Apple forced to restructure ATT

Yesterday, the German competition authority, the Bundeskartellamt, concluded its antitrust investigation into Apple’s App Tracking Transparency (ATT) framework after Apple agreed to legally binding changes to the ATT prompt and related consent design. From the Bundeskartellamt’s press release (emphasis mine):

Apple’s ATTF introduced rules for third-party app providers on the use of data on iPhones and iPads. For specific forms of cross-company data use, third-party app providers must obtain not only user consent under data protection law, but also additional consent through a prompt that is predefined by Apple. However, these ATTF rules do not apply to Apple’s own offerings; Apple uses user data from its own ecosystem and therefore its own prompt to request user consent to personalised advertising …

In the Bundeskartellamt’s preliminary assessment, competition law generally also allows powerful companies such as Apple to take measures to protect their users’ privacy. However, the differences between the consent request used for Apple’s own offerings and the consent request predefined by Apple for third-party apps exceeded what could be justified based on differences in types of data processing. The wording, design and selection options of the request used for Apple’s own offerings had the potential to encourage users to give their consent, whereas they had the potential to discourage consent for third-party apps. In addition, third-party apps in some cases had to request consent several times even when users had already given data protection law-compliant consent.

The French competition authority came to a similar conclusion in March 2025, as I documented in ATT, antitrust, and Apple’s privacy options. What makes this decision more meaningful, however, is that the French penalty involved only a (relatively paltry, by Apple standards) €150MM fine, with no specific changes to ATT being mandated. The Bundeskartellamt has secured meaningful concessions from Apple related not only to the design of the ATT prompt but also to developers’ ability to bundle various other data-access consent requests — mandated by EU law — with it. Also from the Bundeskartellamt’s press release (again, emphasis mine):

Under the commitments that have now been declared binding, Apple will align the consent prompts for its own offerings and for third-party apps much more closely. This involves removing possibly discouraging symbols and wording in Apple’s predefined requests for third-party providers. The design of the consent prompts will be neutral in terms of content, wording and layout. In addition, app publishers and content providers, such as media publishers, will be given more scope to explain to users what significance personalised advertising has for their offering and their business model.

Under the commitments, Apple will also reduce the complexity of the current consent request architecture for third-party providers. In particular, app publishers will be given more freedom to combine the consent request required by Apple with the consent requests required under data protection law or connect them in a way that is clear to users. The improved conditions may also benefit advertisers and technical service providers to the advertising industry.

Apple now has four months to implement these changes, and the commitments will remain binding for seven years.

My principal opposition to ATT when it was announced was the clear self-preferencing that Apple applied to its own advertising mechanics, including the opt-in prompt, as well as the static, intimidating, and context-free nature of the ATT prompt. I discussed this discrepancy at length in ATT advantages Apple’s ad network. Here’s how to fix that, published in November 2021. From that piece:

The language that Apple uses to collect consent from users for ads targeting is vastly different from the language that is mandatory in the ATT consent prompt (as contrasted at the top of the article). Developers are only able to customize the supporting text under the ATT prompt headline, but the headline itself cannot be modified: App Name would like permission to track you across apps and websites owned by other companies. Apple’s own opt-in prompt describes its collection of data from apps that it does not own, through its App Store payments processor, for the purposes of ads targeting as “personalization.” … [t]he personalization framing is, subjectively, less intimidating than the tracking framing, and it also implies consumer benefits (relevant advertising) whereas tracking does not.

The UK’s Competition and Markets Authority (CMA) also raised objections to the “choice architecture” deployed in the design of the ATT prompt, as it notes in Appendix J of its Mobile ecosystems market study, on which I consulted. From page J21 of that appendix:

These are valid concerns that, in my view, were not taken seriously at the time. The German commitments, the French and Italian decisions, and potentially the outcomes of similar antitrust investigations underway in Poland and Romania make clear that these issues constitute serious antitrust concerns across major European markets. The agreed-upon remedies that will be deployed in Germany will address that.

The larger question is what impact these forced changes to the ATT prompt will have on the digital advertising market. In ATT, antitrust, and Apple’s privacy options, and also in Could ATT be rolled back?, published in March 2025, I predicted that Apple would be forced to “harmonize” the consent prompts between ATT and its own use of data for advertising targeting, which has now materialized in Germany. From ATT, antitrust, and Apple’s privacy options:

There are two interesting consequences of this and future decisions to consider. The first is whether Apple will be forced to jettison ATT altogether. I don’t think it will; as I argued in Could ATT be rolled back?, since the French and German cases are predominantly concerned with the discordance between Apple’s own “personalized advertising” prompt and the ATT prompt, I think Apple can merely harmonize these to mostly satisfy the authorities’ concerns (France’s digital privacy authority, the CNIL, noted in its own investigation of the ATT prompt that Apple could make “marginal modifications to the framework” to satisfy GDPR compliance). ATT has been live on iOS for nearly 4 years; while Apple may be required to alter various aspects of the framework, I don’t believe it will be forced to abandon it. To be definitive: I don’t think that ATT is going anywhere.

I believe the agreed-upon changes to the ATT prompt, as well as the ability for developers to bundle other data-use consent requests with the ATT prompt, will nudge opt-in rates upward by a non-trivial amount. Apple has stated that the changes will apply in almost all EU countries, and I expect the remaining European investigations to resolve similarly.

But I’m skeptical that the US will adopt similar measures, and for that reason, the broader impact on the digital advertising market of this restructuring of ATT will be muted: without any changes in the US, and given that historical ATT opt-out decisions will not be automatically reversed en masse, my sense is that the principal impact of the concessions extracted from Apple by the Bundeskartellamt will be precedential rather than immediately economic: a concrete limit has now been placed on the types of broad-based, self-preferencing platform rules Apple can impose going forward. Coupled with the continued fallout from the Epic Games v. Apple trial, it does seem that many of the operational and distribution frictions present on iOS are eroding.

So ATT will survive, but Apple’s ability to impose asymmetric rules on third parties under the banner of privacy without meaningful constraint will not. The immediate economic impact of these concessions may be modest, particularly if the changes stop in Europe, as I believe they will (for a more extensive argument on why I think that’s the case, see Could ATT be rolled back?). But their precedential impact is consequential. ATT was never simply a privacy policy; it was an exercise of platform power, and that power is now circumscribed.