The Bundeskartellamt today declared binding a set of commitments under which Apple will rebuild the consent prompt that governs cross-company advertising data on iPhones and iPads in Germany. The warning hand symbol disappears. So does the word "tracking." App publishers gain up to 4,000 characters to explain why personalised advertising funds their apps, and three defined ways to stop asking the same user for consent twice.

The German competition authority closed its proceeding against Apple over the App Tracking Transparency Framework, known as the ATTF, on August 17, 2026. The underlying commitment decision carries the date of August 13, 2026, and the case reference B7-54/25. Apple has four months from service of that decision to implement the changes, and the commitments bind the company for seven years once implementation is complete.

Apple did not concede the point. According to the Bundeskartellamt, the company considers its rules compliant with competition law and comprehensively rejected the authority's preliminary assessment. It offered commitments anyway. The proceeding ends without a fine and without a finding of infringement.

What the authority objected to

The ATTF, introduced in April 2021, sets the conditions under which app publishers on iOS and iPadOS may combine user data across apps and companies for advertising purposes. The mechanism is the IDFA, Apple's Identifier for Advertisers, which allows a device to be recognised across different companies. Apple releases the IDFA to a third-party app publisher only after the user consents through a prompt that Apple largely predefines.

According to the Bundeskartellamt's investigation, no other technical route is equally suitable for exchanging data across companies. That single dependency is what turned a design question into a competition case.

Apple's own personalised advertising runs on different rails. The company does not use the IDFA and does not combine data across companies. It draws instead on data from within its own ecosystem, a pool that smaller app publishers cannot match. Apple therefore does not display the ATT prompt for its own advertising. Where it seeks consent, it uses a separate interface, the PA prompt, short for Personalized Ads prompt.

The authority did not object to the existence of the ATTF. It objected to two specific features of its design.

The first was the prompt itself. In the Bundeskartellamt's preliminary assessment, the ATT prompt steered users towards refusing consent while the PA prompt steered them towards granting it. The listed factors are granular: the warning hand symbol, the choice between the words "app tracking" and "personalised advertising," partially ambiguous descriptions of how data would be used, unequal space to explain the advantages of allowing data use, and the order in which the selection options appeared. Because the space Apple allowed was so tight, some publishers resorted to showing an additional pre-prompt before the ATT prompt in order to give users context.

The second objection concerned architecture. Publishers who need consent under data protection law generally collect it through a Consent Management Platform, or CMP. Publishers who also need IDFA access must additionally show the ATT prompt. The result, in cases of overlap, was two requests for what is partly the same permission. Apple shows no separate CMP prompt for its own personalised advertising.

"It is key that personal data and privacy are protected effectively when using apps. Apple is allowed to provide for a level of protection for its users that exceeds the minimum legal requirements," said Andreas Mundt, President of the Bundeskartellamt, in the announcement. "However, if Apple sets up additional rules within its ecosystem for the use of data, these rules must, under Germany's special abuse provision for large digital companies, not treat its own offerings better than those of its competitors."

The commercial weight behind the case

Two figures explain why associations representing the branded-goods, media and advertising industries pursued this for four years.

According to the Bundeskartellamt's investigation in the designation proceeding, up to 60 per cent of app publishers' turnover is achieved on the basis of Apple's distribution infrastructure. And Apple's economic exposure differs by monetisation model: the company frequently takes a commission from apps funded by user payments, but generally receives no share of app publishers' advertising revenue.

The authority states that relationship plainly rather than drawing an inference from it. The complainants drew the inference themselves, arguing that a gatekeeper should not be permitted to impose extra-statutory rules that restrict other companies, and that the ATTF reduced advertising revenue in ways that put their business models at risk.

Apple's position, recorded in the same documents, is that the ATTF protects user privacy beyond what data protection law requires and helps position the company as a provider of a high level of data protection.

German data protection authorities occupy a third position. According to the Bundeskartellamt, they view the ATTF positively as a matter of data protection policy, noting that not all app publishers fully comply with applicable law, while not considering the framework necessary under data protection law.

What changes in the prompt

The ATTF survives. Its interface does not.

Under the commitments, the ATT prompt will be redesigned so that users are no longer steered, in a manner relevant under competition law, towards refusing consent. Discouraging symbols and wording are removed. The Bundeskartellamt names two specifically: the warning hand symbol goes, and so does the term "tracking," which app publishers perceive as alarming.

Both the new ATT prompt and the PA prompt will carry what the authority considers an accurate explanation of how data may be processed if the user consents. The wording and the order of the selection options in the two prompts will be aligned more closely. In Germany, only the new ATT prompt and the correspondingly amended PA prompt will be shown.

The most concrete change for publishers is the Customizable Purpose String. App publishers will be able to write up to 4,000 characters explaining the relevance and advantages of personalised advertising for their business model. Apple's currently prescribed standard is one to two sentences.

They also gain a structural element: an additional text button inside the new ATT prompt, linking to a second layer page where granular settings or further information can sit.

The second layer button is what makes the new choice architecture possible. Where a publisher needs both data protection consent and Apple consent, the commitments define three approaches.

Option 1: one prompt for both

Publishers may combine the required CMP with the ATT prompt for all advertising data processing that falls within the ATTF's scope. User choices, Allow or Reject, then apply uniformly across both consent requests. This requires that every data protection requirement is met in the individual case: all first layer information goes into the Customizable Purpose String, and all second layer information and granular settings go behind the text button.

If the user selects Allow, the publisher may process user data for advertising purposes using the IDFA. The same applies to other processing within the ATTF's scope, including first-party data used for advertising. The user sees one prompt instead of two. A refusal likewise applies to both.

Option 2: separate prompts that reference each other

Publishers may keep their CMP separate and unchanged, which matters for those whose CMP is complex or was previously agreed with data protection authorities. The commitments then allow the new ATT prompt to indicate that the user has already consented under data protection law.

This route carries a sequencing rule. If the user declines in the CMP for the processing that overlaps with the ATTF's scope, the publisher may not proceed to display the new ATT prompt or use the IDFA. If the user did consent in the CMP, the publisher may display the new ATT prompt again 12 months after the last display, and IDFA access follows a subsequent Allow.

Option 3: separate prompts, no cross-reference

Publishers may continue exactly as before, serving CMP and ATT prompt independently. They still receive the new ATT prompt and its revised layout and wording.

The authority is explicit that none of this is designed to raise consent rates. "It is expressly not our aim to help achieve the highest possible levels of consent to personalised advertising. We want to ensure that users can make a free and informed decision," Mundt said. "Users who do not wish to allow their data to be used for personalised advertising must be able to make an equally free and informed decision as users who intend to consent to such data use."

The FAQ document accompanying the decision puts the consequence in flat terms: the resulting consent or refusal rates must be accepted by app publishers.

Implementation, monitoring and geographic scope

Apple has four months from service of the commitment decision to implement the changes in iOS and iPadOS and to inform app publishers. Before implementation, the company will run extensive technical testing with app publishers, described in the FAQ as Beta Seed Testing.

The commitments then run for seven years. The press release states that the commitments apply for seven years; the FAQ specifies that the seven years run from implementation rather than from the decision date, a distinction that matters for anyone counting the expiry.

An independent monitoring trustee will supervise compliance on the authority's behalf, mediate disputes between Apple and third-party app publishers, and report regularly to the Bundeskartellamt. Publishers who believe Apple has breached the commitments to their detriment can approach the trustee directly. Where the trustee cannot resolve a dispute, it informs and consults the Bundeskartellamt. Existing legal routes for enforcing the commitments remain available.

Geography limits the reach. The settlement applies to users with App Store billing addresses and devices located in Germany. The Bundeskartellamt notes it may also affect the future design of the ATTF in other EU member states, which is a prediction rather than an obligation.

The proceeding rested on Section 19a of the German Competition Act (GWB) and on Article 102 TFEU, the general prohibition of abuse of a dominant position.

Section 19a operates in two steps. The authority first declares that a company holds paramount significance for competition across markets, then may prohibit specified conduct. Apple received that designation in April 2023, and the Federal Court of Justice confirmed it in March 2025.

The overlap with EU law is not accidental. Apple was designated a gatekeeper under Article 3 of the Digital Markets Actby the European Commission in September 2023, with the App Store, iOS, iPadOS and Safari qualified as core platform services. The Bundeskartellamt states that the DMA does not preclude its proceeding, does not affect European or national abuse control rules, and expressly allows national decisions to impose obligations beyond those the DMA places on gatekeepers. Apple lost its challenge to that gatekeeper designation at the General Court on July 8, 2026.

Competition authorities in France, Italy, Romania and Poland have conducted or are still conducting their own ATTF proceedings. The Bundeskartellamt coordinated through the European Competition Network, involving the European Commission, and says the exchange covered possible future amendments to the ATTF.

Two of those proceedings ended in penalties. France's Autorité de la concurrence fined Apple 150 million euros on March 30, 2025, finding that the framework's implementation between April 2021 and July 2023 created unnecessary complexity and disadvantaged smaller publishers. Italy's competition authority imposed a fine of 98,635,416.67 euros on December 22, 2025 over the same double-consent burden. Germany chose remedy over penalty.

Data protection stayed outside the frame

The Bundeskartellamt examined competition law only. It did not assess whether Apple or app publishers breached data protection law, and did not aim to enforce it.

Data protection still shaped the case at two points. Apple's justification for the ATTF was that it protects privacy beyond statutory requirements, which the authority had to weigh when considering objective justification. And the authority had to avoid imposing commitments that conflict with data protection law, for which it exchanged views with the Federal Commissioner for Data Protection and Freedom of Information (BfDI) and the Bavarian State Office for Data Protection Supervision (BayLDA).

Why this matters for the marketing community

The measurable stakes have been documented in ways that complicate the simplest narratives. Reported opt-in rates after the framework's launch ran between 11 and 15 per cent, according to PPC Land's analysis of the French decision. Adjust's Mobile App Trends 2026 report put the industry-average opt-in rate at 38 per cent in the first quarter of 2026, up from 35 per cent a year earlier, as reported in coverage of Singular's 2026 ROI Index.

Academic work has questioned a different assumption. A four-year study by Reinhold Kesler, covered by PPC Land on its July 31, 2026 revision, found the framework raised the likelihood of an App Store app charging an upfront price by 0.071 percentage points against a Google Play control group. Publishers did not migrate to payments. What changed was what they could know about users.

For media buyers, the German remedy touches three things at once. Consent volume in one market may move, since the removal of the warning hand symbol and the term "tracking" addresses precisely the design factors regulators identified as suppressive. Whether that translates into higher IDFA availability is untested, and the authority disclaims any interest in the outcome.

Second, the operational burden shifts. Option 1 collapses two prompts into one for publishers whose data protection posture permits it, which reduces drop-off points in the consent flow. Option 2 offers a lower-risk path for publishers with a negotiated CMP, at the cost of the 12-month re-display rule. Both require engineering work inside a four-month window that Apple controls the timing of.

Third, the 4,000-character allowance changes who does the persuading. Under the current standard, Apple's one-to-two-sentence limit means the prompt says roughly what Apple says it says. Under the new one, a media publisher can set out its funding model in the same interface where the user decides. The Bundeskartellamt describes this as giving publishers scope to explain the significance of personalised advertising for their business model, and notes the improved conditions may also benefit advertisers and technical service providers.

The regulatory pattern is the wider point. Apple's advertising business has been expanding across placements and terms, from App Store search inventory to Maps and rewritten Apple Ads terms, while the rules constraining rival measurement have been litigated in four jurisdictions. Germany is the first to end with a design specification rather than a cheque. A monitoring trustee with a seven-year mandate and a dispute channel open to app publishers is a different instrument from a fine, and its effects will be visible in interface screenshots rather than in press releases.

Whether other member states adopt the German prompt is unresolved. The Bundeskartellamt says the solution may affect the future design of the ATTF elsewhere in the EU. Romania and Poland have proceedings running. The European Commission and the European Data Protection Board are separately finalising joint DMA and GDPR guidelines that would bind how designated gatekeepers handle consent for personalised advertising, a process that drew more than 100 public submissions before closing in December 2025.

For now, one country gets a redesigned prompt, and the rest of Europe gets a reference implementation.

Timeline

  • April 2021: Apple introduces the App Tracking Transparency Framework with iOS 14.5 and iPadOS 14.5, requiring a standardised prompt before cross-company tracking
  • June 2022: The Bundeskartellamt initiates its proceeding against Apple following complaints by associations representing app publishers and the advertising industry
  • April 2023: The Bundeskartellamt declares Apple of paramount significance for competition across markets under Section 19a(1) GWB
  • September 2023: The European Commission designates Apple a gatekeeper under the DMA, covering the App Store, iOS, iPadOS and Safari
  • July 25, 2023: End of the period examined in the French competition authority's ATT investigation
  • February 13, 2025: The Bundeskartellamt informs Apple and the admitted associations of its preliminary legal assessment
  • March 2025: The Federal Court of Justice confirms Apple's Section 19a designation
  • March 30, 2025: France's Autorité de la concurrence fines Apple 150 million euros over the ATT framework
  • December 2, 2025: The Bundeskartellamt opens a market test of Apple's offered commitments
  • December 22, 2025: Italy's competition authority fines Apple 98,635,416.67 euros over the same double-consent issue
  • July 8, 2026: The General Court dismisses Apple's challenge to its DMA gatekeeper designation
  • July 31, 2026: A revised four-year study on the framework's effects is published
  • August 13, 2026: The Bundeskartellamt issues its commitment decision in case B7-54/25
  • August 17, 2026: The Bundeskartellamt announces the commitments are binding and the proceeding is concluded
  • Four months from service: deadline for Apple to implement the changes in iOS and iPadOS, preceded by Beta Seed Testing with app publishers
  • Seven years from implementation: commitments expire, subject to monitoring by an independent trustee

Summary

Who: The Bundeskartellamt, Germany's federal competition authority, and Apple Inc. The proceeding was initiated following complaints by associations representing the branded-goods, media and advertising industries. Andreas Mundt, President of the Bundeskartellamt, is quoted in the announcement. Third-party app publishers, advertisers and advertising technology providers operating on iOS and iPadOS in Germany are the affected parties.

What: The Bundeskartellamt declared binding a set of commitments under which Apple will redesign the ATT prompt and simplify the consent architecture of its App Tracking Transparency Framework. The warning hand symbol and the term "tracking" are removed, the wording and order of selection options in the ATT prompt and Apple's own PA prompt are aligned more closely, app publishers gain a Customizable Purpose String of up to 4,000 characters and a second layer text button, and three defined approaches become available for combining or separating the ATT prompt and a Consent Management Platform request. The framework itself remains in force. No fine was imposed and no infringement was formally established.

When: The commitment decision is dated August 13, 2026 and was announced on August 17, 2026. Apple has four months from service of the decision to implement the changes, with Beta Seed Testing involving app publishers beforehand. The commitments then apply for seven years from implementation. The proceeding began in June 2022, reached a preliminary assessment on February 13, 2025, and entered a market test on December 2, 2025.

Where: The settlement applies to users with App Store billing addresses and devices located in Germany. The Bundeskartellamt coordinated with authorities in France, Italy, Romania and Poland through the European Competition Network and says the outcome may affect the ATTF's future design in other EU member states.

Why: The Bundeskartellamt's preliminary assessment held that the ATT prompt steered users towards refusing consent while Apple's PA prompt steered them towards granting it, and that requiring third-party publishers to collect consent twice created an unnecessarily complex choice architecture. The legal basis was Section 19a GWB, which applies to companies of paramount significance for competition across markets, together with Article 102 TFEU. The authority states its objective was a free and informed user decision rather than higher consent rates.