IAB Tech Lab promotes Trusted Server after Safari block, but project still lacks a formal release

IAB Tech Lab is promoting Trusted Server more aggressively as an answer to Safari 27’s blocking of advertising domains. The open-source proposal moves auctions, requests and part of ad delivery out of the browser and into infrastructure controlled by the website itself. The idea gained urgency after adsrvr.org, a domain The Trade Desk uses for ad requests and delivery, appeared among addresses unconditionally blocked by WebKit on iPhones and iPads running iOS 27.

The confirmed event is documented in a public WebKit issue filed on September 21, 2026. The report describes requests being blocked during ordinary browsing, not only in private mode, and identifies nine domains. Its author, an engineer at The Trade Desk, argued that eight of the addresses were associated with post-cookie identity services, while adsrvr.org also performed a central ad-delivery function. A WebKit engineer replied that the case was under investigation.

The record was updated on October 5, when a WebKit engineer asked the company to test a new iOS 27.2 beta. The Trade Desk replied that it could see changes in the build and would conduct further testing. That exchange is not confirmation of a permanent fix. As of the October 10 review, the issue remained open, marked P1, with no public resolution.

Why Trusted Server returned to the center of the debate

The block exposed digital advertising’s structural dependence on the browser. When scripts and requests travel directly from a reader’s device to third-party domains, the browser can identify and stop those connections. Trusted Server proposes a different design: the device communicates with the publisher’s domain, while an edge proxy performs advertising tasks and contacts partners on the server side.

According to IAB Tech Lab, the architecture supports server-side auctions, Prebid Server integration, creative delivery and signal processing in a first-party context. The public repository describes a core written in Rust, compiled to WebAssembly and adaptable to edge-computing providers or container environments. The code is distributed under the Apache 2.0 license, allowing inspection, modification and redistribution under its terms.

The institutional claim is that this model gives publishers more control over data, security and performance. That is a statement from the organization responsible for the project, not an independent conclusion about results at scale. Moving functions to a server may reduce exposure to blocklists based on third-party domains, but it also transfers operating costs, integration work and responsibility to publishers. Processing in a first-party context also does not remove requirements for consent, purpose limitation and data protection.

The gap between active code and product maturity

Anthony Katsur, IAB Tech Lab’s CEO, said on October 8 that Trusted Server was ready for production. The public materials support a more cautious reading. The official project page says the proof of concept is complete, but describes the minimum viable product as “in progress” and ready for more publishers to test. The repository displayed 343 commits and detailed technical documentation, yet no formal version appeared in its releases area.

Those signals do not prove that the software cannot be deployed. They show that active development and deployability are not the same as a stable distribution with a version number, support cycle and widely demonstrated operating history. The absence of a release can also make it harder for outside teams to pin a version and track changes predictably.

The episode broadens a dispute over web governance. Apple controls Safari’s network behavior on iOS, while advertising organizations are trying to reduce that dependency through their own infrastructure. Trusted Server may change where technical decisions are executed, but it cannot by itself resolve the conflict among privacy, content funding and platform power. For now, the verified picture is an open project with a concrete architecture, increased interest reported by its maintainer, and unresolved questions about maturity, adoption and consequences for users.