Germany Forces Apple to Level Its Tracking Consent Prompts in ATT

Germany's antitrust regulator, the Bundeskartellamt, has closed its investigation into Apple, which had been running since June 2022. The complaints concerned the Apple Tracking Transparency Framework (ATTF) — the set of rules under which third-party apps on the iPhone and iPad must obtain a user's consent to use their data for personalized advertising.

The crux of the objections was that these rules did not apply to Apple's own services. For cross-company data use, third-party developers must obtain not only consent under data protection law but also an additional confirmation through a dialog predefined by Apple. Its own apps, meanwhile, Apple served within its own ecosystem and through its own prompt.

What the difference was

By the authority's preliminary assessment, the differences between the two dialogs went beyond what could be explained by the specifics of data processing. The wording, design and choices in Apple's prompt were arranged so as to nudge users toward consent, whereas the dialog for third-party apps tended to discourage it. What is more, external apps sometimes had to ask for consent several times, even when the user had already granted it in accordance with data protection law.

Bundeskartellamt President Andreas Mundt stressed that Apple is entitled to provide privacy protection above the statutory minimum, but under a special provision of German law for large digital companies (Section 19a GWB) it may not place its own offerings in a more favorable position than those of competitors. Apple's dual role — as owner of the operating system and the App Store and, at the same time, provider of its own apps and advertising space — is precisely what falls under the heightened oversight.

What will change

Apple maintained that the ATTF complies with antitrust law and serves to protect privacy, but it offered commitments that the regulator has now made binding. The company will align the consent dialogs for its own and third-party apps, remove potentially off-putting symbols and wording, and make the design neutral. Developers will be given more freedom to explain to users what personalized advertising means for their business model and to combine Apple's mandatory prompt with requests under data protection law.

Mundt made a particular point of noting that the goal is not to secure the maximum number of consents, but to ensure that the decision is free and informed — declining should be just as easy as agreeing.

Apple was given four months to implement the changes; the commitments run for seven years under the supervision of an independent trustee. The German decision is part of a Europe-wide dialogue within the ECN network: the French and Italian regulators had earlier already fined Apple over the ATTF, €150 million and €98.6 million respectively.

Source: Hacker News