App Tracking Transparency (ATT) is the permission system Apple built into iOS, iPadOS and tvOS that requires an app to obtain a user's agreement, through a standard system prompt, before tracking that person across apps and websites owned by other companies. Without that agreement, the app receives no usable advertising identifier and is barred by Apple's rules from linking its data with outside data for ad targeting or measurement. Apple presents ATT as a privacy control. Advertisers, publishers and several European competition authorities have described it as a rule that Apple writes, enforces and partly exempts itself from.

How the prompt works

ATT is a software framework as well as a pop-up. A developer who wants to track must add a purpose string, the Info.plist key NSUserTrackingUsageDescription, explaining why. The app then calls requestTrackingAuthorization on the ATTrackingManager class, which displays the system alert with the developer's text and two buttons: "Allow" and "Ask App Not to Track". The prompt appears only once per app. Later calls simply return the stored answer.

The result is an authorisation status with four values: not determined (the user has not been asked), restricted (a parent or device manager has blocked tracking), denied and authorised. Only the last unlocks the Identifier for Advertisers (IDFA). In every other case the IDFA call returns a string of zeros. A global switch in Settings, "Allow Apps to Request to Track", lets a user refuse every app at once, and apps on such devices never see the prompt.

Apple's definition of tracking is broader than the identifier. It covers linking data collected in an app with data from "other companies' apps, websites, or offline properties for targeted advertising or advertising measurement purposes", as well as sharing data with data brokers, according to Apple's User Privacy and Data Use page. Hashed email addresses and phone numbers used to follow people across companies therefore need permission too. Apple holds developers responsible for every tracking SDK bundled into their apps. On-device matching and fraud prevention fall outside the definition.

Two further rules close the obvious workarounds. Under App Review Guideline 5.1.2(i), apps may not reward users for agreeing or withhold features from those who refuse. And Apple's developer licence states that an app "may not derive data from a device for the purpose of uniquely identifying it", which outlaws fingerprinting whatever the ATT answer.

The status travels into the auction. IAB Tech Lab's iOS 14 guidance added an atts extension to the OpenRTB device object, carrying the four states as 0 to 3, and told sellers to set the limit ad tracking flag to 1 unless the value is 3. A demand-side platform (DSP) seeing zeros in the ifa field can still bid on context, but cannot match the impression to a user profile.

From Limit Ad Tracking to a mandatory prompt

Apple introduced the IDFA with iOS 6 in September 2012, alongside an opt-out setting called Limit Ad Tracking that few users touched. ATT reversed the default. Apple announced the framework on June 22, 2020 at its developer conference, then delayed enforcement on September 3, 2020 after objections from developers and advertisers. Enforcement began with iOS 14.5 on April 26, 2021.

Measurement was rebuilt around the gap. Apple had launched SKAdNetwork in 2018 with iOS 11.3 as an attribution method that confirms an ad led to an install without revealing which device. With ATT, SKAdNetwork became the default way to measure iOS app campaigns for users who refused, at the cost of delayed postbacks, coarse conversion values and privacy thresholds. Its successor, AdAttributionKit, arrived with iOS 17.4 in March 2024; re-engagement measurement followed with iOS 18 and configurable attribution windows and country codes were announced in June 2025. Apple's own ad business, Apple Search Ads, said on April 10, 2025 that it would register with AdAttributionKit.

Apple also added a separate consent screen for its own advertising. Before iOS 15 in September 2021, Apple asked no permission for the personalised ads it shows in the App Store and its News and Stocks apps. Since then a Personalized Ads prompt has covered them. Apple argues no ATT prompt is needed because its ads draw only on first-party data and never use the IDFA.

Why it matters for marketers

Opt-in rates set the size of the addressable audience. Early figures put agreement at between 11% and 15%, rates cited by both the Italian authority and PPC Land coverage. Research by Kraft and colleagues, cited in a July 2026 paper by Heinrich Heine University economist Reinhold Kesler, estimated that the share of trackable US users fell from 72.6% to 17.9%. Rates have since recovered somewhat. Adjust, a measurement firm, put the industry average at 38% in the first quarter of 2026, up from 35% a year earlier, with gaming at 39% and publications at 26%, as reported by PPC Land. Methods differ: Flurry, an analytics firm, excludes users never shown the prompt, which flatters the rate.

The financial effect was large for companies that depended on cross-app data. Dave Wehner, then Meta's chief financial officer, told investors on February 2, 2022 that Apple's changes would cost the company "on the order of $10 billion" that year, according to CNBC. Mobile measurement partners rebuilt their products around aggregated postbacks and modelled data. Google later introduced on-device conversion measurement for iOS app campaigns, which processes de-identified app event data on the phone.

The change also moved data collection rather than ending it. Among apps that survived in Kesler's sample, the share disclosing data linked to users rose from 10.4% to 24.1% by 2025, and the shift towards paid downloads was a fraction of a percentage point. France's data protection regulator, CNIL, fined game publisher Voodoo 3 million euros on December 29, 2022 for using the identifier for vendors (IDFV) for advertising after users had refused ATT.

Competition disputes

The main criticism of ATT is not that it asks for consent but how. In Europe, the General Data Protection Regulation (GDPR) and the ePrivacy Directive already require consent for most tracking, and the ATT pop-up does not meet those legal standards on its own. Publishers therefore show a consent management platform as well, so agreeing takes two steps while refusing takes one. Apple's own apps faced a single, differently worded prompt.

France moved first. Advertising and publishing associations complained on October 23, 2020; the competition authority rejected interim measures in March 2021, then announced on March 31, 2025 that it had fined Apple 150 million euros, finding the implementation "neither necessary nor proportionate" to its stated aim. PPC Land coverage dates the decision itself to March 30. The authority did not order specific changes. Apple said it was "disappointed" with the decision, according to Reuters. Critics argued that the case exposed the gap between Apple's treatment of itself and of rivals.

Italy's AGCM, which opened its case on May 2, 2023, fined Apple 98.6 million euros on December 22, 2025, calling the double consent "excessively burdensome for developers and disproportionate to the privacy-protection objective allegedly pursued by Apple." Poland's UOKiK brought abuse-of-dominance charges on November 25, 2025. Its president, Tomasz Chrostny, objected to the wording itself: "no one likes the idea of being 'tracked'." Romania has also opened a case.

Germany took a different route. The Bundeskartellamt opened proceedings in June 2022 and on February 13, 2025 issued preliminary findings that third-party apps could face up to four consent dialogues while Apple's apps showed at most two. On August 13, 2026 it accepted binding commitments for seven years, without a fine. Andreas Mundt, its president, said: "It is expressly not our aim to help achieve the highest possible levels of consent to personalised advertising."

Apple contests the premise. It maintains the prompt applies equally to all developers, including itself, and on October 23, 2025 warned that "intense lobbying efforts in Germany, Italy and other countries in Europe may force us to withdraw this feature to the detriment of European consumers", according to AppleInsider.

What App Tracking Transparency is not

IDFA. The identifier is the thing being guarded; ATT is the gate. Apps can be refused the IDFA and still track by other means, which Apple's rules forbid but cannot always detect.

SKAdNetwork and AdAttributionKit. These are measurement frameworks that work without ATT permission. They report campaign outcomes in aggregate; ATT governs user-level tracking.

Intelligent Tracking Prevention. Safari's web protection limits cookies and scripts in the browser. It applies to websites, not to apps, and shows no prompt.

Consent management platform. A CMP collects consent under European law for specific vendors and purposes. ATT is a single yes-or-no system permission that, in Europe, does not replace it.

Recent developments

The German commitments are now spreading beyond Germany. On September 16, 2026, Apple published an alternative ATT prompt for iOS 27.2, then in developer beta, that drops the word "track", replaces "Ask App Not to Track" with "Reject", adds an optional "Additional Information" button and allows formatted purpose text. It will be the only version shown in Germany, France, Italy, Poland and Romania, and optional in the other 22 European Union (EU) member states. EU apps may ask again one year after a user's last answer. The German deadline falls no earlier than December 13, 2026, four months after service of the decision. Whether softer wording lifts opt-in rates, and whether other authorities, including those enforcing the Digital Markets Act, accept the redesign, remain open. The earlier French case and its aftermath suggest any answer will take years.

Timeline

  • September 2012: Apple introduces the IDFA and Limit Ad Tracking with iOS 6
  • March 2018: SKAdNetwork launches with iOS 11.3
  • June 22, 2020: Apple announces App Tracking Transparency
  • September 3, 2020: Apple postpones enforcement
  • October 23, 2020: French industry associations file a complaint
  • April 26, 2021: ATT takes effect with iOS 14.5
  • September 2021: iOS 15 adds Apple's Personalized Ads prompt
  • February 2, 2022: Meta says Apple's changes will cost about $10 billion that year
  • June 2022: The Bundeskartellamt opens proceedings
  • December 29, 2022: CNIL fines Voodoo 3 million euros over IDFV use after ATT refusals
  • May 2, 2023: Italy's AGCM opens its investigation
  • March 2024: AdAttributionKit launches with iOS 17.4
  • February 13, 2025: The Bundeskartellamt issues preliminary findings
  • March 31, 2025: France announces a 150 million euro fine
  • April 10, 2025: Apple Search Ads commits to AdAttributionKit
  • October 23, 2025: Apple warns it may withdraw ATT in Europe
  • November 25, 2025: Poland's UOKiK brings charges
  • December 22, 2025: Italy fines Apple 98.6 million euros
  • August 13, 2026: The Bundeskartellamt accepts Apple's commitments
  • September 16, 2026: Apple publishes the alternative ATT prompt for iOS 27.2

Summary

Who. Apple designs and enforces ATT. App developers, ad networks, measurement firms and DSPs must comply with it. Competition authorities in France, Italy, Germany, Poland and Romania have challenged how it is implemented.

What. A system prompt and framework that makes apps ask permission before linking their data with other companies' data for advertising or sharing it with data brokers. Refusal zeros the IDFA and bars tracking by other means.

When. Announced on June 22, 2020 and enforced from iOS 14.5 on April 26, 2021. France and Italy fined Apple in March and December 2025; Germany accepted commitments on August 13, 2026, and a redesigned EU prompt was published on September 16, 2026.

Where. On iPhone, iPad and Apple TV apps worldwide, with an alternative prompt compulsory in five EU countries and optional in the remaining 22.

Why. Apple says it gives users control over cross-company tracking. Its effect has been to cut the share of trackable iOS users sharply, push measurement towards aggregated frameworks, and raise unresolved questions about whether a platform owner can set privacy rules that bind rivals more tightly than itself.