Apple told developers on September 16, 2026 that apps distributed in Germany, France, Italy, Poland and Romania will have only one consent sheet available for cross-company data linking once iOS 27.2 and iPadOS 27.2 ship: an alternative version of the App Tracking Transparency prompt, which developers elsewhere in the European Union may adopt voluntarily. The same update allows apps to put the question to EU users again after a year, whether the first answer was yes or no.

In Short

Apple is changing the pop-up that asks whether an app may connect what you do in it with data from other companies for advertising, and in Germany, France, Italy, Poland and Romania the new version will be the only one apps are allowed to show. This matters to app makers and advertisers because the wording, the layout and a new button that opens extra information all influence how many people agree, and that decides how much targeting and measurement data reaches ad networks. Once iOS 27.2 arrives, an app anywhere in the EU can also ask you again a year after your last answer, even if you said no, unless you have switched off the setting that lets apps ask at all.

What Apple published

The change arrived as a developer news item titled "Updates to App Tracking Transparency in the European Union," dated September 16, 2026, together with a rewritten section on Apple's User Privacy and Data Use page. Apple gives its reason in a single clause: the changes come "as part of agreements with select European competition authorities." The company does not name those authorities, say how many agreements exist, or describe what each one requires.

Two rules sit at the centre. From iOS 27.2 and iPadOS 27.2, developers across the EU gain the option of an alternative version of the ATT system prompt. In five member states the option becomes an obligation. "Due to legal requirements, only the alternative version of the system prompt is available for apps distributed in Germany, France, Italy, Poland, and Romania," according to Apple.

What triggers a request does not move. The requirements governing when permission must be sought "will remain the same," according to Apple. ATT has applied since iOS 14.5, iPadOS 14.5 and tvOS 14.5, and it still controls access to the device's advertising identifier, which returns a value of all zeros until a user grants permission. The September notice names iOS and iPadOS only. tvOS, which the framework also covers, is not mentioned.

The update circulated quickly among measurement specialists. Michal Nováček, a mobile app analyst at Measure-Apps.com, shared it on LinkedIn with the line "Apple has released updates on ATT for EU." and flagged it as reading material for mobile app owners. His post reproduced Apple's text alongside the example screen Apple published with it.

A different sheet, a different vocabulary

Apple describes the new version as having "modified formatting and language," plus an optional text button labelled "Additional Information." That button lets developers surface more detail about a request to combine data from their app with data "collected from other companies' apps, websites, or offline properties for targeted advertising or advertising measurement purposes," or to hand data to a data broker, according to Apple.

The example screen says more than the prose. Its opening sentence states that the sample app "would like permission to link your app activity with data from other companies' apps, websites, or with offline data, for personalized advertising or to measure advertising effectiveness." A second sentence discloses that the app "may also share your information with data brokers." The developer's own wording sits beneath a heading, "App Explanation," followed by the Additional Information link. Two buttons close the sheet: "Allow" and "Reject."

The verb "track" appears nowhere in that sample. The vocabulary shift reaches the device settings too. In the EU, the switch "Allow Apps to Request to Track" has been renamed "Allow Apps to Request to Link Your Activity Across Companies," according to Apple's updated page.

The refusal button changes as well. Since 2021 the dialog has offered Allow alongside Ask App Not to Track; the second label gives way to Reject. That was one of eight changes Apple had committed to, according to a 9to5Mac report published on August 18, 2026. The same list included support for bold, italics and bulleted lists inside the prompt, the optional page of extra information, the yearly re-ask, and what 9to5Mac described as minor clarifications to the language of Apple's own Personalized Ads prompt, with no change to its effect.

How the developer mechanics work

One method, three regional behaviours

The engineering work centres on a new method, requestTrackingAuthorization(usingExpandedInterface:additionalInformationAction:completionHandler:), available from iOS 27.2, iPadOS 27.2 and Mac Catalyst 27.2 in completion-handler and async forms, according to Apple's developer documentation. It takes two new parameters. The first, preferExpandedInterface, is a Boolean that requests a full-page sheet in place of the familiar system alert. The second, additionalInformationAction, is a closure that runs when the user taps Additional Information; passing nil removes the button.

Behaviour then splits by geography. In France, Germany, Italy, Poland and Romania, the system displays the developer's Markdown text in a full-page sheet whatever value the app passes for preferExpandedInterface, and adds the Additional Information button if an action is supplied. In other EU countries, the full-page sheet appears only when the app sets preferExpandedInterface to true. Outside the EU, the system ignores both parameters and presents the original alert with the existing NSUserTrackingUsageDescription string, which Apple says is equivalent to calling the older requestTrackingAuthorization(completionHandler:) method.

Eligibility rests on two conditions at once. The device must be located in a specific EU country and signed in with an Apple Account whose country or region is set to a specific EU country or region, according to Apple. That double test resembles the scope of the German settlement, which covers users with App Store billing addresses and devices located in Germany.

A purpose string written in Markdown

A new Info.plist key, NSUserTrackingMarkdownUsageDescription, carries the developer's explanation from iOS 27.2 and iPadOS 27.2. The string is Markdown: bold and italic styling are supported, as are bullet lists and paragraph breaks, while underlining is not. The key is optional. Where an app omits it, the system falls back to NSUserTrackingUsageDescription, and outside the EU the system uses the older key in every case, according to Apple's documentation.

Apple's two documentation pages describe the middle case, EU countries outside the five, slightly differently. The method's page says the system displays the Markdown text if the developer supplies it. The key's page says that in those countries the key is used only when the app calls the new method with preferExpandedInterface set to true. The method's page also notes that, in the EU, the full-page sheet uses the Markdown string in place of the older one.

One further line on the key's page stands out. It carries a tip recommending that the description stay short and specific, and notes that the system already displays the app's name in the prompt, so the name need not be repeated.

What a tap on Additional Information does

The button does not record a decision. Tapping it dismisses the sheet without an answer and runs the developer's closure, inside which the app presents its own interface, according to Apple. The completion handler still fires, returning the status notDetermined. To obtain an answer, the app calls the method a second time.

That sequence has a measurement consequence. An app that routes users into a secondary screen and back will log an indeterminate status in between, so reporting built around a single authorised or denied event may register the detour as an abandoned request.

The system skips the prompt entirely, running the completion handler at once, in five circumstances listed by Apple: when tracking is restricted on the device; when the user has switched off the toggle under Settings, Privacy & Security, Tracking; when another permission request is pending; when the call comes from an app extension; and when the app is not in the active state.

A clock that resets once a year

In the EU, the system records the date of an answer and will not display the prompt again until a year has passed, according to Apple. After that, the app may ask again, regardless of whether the user previously allowed or refused. A user who has disabled the Settings switch cannot be asked at all. Apple's page makes no equivalent provision for users outside the EU.

Where Apple's text and the German decision part ways

Germany's Bundeskartellamt closed its proceeding on August 17, 2026 with commitments dated August 13 under case reference B7-54/25. Set Apple's September documentation beside PPC Land's account of those commitments and five gaps appear.

The first concerns length. Under the German commitments, app publishers gain a Customizable Purpose String of up to 4,000 characters to explain why personalised advertising funds their apps, against the one to two sentences Apple currently prescribes. None of Apple's September 16 pages states a character limit, and the new Markdown key's documentation instead carries the tip about brevity. Whether a 4,000-character ceiling is enforced in code, applies only in Germany, or is specified in material not yet public cannot be determined from what Apple has published.

The second concerns the second ask. The German decision, as PPC Land summarised it in August, allowed a publisher to show the new prompt again 12 months after the last display where the user had already consented in the publisher's consent management platform. Apple's EU rule is wider, covering any user in any EU country who previously allowed or refused. 9to5Mac's August list had already described the re-ask as applying to both answers, so the broader version appears to be Apple's own choice rather than a late addition.

The third concerns geography. The German settlement applies to Germany. Apple's list of legal requirements runs to five countries. France's Autorité de la concurrence fined Apple 150 million euros on March 30, 2025, Italy's competition authority imposed a fine of 98,635,416.67 euros on December 22, 2025, and proceedings in Romania and Poland were still running in August. Apple has not said which legal requirement applies in which of the four countries beyond Germany.

The fourth concerns timing. Apple has four months from formal service of the German decision to implement the changes, after which the commitments run for seven years under an independent monitoring trustee. The service date has not been published. Because service cannot precede a decision dated August 13, the German deadline cannot fall before December 13, 2026. Apple has given no public release date for iOS 27.2. The release entered developer beta testing in the week of the notice, according to The Apple Post, and beta wording and timing can change before shipping, according to MacObserver.

The fifth concerns Apple's own prompt. The German commitments cover both the ATT prompt and Apple's Personalized Ads prompt, and in Germany only the amended versions of each will be shown. Apple's developer page, written for third parties, says nothing about the Personalized Ads prompt, and the September notice does not address whether its wording changes elsewhere in the EU.

Double consent has been the practical grievance for European publishers. Many run a CMP to meet the General Data Protection Regulation and the ePrivacy Directive, then show Apple's prompt on top. Apple's frequently asked questions now include the entry "Can I provide additional information and consent controls with my app's ATT prompt implementation, to comply with local privacy laws in the European Union, such as ePrivacy or GDPR?"

Apple's answer is yes, with conditions. Apps in the EU may use the Additional Information button to surface further explanation and more granular consent controls required by local privacy law, according to Apple. Everything reached through that button is the developer's responsibility. The advertising identifier stays unavailable, and no data covered by the prompt may be collected or used, until the user grants permission in the ATT sheet itself.

The guidance adds several requirements. The purpose string is expected to carry the most important information about the intended data use. After a user visits the linked screen, the app may send the user back to the ATT sheet so the choice is recorded in the framework, but not if the user has opted out of every relevant legal consent choice on that screen. Using the button is optional, and separate permission requests remain permitted.

A second answer covers publishers that keep their CMP apart from the ATT flow. If a user has already consented through a separate prompt, the app may reference that consent in the ATT purpose string, according to Apple, but the ATT prompt is not to be displayed to users who declined all the relevant legal consent choices in the earlier control.

Those two answers map closely onto the first two of the three routes the Bundeskartellamt defined in August: a single combined flow, and separate prompts that refer to each other. The third German route, running both independently, remains available because Apple continues to allow separate controls. Developers stay fully responsible for making any combination comply with privacy law, according to Apple.

What does not change

The definition of tracking is untouched, and it reaches well beyond the IDFA. Tracking means linking user or device data collected from an app with data collected from other companies' apps, websites or offline properties for targeted advertising or advertising measurement, and it also covers sharing such data with data brokers, according to Apple. The examples on the page include showing targeted ads based on data from other companies' apps and websites, sharing location data or email lists with a broker, handing lists of emails or advertising IDs to an ad network for retargeting or for finding similar users, and embedding a tracking SDK that combines data across developers' apps even when the host app does not use it for that purpose.

Three cases fall outside the definition. Linking performed solely on the device, without identifying data leaving it, is excluded. So is sharing with a data broker that uses the data solely for fraud detection, fraud prevention or security, and sharing with a consumer reporting agency for creditworthiness reporting or a credit determination.

The frequently asked questions remain strict on workarounds. Without ATT permission, identifiers other than the IDFA, such as hashed email addresses or phone numbers, cannot be used to track a user, according to Apple. Fingerprinting, or using device signals to identify a device, is barred under the Apple Developer Program License Agreement, and apps that reference SDKs doing so may be rejected. Identifiers in scope include session IDs, fingerprint IDs and device graph identifiers. Third-party deep-linking and deferred deep-linking tools that create a shared identity across companies' apps require permission. Developers answer for any SDK and any single sign-on code they integrate, and tracking inside a webview counts unless the user is navigating the open web. Gating functionality on consent, or offering incentives for it, remains prohibited under App Review Guideline 5.1.2(i).

The identifier for vendor, or IDFV, can still be used without ATT for analytics across apps from the same content provider, but it may not be combined with other data to follow users across other companies' apps and websites, according to Apple.

The surrounding infrastructure is also unchanged. Privacy manifests, which became a submission requirement for listed third-party SDKs from May 1, 2024, still feed the Privacy Nutrition Labels shown on App Store product pages. Install attribution still runs through AdAttributionKit, which Apple's page calls its "privacy-preserving, industry-leading technology." Apple opens the same page with a statement of principle: "At Apple, we believe privacy is a fundamental human right."

How five markets reached the same outcome

ATT took effect with iOS 14.5 on April 26, 2021. Germany's Bundeskartellamt opened its case in June 2022 after complaints from associations representing app publishers and the advertising industry, and in February 2025 it reached preliminary findings that the rules could treat third-party developers less favourably than Apple's own services. A market test of Apple's offered commitments followed on December 2, 2025. The German proceeding ended without a fine or a formal finding of infringement. Apple rejected the preliminary assessment and offered commitments regardless.

The French decision covered conduct between April 26, 2021 and July 25, 2023. The Italian case centred on the double-consent burden that ATT placed on third-party developers relative to Apple's own apps. In Poland, the competition authority UOKiK brought abuse-of-dominance charges against Apple, Apple Operations International and Apple Distribution International over the framework in late 2025, according to UOKiK. A finding against the company could carry a fine of up to 10 per cent of its annual turnover in Poland, according to AppleInsider. Romania's investigation was listed alongside those cases by both the Polish and German authorities.

Apple's position has been consistent. Its own apps do not show the ATT prompt because the company does not use personal data collected from apps to target ads or measure their effectiveness, and it treats third-party apps the same way when they do not collect such data, according to 9to5Mac's August reporting of Apple's statements.

The European Union layer runs in parallel. Apple remains a designated gatekeeper under the Digital Markets Act after the General Court dismissed its challenges on July 8, 2026. The European Commission and the European Data Protection Board are finalising joint guidelines on how gatekeepers handle consent for personalised advertising; the consultation closed in December 2025 and more than 100 responses were published in March 2026. And on August 18, 2026, one day after the German decision became public, Apple replaced the per-install Core Technology Fee with a 5 per cent commission under unified EU business terms that take effect on October 1, 2026.

The ATT notice itself landed two days after Apple began rolling out iOS 27 on September 14, 2026, meaning the alternative sheet belongs to the first point release cycle of the new operating system rather than to its initial version.

Why this matters for the marketing community

Consent rates are the obvious variable. Opt-in rates ran between 11 and 15 per cent after the framework took effect. Adjust's Mobile App Trends 2026 report put the industry average at 38 per cent in the first quarter of 2026, up from 35 per cent a year earlier, with gaming at 39 per cent, publications rising from 18 to 26 per cent and e-commerce slipping from 35 to 34 per cent. Most users shown the prompt still decline. Under the EU rule, a refusal from a user in the bloc becomes eligible for a second request after 12 months, unless that user has turned off the switch in Settings.

Will the new wording move those numbers? The removal of the word "track", the new Reject label and the room for longer explanations address several of the design factors the German authority identified as steering users toward refusal, including the vocabulary of tracking and the unequal space available to explain a request. Yet the Bundeskartellamt stated that raising consent levels was expressly not its aim, and its accompanying FAQ said publishers must accept whatever consent or refusal rates result. No regulator, and not Apple, has published a forecast.

For measurement teams, the stakes run through attribution. When a user declines, install measurement falls back to Apple's aggregated postback frameworks, SKAdNetwork and AdAttributionKit, and every mobile measurement partnerworking on iOS inherits that thinner signal. Apple's own advertising placements report through the separate AdServices API, a channel third-party networks do not share. The commercial scale on Apple's side keeps growing: the company reported record June-quarter advertising revenue, without disclosing a figure, inside services revenue of 30.739 billion dollars, up 12 per cent.

The cost on the other side has been documented. Meta estimated in the fourth quarter of 2021 that Apple's changes would cost it on the order of 10 billion dollars. A four-year academic study found ATT barely shifted app monetisation toward paid downloads, while linked-data disclosures among surviving apps rose from 10.4 to 24.1 per cent, a sign that developers adapted by changing what they collect rather than how they charge.

There is operational work as well. Apps shipping into the five named markets need the new method, and any app wanting more than a sentence of explanation needs a Markdown string written, localised and reviewed for German, French, Italian, Polish and Romanian audiences. Publishers that consolidate their CMP behind the Additional Information button carry full legal responsibility for what sits there. And because the full-page presentation is compulsory in those five markets but optional in the other 22 member states, a single app can present two different consent experiences inside the EU, depending on where the device sits and which country its Apple Account names.

In August, the German decision gave one country a rebuilt prompt and left the rest of Europe with a reference design. Apple's September documentation has turned that reference design into the only option in five markets and a choice in the other 22. How many developers outside those five opt into a sheet built for longer explanations, and whether users read it any differently, will be visible only after iOS 27.2 reaches devices.

Timeline

Summary

Who: Apple, which published the change for developers distributing apps through the App Store in the European Union. Affected parties include app publishers, advertisers, ad networks and measurement companies operating on iOS and iPadOS, and EU users of those apps. Competition authorities in Germany, France, Italy, Poland and Romania form the regulatory backdrop, although Apple does not name the authorities behind its agreements.

What: From iOS 27.2 and iPadOS 27.2, developers in the EU may use an alternative App Tracking Transparency sheet with modified formatting and language, Markdown-formatted purpose strings, Allow and Reject buttons and an optional Additional Information button. In Germany, France, Italy, Poland and Romania, only the alternative version is available. EU apps may ask again one year after a user's previous answer, whether it was acceptance or refusal, and the Settings switch is renamed. The definition of tracking and the conditions requiring permission are unchanged.

When: Apple published the notice and documentation on September 16, 2026. iOS 27.2 entered developer beta testing the same week and has no public release date. The German commitments require implementation within four months of formal service of the August 13, 2026 decision, a deadline that cannot fall before December 13, 2026.

Where: All EU member states, with the alternative sheet compulsory in Germany, France, Italy, Poland and Romania and optional in the other 22. Regional behaviour depends on the device being located in an EU country and signed in with an Apple Account set to an EU country or region. Outside the EU, the original alert remains.

Why: Apple attributes the change to agreements with select European competition authorities and to legal requirements in the five compulsory markets. The German Bundeskartellamt had found that the ATT prompt steered users toward refusal while Apple's own Personalized Ads prompt steered them toward consent, and that third-party publishers faced a double-consent burden. For the advertising market, the change alters the wording, layout and frequency of the request that governs access to the IDFA, the identifier behind device-level targeting and attribution on iOS.