Apple fined €150 million: ATT framework ruled anticompetitive
Apple's App Tracking Transparency approach deemed disproportionate and harmful to smaller publishers.
The French Competition Authority (Autorité de la concurrence) has imposed a €150 million fine on Apple for abusing its dominant position in the mobile application distribution market. According to the French regulator, Apple's implementation of the App Tracking Transparency (ATT) framework between April 2021 and July 2023 created unnecessary complexity for users and unfairly disadvantaged smaller application publishers.
The decision, announced yesterday on March 30, 2025, marks a significant development in the ongoing tension between platform operators, application developers, and advertising networks over user data collection practices on mobile devices.
Apple introduced the ATT framework on April 26, 2021, with the launch of iOS 14.5 and iPadOS 14.5. The framework requires applications to display a standardized pop-up window asking users for explicit consent before collecting their data for targeted advertising purposes. If consent is granted, applications can access the Identifier for Advertisers (IDFA), which allows tracking user activity across different applications and websites.
The ATT framework was initially presented as a privacy-enhancing mechanism, giving users greater control over how their data is collected and used by third-party applications on Apple devices.
A long-running investigation
The case began on October 23, 2020, when several French advertising industry associations filed a complaint with the Competition Authority, anticipating the negative impact the ATT framework would have on their business models. While the Authority rejected a request for interim measures in March 2021, it continued investigating the matter.
After nearly four years of examination, the Authority has determined that Apple's implementation of the ATT framework constituted an abuse of its dominant position in the iOS and iPadOS application distribution market.
The Competition Authority found that while privacy protection is a legitimate objective, Apple's implementation of the ATT framework was neither necessary nor proportionate to achieve this goal.
According to the regulator's findings, the consent obtained through the ATT framework does not meet the standards required by applicable French data protection laws, particularly the French Data Protection Act. This forces application publishers to implement their own consent management platforms (CMPs) in addition to Apple's required ATT pop-ups.
"The result is that multiple consent pop-ups are displayed, making the use of third-party applications in the iOS environment excessively complex," the Authority stated in its decision, citing an opinion from the French data protection authority (CNIL) issued in 2022.
Luís Rijo
Neutrality undermined by asymmetric consent mechanics
The regulator identified specific issues with how the ATT framework's consent mechanics were designed. While users only need to refuse tracking once, they must confirm their consent twice if they wish to allow tracking. This asymmetry, according to the Authority, prevents the truly informed consent that the ATT framework purportedly aims to facilitate.
The Competition Authority emphasized that these issues could be addressed with "marginal modifications to the ATT framework, as recommended by the CNIL, and therefore seems all the more unjustified."
Double standards in Apple's treatment of its own applications
A particularly troubling aspect identified by the Authority was the different standards Apple applied to its own applications compared to third-party developers. Until the implementation of iOS 15, Apple did not request consent from users of its own applications while requiring publishers to obtain double consent for tracking on third-party sites and applications.
Luís Rijo
This asymmetry led the CNIL to fine Apple for infringing Article 82 of the French Data Protection Act, which transposes the European ePrivacy Directive. Despite subsequent changes, the Authority noted that asymmetry persists, as Apple now uses a single "Personalized Advertising" pop-up for its own data collection while continuing to require double consent for third-party publishers.
Disproportionate impact on smaller publishers
The Competition Authority found that the ATT framework has been particularly harmful to smaller application publishers that lack sufficient proprietary data to develop alternative targeting mechanisms.
Ad4Screen, a mobile marketing agency, testified that the loss of business for smaller players contrasts sharply with the situation of "players with their own data 'ecosystem' [that] can leverage their position to strengthen their offering without using IDFA or cookies." The agency specifically mentioned Meta and Google as examples of companies that can track users' journeys after viewing advertisements without relying on the identifiers restricted by Apple's framework.
Novel collaboration between competition and data protection authorities
This case represents a significant example of cooperation between the French Competition Authority and the French Data Protection Authority (CNIL). The two regulators published a joint declaration in December 2023 titled "Data protection and competition: a common ambition," expressing their intention to deepen their already established cooperation.
The Competition Authority consulted the CNIL twice during its investigation, receiving formal opinions that helped shape its competitive analysis. According to these opinions, bringing the ATT framework into compliance with competition law would not have compromised the effectiveness of Apple's privacy protection system.
The CNIL stated that "making publishers systematically collect user consent twice for the same purpose constitutes an unnecessary and artificial complexity," and suggested that "a marginal improvement in how the ATT framework is configured, which does not affect the readability of the pop-up, [...] would retain the user protection offered by the ATT framework [...] without having the disadvantage of creating a complex and excessive system for the user."
The Competition Authority concluded that this case demonstrates that "competition law and the right to privacy are not mutually exclusive, but both aim to guarantee a fair and transparent market that safeguards consumer interests and well-being."
Significant financial penalty and publication order
Based on the seriousness of the infringement, its duration (from April 26, 2021, to July 25, 2023), and Apple's economic power, the Competition Authority imposed a fine of €150 million on Apple Distribution International Limited and Apple Inc. as the direct perpetrators, with Apple Operations International Limited and Apple Inc. held liable as parent companies.
In addition to the monetary penalty, Apple has been ordered to publish a summary of the decision on its website for seven consecutive days.
Industry reaction
The decision has been met with approval from advertising industry representatives. Nicolas Rieul, Co-Founder at Actionable AI, who appears to have been involved in the case, posted on LinkedIn that "after four years of fighting, Apple has lost — and we have won!" He described the decision as "landmark" and suggested it "opens the door for the entire ecosystem to claim damages for the losses they have suffered."
Rieul expressed gratitude to various industry associations, including advertising networks, media agencies, and publishers, as well as their legal representatives and companies worldwide "who had the courage to testify, despite the risk of retaliation from Apple."
The case has generated significant interest across the digital advertising industry, with numerous professionals commenting on the potential implications for similar frameworks and restrictions implemented by major technology platforms.
Broader implications for platform regulation
This decision comes amid increasing regulatory scrutiny of major technology platforms worldwide. The case highlights the complex interplay between competition law, data protection regulations, and the economic models of digital platform ecosystems.
The French regulator's finding that a dominant platform operator like Apple must balance legitimate objectives like privacy protection with fair competitive practices could influence similar cases pending in other jurisdictions, including reported investigations in Italy and Germany.
The ruling also underscores the importance of proportionality in the implementation of user-facing privacy features, particularly when introduced by companies with significant market power that can shape entire economic sectors through platform design decisions.
Timeline
- October 23, 2020: Several French advertising industry associations file a complaint with the Competition Authority against Apple's planned ATT framework
- March 17, 2021: The Competition Authority rejects request for interim measures but continues investigation
- April 26, 2021: Apple launches the ATT framework with iOS 14.5
- 2022: The French data protection authority (CNIL) issues an opinion on the ATT framework at the Competition Authority's request
- December 12, 2023: The Competition Authority and CNIL publish a joint declaration on data protection and competition
- July 25, 2023: End of the period considered in the Competition Authority's investigation
- December 19, 2024: CNIL publishes conclusions of a mission examining the interplay between data protection and competition
- March 30, 2025: The Competition Authority announces a €150 million fine against Apple for abuse of dominant position