Germany Forces Neutral Apple ATT Prompts Across Most of Europe

Apple must redesign its App Tracking Transparency consent screens after Germany’s Federal Cartel Office closed a four-year probe on Monday, finding the system gave the company’s own apps more favourable prompts than third-party developers. The binding commitments declared by the Bundeskartellamt give Apple four months from service of the decision to implement the fixes, which then run for seven years under an independent trustee and will apply in almost all European Union countries.

The changes strip discouraging symbols and wording from third-party prompts, align them more closely with Apple’s own personalised-ads request, and let publishers combine or sequence the ATT request with ordinary data-protection consent. No fine was imposed and Apple still calls the original tool clear and effective.

The dual-role problem the cartel office locked onto

Apple introduced App Tracking Transparency with iOS 14.5 in 2021. Third-party apps that want to use the Identifier for Advertisers for cross-app or cross-company advertising must first show a system prompt that Apple largely controls. Apple’s own advertising does not use that identifier the same way. It draws on first-party data inside its ecosystem and shows a separate Personalised Ads prompt when needed.

That split created two paths through the same phone. One path was a system screen Apple designed for everyone else. The other was a first-party request Apple designed for itself. The Bundeskartellamt said the wording, design and option order of the third-party prompt steered users toward refusal while Apple’s own prompt steered them toward consent. Third-party apps also often faced a second consent request under data-protection law, creating a double hurdle Apple itself avoided.

It is key that personal data and privacy are protected effectively when using apps. Apple is allowed to provide for a level of protection for its users that exceeds the minimum legal requirements. However, if Apple sets up additional rules within its ecosystem for the use of data, these rules must, under Germany’s special abuse provision for large digital companies, not treat its own offerings better than those of its competitors.

Andreas Mundt, president of the Bundeskartellamt, said that in the announcement. The office had designated Apple as a company of paramount significance for competition across markets in 2023 under Section 19a of the German Competition Act; the Federal Court of Justice confirmed the designation in March 2025. That status supplied the legal hook alongside Article 102 TFEU.

Apple never conceded an infringement. It offered the commitments anyway, and the authority declared them binding without a finding of violation or a penalty. German data-protection authorities had viewed the original ATT framework positively for privacy, a point Apple highlighted in its own statement. The case therefore turned on equal treatment inside the ecosystem, not on whether tracking controls should exist at all.

Exact redesign of the consent screens

The ATT framework itself stays. Its interface changes. The warning hand symbol disappears. So does the word “tracking,” which publishers said alarmed users. Both the new third-party prompt and Apple’s own Personalised Ads prompt must carry accurate explanations of data use and present selection options in more closely aligned order and language. Design becomes neutral in content, wording and layout.

Publishers also gain a structural button inside the prompt that opens a second layer for granular settings. The longer purpose string lets an app describe why it wants the identifier and what the user receives in return, without forcing that explanation into a pre-prompt of uncertain legal status. The authority said the goal is free and informed choice, not higher consent rates. Users who refuse must face the same ease of decision as users who allow.

Neutral layout and matched option order close the visual gap that the office said favoured Apple’s own ads request. The system prompt remains Apple’s to surface; only its content, symbols and sequence must now track the Personalised Ads experience more closely.

Three ways publishers can now stack consent

The double-request problem receives explicit fixes. Where a publisher needs both data-protection consent via a Consent Management Platform and the ATT prompt, three routes become available.

• Single combined prompt: The CMP and ATT request merge into one screen. Allow or Reject applies to both. All first-layer information sits in the 4,000-character string; second-layer details sit behind the new button. This works only when every data-protection requirement is met in that combined form.
• Separate prompts that reference each other: The CMP stays unchanged. The new ATT prompt can note that the user already consented under data-protection law. If the user refused the overlapping CMP request, the publisher may not show ATT or use the IDFA. If the user consented, ATT can reappear after 12 months.
• Fully separate prompts: Publishers keep the old independent flow but still receive the redesigned, neutral ATT prompt.

These options cut the friction that forced many apps to show pre-prompts or accept lower opt-in rates. A publisher that already collected a valid data-protection yes can avoid asking the same user the same substance twice in quick succession. Advertisers and ad-tech intermediaries stand to benefit from cleaner paths as well.

The combined route demands the most legal care, because every data-protection element must fit the single screen. The reference route keeps existing CMP tooling intact while still linking the two decisions. The fully separate route remains available for teams that prefer not to redesign their consent stack.

French and Italian fines that set the stage

Germany chose remedy over penalty. Other EU authorities did not. France’s competition authority fined Apple €150 million in March 2025 for the way ATT was implemented between 2021 and 2023. Italy’s authority imposed €98.6 million in December 2025, focusing on the double-consent burden. Both decisions treated the design as an abuse that disadvantaged smaller publishers while Apple’s own ads faced lighter rules.

Stats snapshot

• €150 million, French fine (2025)
• €98.6 million, Italian fine (2025)
• ~$10 billion, Meta’s estimated 2022 revenue headwind from the original ATT rollout, per the company’s own statements at the time
• Seven years, duration of the German monitoring trustee’s oversight after implementation

The Bundeskartellamt coordinated through the European Competition Network and noted that its solution may influence the future design of ATT elsewhere in the EU. Apple confirmed the changes will apply in almost all EU countries so it can keep offering the tool there. A single redesigned prompt set is simpler to ship than a Germany-only fork, which helps explain the wide geographic reach of a national case.

Who gains the ad dollars next

Many third-party apps fund themselves with personalised advertising. Higher-precision targeting generally produces higher revenue than broad campaigns. Apple often takes a commission on paid apps and subscriptions but generally takes no cut of publishers’ ad revenue. That commercial asymmetry sat behind the associations’ complaints: a gatekeeper setting extra-statutory rules that hit rivals’ main monetisation path while protecting its own.

• Ad-funded apps: clearer purpose text and fewer double asks when seeking IDFA consent
• Advertisers and intermediaries: potentially cleaner signal paths if more users make an informed choice
• Apple: keeps the ATT framework and its privacy brand position, with redesigned copy and layout
• Users: matched ease of allow or refuse, plus in-prompt detail when they want it

The original ATT rollout produced sharp drops in IDFA availability. Meta publicly tied roughly $10 billion of 2022 revenue pressure to the change. Other ad-funded social and gaming apps reported similar compression. Neutral prompts plus the ability to explain the business model in 4,000 characters and to avoid double asking give those publishers a clearer shot at informed consent. Whether actual opt-in rates rise remains unknown; the authority expressly said raising rates is not the aim.

Apple keeps the privacy positioning that has become central to its brand. The framework still stands between third-party apps and cross-company data. The company said in a statement that the current prompt already provides a clear way for users to stay in control, an opinion shared by German data-protection authorities, yet it agreed to text and formatting changes at the FCO’s request so it can continue providing the tool in Europe. The settlement also stands alongside Apple’s parallel fights over App Store fees and other gatekeeper rules under the Digital Markets Act.

Germany Trades Fines For Lasting Oversight

France and Italy extracted large one-off penalties. Germany extracted a multi-year redesign with an independent referee. The difference matters for how the market adjusts.

A fine punishes past design choices. The German package rewrites the live interface and then watches that interface for seven years. Publishers who believe a later prompt change reintroduces bias can go straight to the trustee rather than open a fresh complaint from scratch. Apple, for its part, avoids an infringement finding and a penalty while still accepting operational constraints it did not write alone.

The Section 19a designation and its 2025 court confirmation gave the office a durable hook for that bargain. Commitments without a violation finding let both sides close the file. The monitoring term then does the work a pure damages award cannot: it keeps the neutral wording, option order and stacking routes in force long enough for developers to rebuild around them.

The Commitments Reach Almost All Of Europe

The legal starting line is narrow. Geography begins with users whose App Store billing address and device are in Germany. Practice widens quickly. Apple has said the changes will apply in almost all EU countries so it can keep offering ATT there as a single tool.

That choice tracks the European Competition Network coordination the Bundeskartellamt already flagged. A remedy shaped in Bonn can travel if the company prefers one prompt design across the bloc. French and Italian decisions remain on the books as separate penalties; the German text-and-layout fixes become the operational baseline developers are told to expect in most of the Union.

Parallel DMA disputes over store fees and gatekeeper duties continue on their own tracks. The ATT settlement does not resolve those fights. It does remove one source of prompt-level asymmetry that national authorities had already priced in fines elsewhere.

The four-month clock and seven-year trustee

Implementation is concrete and timed.

1. 13 August 2026, Commitment decision dated.
2. 17 August 2026, Public announcement that the commitments are binding and the proceeding closed.
3. Four months from service of the decision, Apple must implement the redesigned prompts in iOS and iPadOS and inform publishers. Beta seed testing with app publishers occurs first.
4. Seven years from implementation, Commitments remain in force and an independent monitoring trustee oversees compliance, mediates disputes between Apple and publishers, and reports to the Bundeskartellamt. Publishers can approach the trustee directly if they believe a breach harms them.

Geography starts with users whose App Store billing address and device are in Germany, yet Apple’s own statements extend the practical effect to almost the entire EU. The detailed FAQ on the ATTF changes supplies further operational detail for developers preparing for the beta period.

The authority examined competition law only. It exchanged views with German data-protection bodies to avoid conflicts but did not enforce privacy rules itself. Apple’s own rules on asking permission to track remain the baseline developers must still follow; the German commitments simply constrain how Apple designs the system-level prompt and the surrounding architecture.

Developers now have a defined window to test the new purpose strings and the three consent routes. The trustee will be the day-to-day referee for the next seven years. How far consent rates recover, and how much ad revenue follows, will be measured in the quarters after the four-month deadline, not in the press release.