Germany Rewrites Apple’s ATT Prompt and Leaves the Data Edge

Germany’s Bundeskartellamt ended its App Tracking Transparency case on August 17, 2026, with binding prompt changes and no fine. Apple did not admit a breach, and its own ads still skip the IDFA screen that rival apps must clear.

The office declared the ATTF commitments binding in case B7-54/25, on a decision dated August 13, 2026. Apple has four months from service to ship the new screens in iOS and iPadOS, then live under them for seven years.

Apple Never Had to Show the Tracking Screen

Apple switched on App Tracking Transparency with iOS 14.5 in April 2021. For a third-party app that wants to mix user data across companies for ads, the user must tap through a prompt Apple largely writes. Refuse, and the app does not get the Identifier for Advertisers, the IDFA, which is how a phone can be recognised from one company to another.

Apple’s own personalised ads do not run on that rail. The company draws on data from its own apps, services, and App Store, and it asks through a separate Personalized Ads prompt. It does not put a second cookie-style banner on top. Smaller publishers have no matching pool of first-party data, and the Bonn investigation found no other technical path that is equally good for cross-company matching.

That split is the whole case. The authority did not object to ATT existing. It objected to a prompt that steered people to refuse rivals, and to a second ask that Apple never had to make of itself.

Apple also sits on both sides of the till. With iOS, iPadOS, and the App Store it controls the pipe most apps still use to reach iPhone users. The designation file put that pipe at up to 60 percent of app publishers’ turnover. Paid apps and subscriptions often throw off a commission to Apple. In-app ads generally do not.

THREE READS OF THE SAME PROMPT

• Apple: ATT is a privacy tool that goes past the legal minimum and helps the company compete on data protection, and it still says the rules complied with competition law.
• Ad and media groups: A gatekeeper should not add extra rules on top of privacy law when those rules shrink other companies’ ad businesses.
• German data-protection offices: They like ATT as policy and note gaps in how some apps handle consent, while also saying privacy law does not require the extra screen.

Bonn ran a competition case, not a privacy one. It spoke with the Federal Commissioner for Data Protection and Freedom of Information and with Bavaria’s state data office so the remedy would not crash into consent law.

Germany Closed the File Without a Fine

France and Italy punished the same design with cash. Germany took the interface. Apple still rejects the preliminary findings and offered commitments anyway, which is how a four-year-plus file that opened in June 2022 ended without an infringement decision.

The legal hook is Section 19a of the German Competition Act, the special abuse rule for firms of paramount significance across markets, plus the EU ban on abuse of dominance. Apple received the Section 19a tag in April 2023. The Federal Court of Justice upheld it in March 2025. Once that tag sticks, extra data rules inside Apple’s own apps and App Store cannot treat Apple’s products better than rivals’.

It is expressly not our aim to help achieve the highest possible levels of consent to personalised advertising. We want to ensure that users can make a free and informed decision. Users who do not wish to allow their data to be used for personalised advertising must be able to make an equally free and informed decision as users who intend to consent to such data use.

Andreas Mundt, President, Bundeskartellamt

Mundt, the office’s president, also said Apple may protect privacy beyond the legal floor. The fight was the extra house rules. “If Apple sets up additional rules within its ecosystem for the use of data, these rules must, under Germany’s special abuse provision for large digital companies, not treat its own offerings better than those of its competitors.”

Apple’s reply is that the current prompt is already clear, a view it says German data-protection authorities share, and that it agreed to change text and formatting at the office’s request. “These commitments ensure we can continue to provide this important privacy tool in Europe, and keep users, not ad tech companies and data brokers, in control of their data,” the company said.

The binding ATT prompt changes in Germany cover users with an App Store billing address and a device in Germany. Apple said it will apply the new screens in almost all EU countries, which is a product plan, not the legal perimeter Bonn wrote down.

What the New ATT Prompt Must Do

ATT stays. The chrome around it does not. Before the new screens go live, Apple must run tests with app publishers, then build the changes into iOS and iPadOS and tell developers.

HOW THE THIRD-PARTY ASK HAS TO CHANGE

The FAQ that travels with the decision names the warning hand and the term tracking as the two cues publishers treated as alarms. In Germany, only the new ATT prompt and the amended Personalized Ads prompt are supposed to appear.

The second change is the double ask. A publisher that needs GDPR-style consent already uses its own consent management platform. If it also wants the IDFA, it had to fire Apple’s prompt too. Apple never stacked that second banner on its own ads. The commitments spell out three ways through the overlap.

THREE WAYS TO COMBINE THE ASKS

• One screen: Fold the required privacy consent into the new ATT prompt so Allow or Reject covers both, with first-layer copy in the 4,000-character string and settings behind the extra button.
• Linked screens: Keep the privacy banner as it is, then let the ATT prompt note that the user already agreed under data-protection law. If the user refused the overlapping processing there, the publisher may not show ATT or use the IDFA. If they agreed, ATT may be shown again 12 months after the last display.
• Separate screens: Leave the two asks independent and still receive the new layout and wording.

None of those routes is built to lift yes-rates. The FAQ is blunt that publishers have to live with whatever consent or refusal the new screens produce. Strip the warning hand and the word tracking, and a refusal also stops looking like a safety choice. That is the shift Bonn ordered, and it is the one privacy-hard users will keep fighting.

First-Party Data Still Funds Apple Ads

Neutral chrome does not hand rivals Apple’s data. The IDFA is still Apple’s to release. Apple still does not need it for its own ads, because those ads sit on signals from the App Store, Apple’s apps, and the rest of the devices it already runs. A friendlier third-party prompt does not create a matching data set for a small game studio or a news app.

That is why the money effect can stay small even if more people tap Allow in the EU. Historical ATT choices are not wiped. A user who already said no does not get a fresh, unprompted reset. The United States is not on this design brief. Analyst Eric Seufert, who writes Mobile Dev Memo, put the likely EU opt-in lift as “non-trivial” and still called the main result “precedential rather than immediately economic,” because the US will not copy the screens and old opt-outs will not reverse in bulk.

Apple’s ad business has been compounding in the other direction. The company’s Form 10-Q, filed July 31, 2026, put fiscal third-quarter services at $30.739 billion, up 12 percent from $27.423 billion a year earlier, “primarily due to higher net sales from advertising and cloud services.” Chief financial officer Kevan Parekh told analysts the June quarter set a record in advertising, among other services lines. Apple does not publish a standalone ads number, so the signal is direction, not a line item.

A redesigned EU prompt does not touch that first-party pipe. It changes how rivals ask. It does not change who already has the data.

France and Italy Already Collected Their Fines

Bonn coordinated through the European Competition Network with other national offices and the European Commission. Two of those files ended in penalties. Germany aimed at the next version of the screens instead of a bill for the last five years.

CLOSED ATT CASES IN EUROPE

The French office fined Apple €150 million over ATT after finding the way the screens were built was neither necessary nor proportionate to privacy, and that smaller publishers took the worst of it. France’s CNIL, asked during that case, said making publishers “systematically collect user consent twice for the same purpose constitutes an unnecessary and artificial complexity.”

Italy’s AGCM issued a €98.6 million abuse of dominance fine on the same double-consent load. It said Apple could have kept the same privacy level with a single step. Romania and Poland have run, or are still running, their own ATT files. Bonn says the German deal may colour how ATT looks in other EU states. That is a forecast, not an order those offices must copy.

A £2 Billion File Opens in London

The German close did not end the argument. In early September 2026 a £2 billion claim landed at London’s Competition Appeal Tribunal on behalf of UK app developers, arguing ATT policed rivals while Apple’s own ads did not clear the same bar. Ann Pope, a former official at the Competition and Markets Authority, is tied to that action. A British tribunal is not bound by Bonn, Paris, or Rome. It can still read the same prompt.

THE BONN ATT FILE

1. June 2022: The Bundeskartellamt opens the proceeding against Apple’s ATTF.
2. April 2023: Apple is designated a firm of paramount significance across markets under Section 19a.
3. February 13, 2025: The office sends Apple and the admitted associations its preliminary legal assessment.
4. March 2025: The Federal Court of Justice upholds the Section 19a designation.
5. December 2, 2025: Apple’s proposed commitments go to a market test.
6. August 13, 2026: The commitment decision in case B7-54/25 is issued.
7. August 17, 2026: The office announces the commitments are binding and closes the proceeding.

An independent monitoring trustee will watch compliance, mediate fights between Apple and publishers, and report to Bonn. A publisher that thinks Apple is breaching the deal to its detriment can go to the trustee first. If that fails, the trustee consults the authority, and the office’s usual enforcement tools stay in place.

Apple still has to get the new screens through publisher tests and into iOS and iPadOS within four months of service. After that the trustee’s clock runs seven years. The IDFA gate, and the first-party data Apple never had to put through it, remain where they were on August 17.