I’ve been thinking that SaaS companies that provide JS code to embed could work around this by letting you attach a subdomain; so instead Of the js pointing to say adroll.com, it would point to ads.adrollcustomer.com (with dns set up to goto adroll.)

This could probably work, but remember that there’s a lot of tracking that happens by programmatic ad exchanges. To get a sense of this, look at the dozens of sites in a media company’s ads.txt, e.g. https://cnn.com/ads.txt

A big player like Facebook could ask media companies to set up fb.cnn.com or similar, but I imagine this is where we start to enter “security vulnerability” territory, where Apple uses different heuristics to ban this approach.

Huh, OK thanks for explaining. I think I actually understand why this was happening with the particular WSJ guest pass I was getting, and how it can be fixed. Thanks!