is the runtime for the programmatic transaction. The bid request, the identity sync, the creative fetch and the impression beacon are each a call from the page to a third-party domain. The buyer and the publisher have contracts with their partners. Neither has one with the browser.
Is moving the auction server-side enough?
Moving the auction to a publisher-controlled server removes the browser's veto over the bid, but it leaves the transaction unchanged. The industry's immediate response is to shift vendors to first-party implementations and move programmatic calls off the page, as IAB Tech Lab's open-source Trusted Server project does. That protects the pipe, not the deal running through it: a per-impression auction valued largely on whether an identifier is present.
Apple has already answered the obvious workaround. The WebKit post says that even when an identity graph is scoped to a single company's data, the central resolver is still a third party holding cross-site, cross-device and cross-party data, able to match and target like a clearinghouse. In Apple's view that is a tracking capability no first party has on its own, and it is part of what the block is meant to remove. The one thing Apple says it will leave alone is first-party personalization: what a publisher knows about its own users, held and used on its own property.
How does an agentic buy reach the publisher's ad server?
In an agentic buy, the buyer's agent and the publisher's seller agent agree the deal server to server, and the order is trafficked into the publisher's ad server. People set the outcome, the budget and the approval thresholds. Agents do the execution; delivery and reporting come from the publisher's own ad server.
| Step | Browser-based programmatic | Agentic direct buy |
|---|---|---|
| Where the deal is struck | In an auction triggered from the page, per impression | Between two agents, server to server, before delivery |
| Buyer's footprint in the page | Bidder, sync and serving domains | None for the transaction |
| What targeting depends on | An identifier passed in the bid request | The publisher's first-party audiences and context |
| Where the ad is served from | The buying platform's ad-serving domain | The publisher's ad server |
| System of record | Win logs, reconciled across the chain | The ad server that delivered the impression |
The targeting row is where Apple's post and this model line up. First-party personalization, which Apple says it will not block, is what an agentic buy runs on, with no third-party resolver in the path.
Adgentek builds both ends of this path. Adgentek ORCA is the buy-side platform brands and agencies use to direct coordinated agents toward a declared outcome. On the sell side, Adgentek hosts a seller agent for each publisher, in front of the Adgentek Platform, the company's agentic ad server, or the ad server the publisher already runs. For AI surfaces, where targeting draws on the conversation rather than a cross-site identifier, this is already the native model.
What does agentic buying not fix?
It does not take the ad off the device or bring identity back.
- The ad still loads on the device. The creative and the impression call still originate in the page, now through the publisher's ad server. Blocking that server takes down the publisher's whole ad business rather than one buyer, a far heavier step.
- Cross-site and cross-device identity do not come back. Targeting moves to what the publisher knows first-hand and to the context of the session. A publisher whose first-party audiences are built by a third-party resolver is inside Apple's definition, whatever the contract calls it.
What should publishers and buyers do now?
Start by mapping how much of your revenue or delivery depends on a third-party domain loading in a browser you do not control. From there, the work divides by side.
- Publishers: list every identity and data vendor in the stack and the revenue attached to each. Then ask the question Apple's post forces: which of them run a central resolver, whether or not it is scoped to your data alone. A first-party wrapper around a third-party resolver is not a safe harbor. Keep your own audience data on your own property, and stand up a server-to-server path for direct demand so buyers can reach your ad server without placing anything of their own in the page.
- Buyers: run the same campaign three ways, through the open auction, through a deal ID and as a direct agentic buy. Compare the cost of media, delivery against plan and the effort it takes to reconcile the invoice. The direct path will not win every comparison, but you will learn which parts of your spend depend on a domain the browser can remove.
- Both: insist on open standards for the agent connection. A direct path that only works with one vendor is another single point of failure, one level up from the one Apple just exposed.
To see a seller agent and Adgentek ORCA complete a working buy, write to hello@adgentek.ai.
