Data

Apple's App Tracking Transparency: A Deep Dive into the €150M Fine and Recent Developments

French regulators rule Apple's ATT framework created unfair competition by imposing asymmetric consent mechanisms disadvantaging smaller publishers.

Luís Rijo

Apr 18, 2025 • 7 min read

iOS 14.5 update screenshot showing App Tracking Transparency feature announcement that sparked Apple's €150M EU antitrust fine

The recent €150 million fine imposed on Apple by the French Competition Authority (Autorité de la concurrence) marks a significant moment in the ongoing tension between privacy protection and fair competition in digital markets. This complex case reveals how even well-intentioned privacy measures can become problematic when implemented by dominant platforms. Let's explore the key aspects of this ruling and its implications, including Apple's subsequent changes to its attribution systems.

Understanding App Tracking Transparency (ATT)

Apple introduced ATT in April 2021 with iOS 14.5, requiring apps to display a standardized pop-up asking users for permission before tracking their activity across other companies' apps and websites. This system gave users greater control over how their data is used for advertising purposes.

How ATT Works

When a user opens an app, ATT requires the app to display Apple's standardized prompt asking for permission to "track your activity across other companies' apps and websites."
Users can choose "Allow" or "Ask App Not to Track."
If tracking is refused, the app cannot access the device's Identifier for Advertisers (IDFA), a crucial tool for targeted advertising and attribution.
Users can also disable all tracking entirely through Settings > Privacy > Tracking by turning off "Allow Apps to Request to Track" – preventing apps from even displaying the prompt.

What Did the French Competition Authority Find Problematic?

The French regulator's investigation, which began with a complaint from industry associations in October 2020 and concluded in March 2025, identified several issues with ATT's implementation:

The ATT prompt doesn't collect valid consent under GDPR and French data protection laws. This forces app publishers to display their own Consent Management Platform (CMP) in addition to ATT, creating what the French data protection authority (CNIL) called "unnecessary and artificial complexity."

The CNIL noted that with "marginal modifications" to ATT, Apple could have created a system that both protected privacy and allowed publishers to collect valid consent in a single step.

The regulator found that ATT was designed with a structural bias against consent:

If users refuse tracking (in either ATT or a CMP), they only need to do so once
If users want to accept tracking, they must confirm their choice twice (once in ATT and again in the publisher's CMP)

This asymmetry, according to the Authority, undermines truly informed consent and creates unnecessary friction for users who might want to allow tracking.

3. Double Standards for Apple's Own Services

Until iOS 15's release in September 2021, Apple didn't request prior consent for its own advertising practices while imposing strict rules on third parties. Even after introducing consent for its own services, Apple uses a single "Personalized Ads" prompt for its data collection while requiring double consent for third-party publishers.

Furthermore, while ATT controls are prominently displayed, the settings to control Apple's own advertising tracking are buried deeper in the Settings menu under Privacy > Apple Advertising.

4. Disproportionate Impact on Smaller Publishers

The Competition Authority found that ATT particularly harmed smaller application publishers that lack sufficient proprietary data to develop alternative targeting mechanisms. Companies with large proprietary data sets (like Apple, Google, and Meta) could adapt more easily to ATT's limitations.

This finding highlights how seemingly neutral privacy measures can have disparate competitive effects depending on a company's market position and data resources.

Implications for the Digital Advertising Ecosystem

The ruling has several important implications for how we understand the relationship between privacy protection and competition in digital markets:

1. Privacy as a Shield for Market Advantage

The decision challenges the notion that privacy protection can serve as a blanket justification for platform design choices that disproportionately affect competitors. As industry professional Will Harmer noted: "The issue with ATT isn't consent frameworks - it's that one of the biggest platforms in the world is taking the data but stopping others from accessing it. That's not privacy. That's privilege."

2. The Impact on Advertising Effectiveness

The implementation of ATT dramatically reduced access to the IDFA, with opt-in rates reportedly between just 11% and 15% after its launch. This significant reduction in targeting capabilities has affected advertising revenues across the digital ecosystem.

3. New Approach to Regulatory Collaboration

The case represents a notable example of cooperation between competition and data protection authorities. The Competition Authority consulted the CNIL twice during its investigation, receiving formal opinions that helped shape its competitive analysis.

This collaborative approach signals that privacy and competition need not be viewed as opposing values, but as complementary goals that both contribute to a healthier digital ecosystem.

Apple's Response: AdAttributionKit Integration

In what appears to be a direct response to these regulatory concerns, Apple announced on April 10, 2025 (just eleven days after the French ruling) that Apple Search Ads would register with AdAttributionKit (formerly known as SKAdNetwork).

What This Change Means

This integration allows advertisers to evaluate Apple Search Ads campaigns alongside other advertising networks in a consolidated attribution framework, addressing one aspect of the uneven playing field identified by regulators.

Previously, Apple Search Ads campaigns were tracked separately through the AdServices API, creating a disjointed measurement ecosystem where last-click attributions might be counted twice in different systems.

The integration has several important implications:

Unified measurement: Developers can now evaluate Apple Search Ads alongside third-party networks using consistent attribution logic
Elimination of duplicate conversions: The previous dual-system approach sometimes resulted in the same conversion being counted twice
More accurate ROAS calculations: Return on ad spend metrics will become more reliable
Potential attribution shifts: Industry observers note that Apple Search Ads could begin "stealing" last-touch conversions from third-party networks

Is This Change Enough?

While the AdAttributionKit integration represents progress toward a more level playing field, it addresses only one aspect of the concerns raised by the French Competition Authority. The asymmetrical consent mechanics, unnecessary complexity, and different standards for Apple's own advertising services remain unaddressed.

As one app growth specialist noted on the timing: "Some people will say Apple cares about its customers, but I would thank the French antitrust regulators for fining them $150M."

Broader Context and Future Implications

This ruling comes amid increasing regulatory scrutiny of major technology platforms worldwide. The case highlights the complex interplay between competition law, data protection regulations, and the economic models of digital platform ecosystems.

What This Means for Other Platforms

The French regulator's finding that a dominant platform operator must balance legitimate objectives like privacy protection with fair competitive practices could influence similar cases pending in other jurisdictions, including reported investigations in Italy and Germany.

Other dominant platforms may need to reconsider how they implement privacy features, ensuring they don't unnecessarily disadvantage certain market participants or create artificial barriers to competition.

What This Means for App Developers

For app developers and marketers, these developments suggest several considerations:

Revisit attribution strategies: With Apple Search Ads now part of AdAttributionKit, attribution models may need adjustment to account for potential shifts
Consider diversification: Smaller publishers heavily dependent on iOS advertising may need to explore alternative revenue models
Watch for further changes: Apple may make additional adjustments to ATT in response to regulatory pressure

A New Framework for Platform Responsibility

Perhaps most importantly, this case establishes that dominant platforms have special responsibilities when implementing privacy features. The Competition Authority's president, Benoît Cœuré, emphasized this point: "A digital platform, especially when it occupies a dominant position, must ensure that the rules it sets for its users do not distort competition."

This principle - that privacy protection cannot serve as a shield for anti-competitive behavior - represents an important evolution in how we understand platform responsibility in the digital age.

Conclusion: Balancing Privacy and Competition

The French Competition Authority's decision highlights the delicate balance dominant platforms must maintain between legitimate privacy objectives and fair competition practices. While Apple's €150 million fine represents only about 0.03% of its annual revenue, the principles established in this case could have far-reaching implications.

The ruling demonstrates that privacy and competition need not be viewed as opposing values. Rather, they are complementary goals that, when properly balanced, contribute to a healthier, more innovative, and more equitable digital ecosystem. The challenge for platforms going forward will be to design privacy features that protect users while ensuring a level playing field for all market participants.

As digital markets continue to evolve, this case may serve as an important reference point for how dominant platforms should approach the crucial task of protecting both privacy and competition in an increasingly complex digital environment.