Social Rocket
New publisher figures show for the first time how much Safari 27 could weigh on the advertising business of individual websites: At the monetisation service Aditude, revenue per ad opportunity on updated iOS devices fell by around 6 percent, and on Macs by 20 percent. The measurements published by Digiday on 27 October 2026 are an early warning signal – but no proof of a comparable slump across the entire advertising market.
Three metrics instead of a blanket Safari loss
For its client base, Aditude measures different effects: according to the report, average ad prices (eCPM) fell on iOS by 4 percent and on Macs by 11 percent. Revenue per ad opportunity fell more sharply, by 6 and 20 percent respectively. The latter figure also takes into account whether an ad opportunity is monetised at all. A falling eCPM and falling fill rate can therefore reinforce each other.
At the same time, the reach of the affected software is still limited: according to Aditude, 30 percent of impressions in its client base come from WebKit browsers, but only 3,8 percent of all impressions come from the newer WebKit version. The corresponding share of Prebid revenue is 3,3 percent. The figures describe Aditude clients, not all German publishers. Changes in advertising demand, seasonal budgets and technical integrations may also influence the differences observed.
To draw reliable conclusions, media teams should therefore evaluate bid rate, eCPM, fill rate and revenue per ad opportunity separately by browser, operating system version and period. Revenue trends alone do not yet prove how much of the change was directly caused by Apple's block.
What Apple actually blocks – and what it doesn't
The root of the debate is the new network block against certain identity resolution services in Safari 27. In its WebKit post of 19 October, Apple explains that such providers can recognise users across multiple websites via email addresses or other signals. The company intends to prevent this identity linking; personalisation within a company's own customer relationship remains possible, according to its description.
The distinction between addressability and ad delivery is important. The blocking of a The Trade Desk domain for actual ad delivery was reported as fixed on 9 October after a documented bug. The blocks against certain identity infrastructures remain the bigger topic. We classified the technical sequence and the bug fix in our Safari-27 background report.
A price gap is not proof of damage
The data provider Permutive cites a second figure in the Digiday analysis: across 569 million won bids for more than ten publishers in August, Safari inventory averaged 42 percent below the price of Chrome inventory. However, this analysis comes from a period before the rollout examined here and compares different browser environments. The 42 percent therefore must not be presented as an additional loss caused by Safari 27.
The higher CPMs reported by Permutive when using publisher-side audience data are also provider statements, not an independently confirmed causal impact study. They illustrate a possible alternative, not automatically a new revenue guarantee.
Update of 28 October: Trusted Server is infrastructure, not a privacy exemption
Following the new report by Digiday, providers such as ID5 are increasingly testing server-side identity integrations. Instead of running third-party scripts in the browser, functions could run through publisher infrastructure. Providers hope this will reduce their dependence on browser blocklists. However, this shift does not automatically make the underlying data processing permissible.
The open-source project Trusted Server from the IAB Tech Lab goes beyond identity resolution: under the publisher's control, it is meant to process ad requests and Prebid auctions, evaluate consent signals, and run less third-party code directly on the device. The public project documentation describes the technical building blocks. At the same time, the website notes that parts of the documentation may describe behavior that has not yet been released. An active repository does not mean proven production use at large scale.
For German publishers, purpose limitation is the decisive point. A first-party server that processes a site's own ad decisions and valid consents is not the same as a server that secretly links people back together across third-party websites. That latter form of identity linking is exactly what Apple's WebKit statement of 19 October is aimed at. Where the computation happens does not replace checking the legal basis or contractually controlling the data recipients.
Before migrating, publishers should compare not only the browser failure rate but also infrastructure costs, latency, consent logs, data flows, notice periods and net revenue after fees. Smaller sites in particular can lose more through additional server and implementation costs than they recover through higher bids. Our analysis of the Prebid Summit on server-side adtech infrastructure fits here.
What German publishers should test now
A meaningful test separates four levels: (1) technical delivery, (2) demand and bids, (3) actually sold impressions and (4) net revenue after technology fees. This requires control groups with comparable sites, placements and time windows. Our article on DSP and reseller fees shows why gross CPMs are not enough for this. The planned changes to Prebid auctions are a further infrastructure trend, separate from this.
What remains open is the effect on German websites, the adoption of the corrected Safari versions, and the long-term advertising effects. What is established so far: the measurements show risks to publisher revenue, while Apple's privacy rationale and the economic impact must be assessed independently of each other.
Image: IAB Tech Lab, official Trusted Server project graphic.