Apple must strip ATT warning prompts after German ruling

Apple has four months to redesign its App Tracking Transparency consent prompts after Germany’s Federal Cartel Office declared the commitments binding on 17 August 2026. The authority closed a probe begun in June 2022 after finding that the ATT framework gave Apple’s own apps more favourable consent wording and layout than third-party developers received.

The changes strip discouraging symbols and the word “tracking,” align Apple’s own Personalized Ads prompt more closely with the third-party version, and hand publishers up to 4,000 characters to explain why personalised ads fund their apps. Commitments last seven years under an independent trustee and, per Apple, will roll out in almost all EU countries.

The double standard the FCO dismantled

Apple introduced ATT with iOS 14.5 in April 2021. Third-party apps that want the Identifier for Advertisers (IDFA) for cross-app tracking must show a system prompt Apple largely predefines. Users who refuse block that access. Apple’s own personalised advertising draws on first-party ecosystem data instead and uses a separate Personalized Ads prompt that never mentions tracking.

Bundeskartellamt president Andreas Mundt said Apple may exceed legal privacy minimums, yet additional rules inside its ecosystem “must not treat its own offerings better than those of its competitors.” The authority’s preliminary view held that the ATT prompt’s warning-hand symbol, “app tracking” language, tight explanation space and option order steered users toward refusal, while the PA prompt steered them toward consent.

• Hybrid role risk: Apple controls iOS, the App Store and its own apps plus ad inventory.
• Revenue asymmetry: Apple takes commission on many paid or subscription apps but generally none of third-party ad revenue.
• Turnover exposure: Up to 60 percent of app publishers’ turnover rides on Apple’s distribution infrastructure, per the designation investigation.

German data protection authorities viewed the original ATT positively as policy even if they did not see it as legally required. Advertising and media associations saw an extra-statutory gatekeeper rule that cut their revenue. The FCO stayed inside competition law under Section 19a GWB and Article 102 TFEU after Apple’s paramount significance designation under Section 19a in 2023, later confirmed by the Federal Court of Justice.

Exact redesign Apple must ship

The ATT framework itself survives. Its interface does not. Under the binding package Apple will remove possibly discouraging symbols and wording, make content, wording and layout neutral, and give publishers more room to describe the value of personalised advertising to their business model.

Publishers also gain clearer routes when they already need GDPR-style consent via a Consent Management Platform. The accompanying FAQ on the ATTF changes sets out three defined approaches.

• Combine CMP and ATT into one unified prompt so Allow or Reject covers both.
• Keep separate prompts but let the new ATT prompt reference a prior data-protection consent, with a 12-month re-display rule if the user earlier declined the overlapping processing.
• Continue fully separate prompts exactly as before while still receiving the redesigned neutral ATT interface.

Mundt stressed the authority does not seek the highest possible consent rates. “Users who do not wish to allow their data to be used for personalised advertising must be able to make an equally free and informed decision as users who intend to consent.”

Four months and a seven-year leash

1. 13 August 2026: Commitment decision dated.
2. 17 August 2026: Public announcement and proceeding closed.
3. Four months from service: Apple must implement the changes in iOS and iPadOS after Beta Seed Testing with publishers.
4. Seven years from implementation: Commitments remain binding and monitored by an independent trustee who mediates disputes and reports to the FCO.

Publishers who believe Apple breaches the terms can approach the trustee directly. Existing enforcement routes stay open. Apple offered the package without conceding any infringement; the case ends with no fine and no formal finding of violation.

Who gains when the hand symbol vanishes

Ad-supported free apps, media publishers and the wider advertising supply chain stand to benefit from neutral wording and the chance to explain their business model in far more detail. Meta and other large platforms that once estimated multi-billion-dollar headwinds from ATT’s original design get a more level prompt. Smaller direct-to-consumer firms that research linked to sharp revenue drops after 2021 may see measurement and targeting improve if opt-in rates rise even modestly.

Apple keeps the privacy tool and can continue positioning itself on data control. Its own ad products still draw on first-party data the IDFA path never matched. The company said: “While we believe the current ATT prompt provides a clear, easy-to-understand and effective way to keep users in control of their data, an opinion shared by the German data protection authorities, we have agreed to make changes to the text and formatting of the prompt at the FCO’s request. These commitments ensure we can continue to provide this important privacy tool in Europe and keep users, not ad tech companies and data brokers, in control of their data.”

The irony sits in plain view. The same design choices that made ATT a strong privacy nudge and a commercial shock to rivals are precisely the ones competition law now requires Apple to soften. Users still choose; the framing that once pushed many toward “Ask App Not to Track” becomes more balanced.

France and Italy already collected

Germany chose remedy over penalty. Other national authorities did not.

The FCO coordinated inside the European Competition Network with the Commission and peers in France, Italy, Romania and Poland. It notes the German solution may shape ATT’s future design elsewhere even though the formal geographic scope of the commitments centres on German App Store billing addresses and devices. Apple’s own statement points to almost all EU countries.

This pattern of national pressure on Apple’s platform rules echoes other recent concessions, including Apple’s own external-purchase fee concessions under parallel store and payment scrutiny.

What the neutral prompt still leaves open

ATT remains the gate for IDFA access. No equally effective technical alternative for cross-company data combination was identified in the investigation. Consent or refusal rates that result from the new design must simply be accepted by publishers. The FCO did not rewrite data-protection law; it only required that Apple’s extra layer stop systematically favouring its own services.

It is expressly not our aim to help achieve the highest possible levels of consent to personalised advertising. We want to ensure that users can make a free and informed decision.

Andreas Mundt made that point central. Whether the redesigned prompts produce meaningfully higher opt-ins, whether small publishers recover ad yield, and whether other EU authorities treat the German package as a template will be measured in the coming quarters of trustee reports and real-world A/B results. Apple has the technical window to ship; developers have the new text real estate and combination options. The rest is user behaviour under a less loaded choice.

Frequently Asked Questions

What exact changes must Apple make to the ATT prompt?

Apple must remove discouraging symbols such as the warning hand and the term “tracking,” align wording and option order more closely with its own Personalized Ads prompt, grant publishers a Customizable Purpose String of up to 4,000 characters, add a second-layer text button, and offer three defined ways to combine or sequence the ATT prompt with existing data-protection consent flows.

How long do the German commitments last and who monitors them?

Apple has four months from service of the 13 August 2026 decision to implement the changes after joint testing with publishers. The commitments then bind for seven years from implementation and are supervised by an independent monitoring trustee who reports to the Bundeskartellamt and can mediate publisher disputes.

Did France and Italy fine Apple over the same ATT framework?

Yes. France’s competition authority imposed a €150 million fine in March 2025 for practices on the iOS mobile-application advertising market. Italy imposed roughly €98.6 million in December 2025 over the double-consent architecture. Germany closed its case with behavioural commitments and no fine.

Does App Tracking Transparency still exist after the ruling?

Yes. The framework and the requirement to obtain consent for IDFA access remain. Only the design of the prompt, the explanation space given to publishers, and the architecture for combining it with statutory consent requests are altered to remove self-preferencing effects.

Will the redesigned prompts apply only in Germany or across the EU?

The Bundeskartellamt’s formal settlement focuses on users with German App Store billing addresses and devices located in Germany. Apple stated that the changes will apply in almost all European Union countries so it can continue offering the privacy tool across the region.