Apple must neutralise ATT prompts after German cartel probe

Apple will redesign its App Tracking Transparency prompts across Germany after the Bundeskartellamt declared binding commitments on 17 August 2026, ending a probe that began in June 2022. The company has four months from service of the decision to neutralise the consent screens used by third-party apps, test the new versions with publishers, and align them more closely with the prompts it shows for its own personalised ads. An independent trustee will then monitor compliance for seven years.

The authority found that the current design steered users away from granting tracking permission to rivals while treating Apple’s own offerings more favourably. Apple maintains the framework complies with competition law and protects privacy beyond the legal minimum, yet offered the commitments anyway. No fine and no formal infringement finding accompany the close.

Germany closes the four-year ATT case without a fine

The Bundeskartellamt binding commitments announcement makes the changes mandatory under Section 19a of the German Competition Act and Article 102 TFEU. Apple had already been designated a company of paramount significance for competition across markets in April 2023; the Federal Court of Justice confirmed that status in March 2025.

Andreas Mundt, president of the Bundeskartellamt, said the core problem was unequal treatment inside Apple’s own rules.

It is key that personal data and privacy are protected effectively when using apps. Apple is allowed to provide for a level of protection for its users that exceeds the minimum legal requirements. However, if Apple sets up additional rules within its ecosystem for the use of data, these rules must, under Germany’s special abuse provision for large digital companies, not treat its own offerings better than those of its competitors.

Mundt added that the new requests aim at free and informed decisions, not higher consent rates. The proceeding stayed strictly inside competition law; German data-protection authorities were consulted only to avoid conflicts.

Two design problems the cartel office targeted

Apple introduced the Apple App Tracking Transparency framework docs in April 2021. Third-party apps that want the Identifier for Advertisers (IDFA) for cross-app, cross-company tracking must show a system prompt largely predefined by Apple. Without that consent the IDFA stays blocked. The authority found no equally effective technical alternative.

Apple’s own personalised advertising runs differently. It draws on first-party data from its ecosystem and shows a separate Personalized Ads (PA) prompt. It does not use the IDFA or the ATT prompt. Third-party publishers, by contrast, usually already need a Consent Management Platform prompt under GDPR and ePrivacy rules. When their processing also falls under ATT they face two screens asking for overlapping permission.

The Bundeskartellamt objected to steering in the ATT prompt itself (warning symbols, the word “tracking,” cramped explanation space, option order) and to the unnecessary double-request architecture. Both, it said, could discourage consent for rivals while Apple’s PA prompt encouraged it. Associations for branded goods, media and advertising had pushed the case, noting that Apple often takes a commission on paid apps and subscriptions but takes none of pure advertising revenue. Up to 60 percent of many publishers’ turnover still flows through Apple’s distribution infrastructure.

Warning hands and tracking language leave the screen

Under the commitments the ATT and PA prompts will be aligned in wording, layout and selection order. Discouraging elements disappear.

• Warning hand symbol removed from the third-party prompt
• “Tracking” language replaced by more neutral terms focused on personalised advertising
• Customizable Purpose String expanded to 4,000 characters so publishers can explain why ads fund their free apps
• Additional text button linking to a second-layer page for granular settings or further detail
• Both prompts must carry accurate explanations of data use if the user consents

Before full rollout Apple must run Beta Seed Testing with app publishers. Only the revised prompts will appear for users with German App Store billing addresses and devices located in Germany. The authority notes the solution may influence ATT design elsewhere in the EU.

Publishers get three defined routes past double consent

The architecture change is the operational core for developers. Where data-protection consent and ATT consent overlap, three paths are now explicit.

1. Single combined prompt, Publishers fold the CMP requirements into the new ATT prompt. One Allow or Reject covers both. All first-layer information sits in the 4,000-character string; second-layer detail sits behind the new button.
2. Separate prompts that cross-reference, The CMP stays independent. If the user already consented under data protection for the overlapping processing, the new ATT prompt can note that fact. Sequencing rules apply: a CMP refusal blocks the ATT prompt and IDFA use. A later Allow can be sought after 12 months.
3. Fully separate prompts, Publishers keep the old dual flow if they prefer. They still receive the redesigned, neutral ATT prompt.

The full FAQ on ATTF changes and effects stresses that resulting consent rates must simply be accepted. The goal is equal freedom to say yes or no, not maximised advertising yield.

France and Italy already extracted nearly €250 million

Germany chose remedy over penalty. Other authorities took the cash route for similar concerns about complexity and self-preferencing.

The Bundeskartellamt coordinated inside the European Competition Network with the Commission and peer authorities. Proceedings or follow-ups also appeared in Romania and Poland. Apple remains a designated gatekeeper under the Digital Markets Act; the German case sits alongside, not inside, those rules. The company has already lost challenges to that status, including the EU court rejection of Apple gatekeeper challenges.

Seven years of trustee oversight begin after the four-month window

Implementation starts the clock. Apple has four months from service to ship the changes in iOS and iPadOS and inform publishers. The commitments then run seven years from implementation, not from the decision date.

1. June 2022, Bundeskartellamt opens the ATTF proceeding
2. April 2023, Apple designated under Section 19a
3. February 2025, Preliminary legal assessment sent to Apple and intervening associations
4. March 2025, Federal Court of Justice confirms the designation
5. December 2025, Market test of Apple’s proposed solutions
6. 13-17 August 2026, Commitment decision dated and declared binding; case closed
7. +4 months, Implementation and publisher testing deadline
8. +7 years from implementation, Commitments expire under trustee watch

The independent monitoring trustee reports regularly to the authority, mediates disputes between Apple and publishers, and can escalate unresolved breaches. Publishers may approach the trustee directly if they believe Apple is undercutting the commitments. Existing court routes remain open.

Free apps and advertisers gain clearer paths, not guaranteed revenue

Many iOS apps stay free because advertising pays the bills. Personalised ads command higher rates and better measurement when the IDFA is available. Studies after the 2021 launch recorded sharp drops in opt-in rates, click-through effectiveness and revenue, with smaller direct-to-consumer firms hit hardest (one analysis put the relative revenue drop near 60 percent for the most ad-exposed small sellers, and average advertiser revenue down around 37 percent). Meta and other large platforms also saw measurable shifts in ad spend.

The German fix does not restore the pre-2021 world. It removes the specific steering and double-friction the cartel office called anti-competitive. Publishers can now explain their business model at length, combine legal consents cleanly, and face a prompt that looks more like Apple’s own. Whether users say yes more often is left to them. Apple’s own advertising system loses the relative design advantage it previously enjoyed inside the same ecosystem.

The changes sit inside a larger European pattern of gatekeeper scrutiny that already forced Apple DMA changes for EU app distribution, alternative marketplaces and external purchase links. Privacy remains a stated priority for Apple; competition authorities keep insisting that extra-statutory privacy rules cannot double as self-preferencing tools.

Apple will test the new prompts with publishers, ship them inside the four-month window, and live with trustee oversight until the early 2030s. Third-party developers finally get the neutral screens and flexible architecture they argued for since the first ATT alert appeared.

Frequently Asked Questions

What exactly must Apple change in the ATT prompt?

Apple must remove the warning-hand symbol and the word “tracking,” align wording and option order with its own Personalized Ads prompt, give publishers a 4,000-character Customizable Purpose String, and add a second-layer text button. The design must be content-neutral so it neither steers users toward refusal for third parties nor toward consent for Apple.

How long does Apple have to implement the German ATT changes?

Four months from formal service of the 13 August 2026 commitment decision. Before full release Apple must complete Beta Seed Testing with app publishers. The seven-year monitoring period then runs from the date of implementation, not from the decision itself.

Will the new rules apply only in Germany or across the EU?

The binding commitments cover users whose App Store billing address and device are in Germany. The Bundeskartellamt states the solution may affect ATT design in other EU member states through the European Competition Network dialogue, and some reports quote Apple saying the revised prompts will reach almost all EU countries. Separate national cases and the DMA remain independent.

Did Germany fine Apple over App Tracking Transparency?

No. The proceeding ended with binding commitments and no financial penalty and no formal finding of infringement. France fined Apple €150 million in March 2025 and Italy €98.6 million in December 2025 for related ATT practices.

What is the independent monitoring trustee’s role?

For seven years after implementation the trustee supervises Apple’s compliance on behalf of the Bundeskartellamt, mediates disputes with third-party publishers, and reports regularly. Publishers can contact the trustee directly if they believe the commitments are being breached; unresolved issues escalate to the authority while ordinary legal remedies stay available.