Apple's commitments to Germany's Federal Cartel Office give app developers a single chance to put a redesigned App Tracking Transparency prompt in front of German iPhone and iPad users once the changes take effect, and the text does not exclude people who turned down the old one. The provision sits on page 9 of a 23-page English courtesy translation of Apple's offer in case B7-54/25, dated August 7, 2026, and signed by Kyle Andeer, Apple's vice president for products and regulatory law. The Bundeskartellamt declared the commitments binding on August 17. Its announcement that day described neutral wording and a closer match between Apple's own advertising prompt and the one third-party apps must use. The full text goes further: into fees, review deadlines, the way Apple decides who counts as a German user, and the court and regulatory rulings that would let Apple ask to reopen the deal.

In Short

Apple has promised Germany's competition authority that apps may show its new, more neutral tracking-permission screen to German users once after the change takes effect, and again a year after each answer, whatever they chose on the old screen. That matters to any app that earns money from personalised advertising in Germany, because a large share of iPhone users declined the old screen. The practical change is a fresh round of permission requests on German devices, with Apple barred for seven years from making the underlying tools harder or costlier to use.

What the document is

The text is a formal offer under Section 32b of the German Act against Restraints of Competition, the GWB, made jointly by Apple Inc. and Apple Distribution International Ltd., the company's Irish subsidiary. Its purpose, in its own words, is to "resolve preliminary concerns of the Bundeskartellamt under Section 19a(2) GWB and/or Art. 102 TFEU" regarding the App Tracking Transparency Framework. Those concerns were set out in a preliminary legal assessment dated February 13, 2025, when the authority found that Apple's app tracking rules may violate competition law, in part because the rules could treat third-party developers less favourably than Apple's own advertising services.

Apple concedes nothing. "Nothing in these Commitments may be construed as implying that Apple agrees with any preliminary views expressed by the Bundeskartellamt in its preliminary legal assessment dated 13 February 2025, including on the application and scope of Section 19a GWB and/or Art. 102 TFEU," the document states. The commitments are also declared to be without prejudice to Apple's position in any other proceedings.

The offer predates the decision by days. The Bundeskartellamt's decision is dated August 13, 2026, and was announced on August 17, when PPC Land reported that Apple faces a four-month deadline to redesign the ATT prompt in Germany. On September 16, Apple told developers that five EU countries would lose its standard tracking prompt for a redesigned one from iOS 27.2: Germany, France, Italy, Poland and Romania. The commitment text binds Apple only in Germany. It is the most detailed public account so far of what Apple has promised in any of those markets.

One more ask, once

The provision with the most direct consequences for advertisers is Section B.I.4.1. For users who have not switched off "Allow Apps to Request to Track" in their Privacy & Security settings, it says "Developers may surface the New ATT Prompt to Apple Users in the Geographic Scope after Apple publicly notifies Developers on the Commitments." A separate passage on developer documentation describes the same right as "the option to surface the New ATT Prompt once after implementation of the Commitments," and commits Apple to explain it in the iOS release notes.

The text does not limit that one-off prompt to users who have never answered. Since anyone who has never seen an ATT prompt can already be asked, the clause has practical meaning mainly for people who answered the old version, including those who declined it.

A second rule follows. "Developers will also have the possibility to resurface the New ATT prompt one year after a user has made a choice to allow or reject the request to Data Linking in ATT made in a previous ATT prompt," the commitment states, unless the user has disabled the settings switch. That yearly re-ask therefore covers both answers in the German text itself. Apple's User Privacy and Data Use page applies the same one-year rule across the EU, regardless of whether the earlier choice was to accept or reject. PPC Land could not find the one-off post-implementation prompt described on that page.

Two limits apply to both kinds of re-ask. "Developers should not display a New ATT Prompt if the Apple User has not granted any relevant Privacy Consent in the Developer's CMP," according to Section B.I.3.2, CMP being the consent management platform a publisher uses to collect consent under data protection law. And where a user rejects every consent option on a developer's second-layer page, "Developers must not resurface the New ATT Prompt." A user who has said no in a publisher's own consent tool is therefore, on paper, outside the reach of the new prompt.

Why does a single extra prompt matter? Opt-in rates ran between 11 and 15 per cent after the framework took effect, according to figures cited in the French competition decision. Adjust measured an industry average of 38 per cent in the first quarter of 2026. Every German user who declined between April 2021 and the implementation date was asked with a prompt that Apple has now agreed to rewrite. The commitments do not say how many developers will use the one-off option, and nothing in the text predicts what share of users will answer differently.

A full-page prompt without the word "track"

Section B.I.1.2 sets out the redesign in detail. "The New ATT Prompt will be enlarged so that it covers an entire page." Its header graphic will be blue and "depict two dots connected by an oscillating line," replacing the white hand on a blue background that Apple uses for privacy and security controls. The words "track" and "tracking" disappear from the standard language, which will instead describe the types of data linking involved and make clear that permission merely gives developers the "possibility" to engage in it.

Typography changes too. The standard text will not be bold, except for the app name and an "App Explanation" heading above the developer's own text. Developers gain bold and italic fonts, paragraph breaks and bullet points in that developer-written section, called the Customizable Purpose String. The choice buttons will read "Allow" and "Reject" in English and "Erlauben" and "Ablehnen" in German, and their "design, order and language" will be "fully aligned" with Apple's own Personalized Ads prompt.

The mock-ups use The New York Times as the sample app. The English version reads: "'The New York Times' would like permission to link your app activity with data from other companies' apps, websites, or with offline data, for personalized advertising or to measure advertising effectiveness. The New York Times may also share your information with data brokers." The German mock-up says the app "möchte die Möglichkeit erhalten" - would like to obtain the possibility - while the English sample asks for "permission", without the word the commitment text itself uses. In the German sample, the app explanation is left in English.

The commitment also records a size. Apple will link developers to its documentation on purpose strings, which "includes information on the possibility to include text up to 4000 bytes in the Customizable Purpose String." Earlier coverage, based on the Bundeskartellamt's materials, described the limit as 4,000 characters. The difference is not academic for German-language text: in UTF-8 encoding, letters such as ä, ö, ü and ß take two bytes each, so a 4,000-byte string holds fewer than 4,000 characters whenever it contains them.

One more line widens the prompt's scope. Developers may use the purpose string and the new button to obtain consents for cross-company data linking, "including first-party data use for advertising purposes that may be part of the broader data processing activities included in Data Linking Covered by ATT." The definition of what ATT covers is otherwise Apple's existing one: linking app data with data from other companies' apps, websites or offline sources for targeted advertising or measurement, or sharing data with data brokers. The same definitions state that the ATT prompt also controls access to the device's IDFA, Apple's resettable advertising identifier. On-device linking, fraud prevention and consumer reporting agencies remain excluded.

The "Additional Information" button

Section B.I.2 describes a new Text Button, labelled "Additional Information" in English and "Zusätzliche Informationen" in German, placed directly after the developer's text. Its use is optional. To the user it looks like a hyperlink. Technically, it ends the system dialog without an answer: "When the user taps the Text Button, the ATT TCC will technically be dismissed, being neither accepted nor denied." TCC refers to Apple's Transparency, Consent, and Control framework, the system that presents permission requests. An additional API tells the developer that the button was pressed, and the developer writes its own handler.

The commitments list the routes. A developer may open a native view built with UIKit or SwiftUI, a web page inside the app through SFSafariViewController or WKWebView, or the user's default browser through UIApplication.shared.open. To bring users back, developers who stay inside the app can "simply re-present the TCC," while those who send users to a browser can use a Universal Link or a custom URL scheme. Apple's developer documentation implements this through a new method, requestTrackingAuthorization(usingExpandedInterface:additionalInformationAction:completionHandler:), which returns a "not determined" status when the button is tapped.

What sits behind the button is called the Second Layer Page. Developers may embed "granular selections of purposes or third parties" for consents under the GDPR and the ePrivacy Directive, and the page is "entirely within the Developer's control." Apple will see none of it. "Apple will not systematically review the Second Layer Page," Section B.I.2.7 states.

The ATT answer still decides access. "None of the Apple Users' choices in the page surfaced by the Developer will control nor interact with the Apple User's choice in the New ATT Prompt for purposes of ATTF permissions," the text says. "If the Apple User ultimately taps on 'Reject' in the New ATT Prompt, the Developer will not get access to the IDFA and must respect their decision, regardless of what the Apple User has done in any Second Layer Page surfaced by the Developer." Developers also remain free to collect consents through other tools, such as a consent management platform, provided this does not contradict the user's ATT decision.

Publishers in Germany have long complained of a double-consent problem: a consent banner under data protection law followed by Apple's prompt asking much the same question. Section B.I.3 addresses it directly. Apple "commits not to object" to developers using the purpose string to refer to consents that, according to the developer, the user gave in an earlier screen. It supplies sample wording in German and English. The English reads: "[App] indicates you allowed [app] to use your data for advertising purposes in [app's] legal prompt. Would you like your Apple device to provide [app] access to the advertising ID or otherwise allow [app] to use other means for the data processing described above."

Developers may write their own variants, provided the text "does not manipulate, trick or force Apple Users to consent." App Review keeps the right to reject a prompt that refers to a consent when no consent window was actually shown beforehand. Developers should also not imply that the user has already consented for ATT purposes, or must agree because of an earlier choice.

The German string is an addition, not a replacement. Developers keep a separate purpose string for the rest of the world, "given other parts of the world do not necessarily have CMPs," according to the text.

Apple's own advertising prompt

Section B.II covers Apple's side of the ledger, with a notable qualifier. The commitments apply "to the extent Apple continues to offer Personalized Ads in the Geographic Scope" - wording that leaves Apple free to stop offering personalised ads in Germany rather than show the new prompt.

If it continues, German users will see a new Personalized Ads prompt with the same Allow and Reject buttons. Its full wording is set out in the document. Part of it reads: "Apple would like to use your account information, your app and content purchases, and where available, the types of News stories you read, to personalize ads in Apple apps such as the App Store and Apple News." It continues: "Apple Ads protects your privacy by using device-generated identifiers to deliver ads and does not link your ad viewing or interaction information to your Apple Account." And: "Rejecting will prevent Apple from using this information for ad personalization, but it will not decrease the number of ads you see." The prompt closes with "Apple does not share your personal information with third parties."

Apple will also rewrite its settings screens. Language stating that "Apple does not track" will be changed under Privacy & Security and Apple Advertising. On the ATT side, "targeted advertising" becomes "personalized advertising" in the relevant settings, and the German versions replace "Datenbroker" with "Datenvermittler". Across the EU, Apple has already renamed the settings switch to "Allow Apps to Request to Link Your Activity Across Companies," according to its developer page.

The asymmetry between the two prompts was central to the case and to others like it. Italy's competition authority fined Apple about 98.6 million euros for making developers ask users twice on December 22, 2025, while Apple's own prompt asked once. Apple's advertising business, meanwhile, keeps growing: on November 2, 2026, the company said its ad business set an all-time record in the September quarter, without publishing a figure.

No fees, no workarounds

Section VII is short and broad. Apple "will not, in any way, directly or indirectly by an act or omission, circumvent or attempt to circumvent these Commitments." The listed examples include:

  • "Making access to the technical framework for the New ATT Prompt more difficult than at present"
  • "Restricting Developers' access to the IDFA in ways other than the ATTF through changes in the Guidelines or Apple Developer Program License Agreement or through new technical restrictions"
  • "Demanding fees from Developers for access to the IDFA"
  • "Providing Developers with insufficient or misleading information related to the Commitments"
  • "Rendering the options made available to Developers under these Commitments unattractive, ineffective or less effective compared to the status quo after the full implementation of the Commitments"

Apple does not charge for the IDFA at present, and the document does not suggest it planned to. The clause matters because it fixes the current terms of access to Apple's advertising identifier in Germany for the life of the commitments, and because it covers changes made through the App Review Guidelines and the developer licence agreement, the two documents through which Apple usually changes platform rules.

Who counts as a German user

Section B.III sets a double test. The new ATT prompt, the new Personalized Ads prompt and the revised settings screens apply to users who have a billing address in Germany in their Apple Account "and" whose device location reports Germany. Users who meet only one condition keep the German versions "for thirty (30) calendar days. After this period, the prompts will switch to those corresponding with the user's country as reported by the device."

That rule differs from Apple's wider EU wording. Apple's developer page says only the alternative prompt is available for apps distributed in Germany, France, Italy, Poland and Romania. Its technical documentation, as PPC Land reported in September, ties the expanded interface to a device located in an EU country and an Apple Account set to an EU country or region. The German commitments give the Bundeskartellamt enforcement powers only over the German arrangement. Which legal requirement drives the change in the other four countries, Apple has not said.

Review clocks and the paper trail

Section VIII creates deadlines for Apple's app reviewers. App Review must give written reasons when it rejects an app or update that implements the commitments, and "should work towards reaching a decision and inform the Developer about it within 15 Working Days." The same 15-working-day target applies to appeals before Apple's App Review Board, which must include "an individual familiar with the Commitments" and give a reasoned written response.

The definition of a working day is American. "Working Days means the weekdays Monday to Friday excluding Federal Holidays in the USA," the text states. December 26 and Easter Monday, both public holidays in Germany, therefore count toward the clock; US Thanksgiving does not.

Documentation has its own deadlines. If the Bundeskartellamt notifies Apple that technical documentation is missing or inaccurate, Apple has 25 working days to fix it, and it must tell the authority and the trustee of substantive documentation changes within five working days of publishing them. Apple's annual reports to the trustee will list App Review Board decisions connected to the commitments, with the submission date, decision date, the developer's contact details, the app name, rejection correspondence and the outcome, plus summary statistics on submissions, rejections, appeals and reversals. A footnote adds a caveat about the appeal data: "Apple does not independently verify such information."

The monitoring trustee

Section X puts an independent Monitoring Trustee between Apple and developers. Within one month of the commitments becoming binding, Apple must propose at least two candidates. The Bundeskartellamt approves or rejects them, and Apple appoints within three weeks of approval. If every candidate is rejected, Apple proposes two more within a month; if those fail too, the authority names the trustee itself.

Apple pays the trustee but cannot direct it. "The Monitoring Trustee is bound by instructions from the Bundeskartellamt, but not from Apple," the text says. Neither the trustee nor its staff may work for Apple during the mandate or for three years afterwards.

The trustee's duties include checking Apple's acceptance of developers' purpose strings, the technical working of the Text Button and the speed of appeals; reviewing the settings language and documentation Apple proposes; resolving disputes between developers and Apple; and filing a first compliance report within three months of implementation, followed by annual reports. Developers may file written complaints directly. Unresolved disputes go to the Bundeskartellamt with the trustee's recommendations.

There are firm limits. The trustee may not take part in product design decisions, may not interfere in App Review, has none of the authority's investigative powers, and "shall not make any public statements relating to the performance of its functions." Its findings, in other words, reach the Bundeskartellamt and Apple, not the public.

The timetable and the exit door

Apple must implement the commitments "within four (4) months of the Effective Date," which the document defines as the date the Bundeskartellamt declares them binding. Implementation includes public iOS and iPadOS releases, full functionality and documentation for developers, and public information. The authority's own announcement counts the four months from service of the decision, a date it has not published. Counting from the August 13 decision date gives December 13, 2026, a PPC Land calculation. The Bundeskartellamt may extend the deadline on a substantiated request "due to exceptional circumstances."

Some of the work has shipped. iOS 27.2, which introduced the alternative expanded ATT prompt in the EU, reached the public on October 26, 2026, according to MacRumors. Apple's developer page on the EU changes says nothing about its own Personalized Ads prompt, so whether Apple regards the German commitments as fully implemented is not public.

Once implemented, the commitments run "for a period of seven (7) years from the Implementation Date" - to around the end of 2033 on the December timetable, again by PPC Land's count.

Section VI sets out how they could end sooner. Apple may ask the authority to revoke or amend the decision if circumstances change significantly. More specifically, a Situation of Conflict arises if a binding ruling of a German court, the EU General Court or the Court of Justice, a final decision of a German data protection authority or of the Irish Data Protection Commission, a final European Commission decision with effects in Germany, or a change in applicable law obliges Apple to act against the commitments. Apple then has three months to notify the Bundeskartellamt and may propose new commitments. For conflicts that stem from data protection decisions or law, the authority will consult the relevant data protection regulator and may run a market test. It can accept new terms, or rescind the decision and reopen the case. If it rejects Apple's claim of a conflict, Apple keeps complying but "reserves its right to make use of all admissible means of legal recourse, including seeking interim relief."

The Irish regulator sits on that list alongside German authorities and courts. Apple Distribution International, one of the two signatories, is Apple's Irish subsidiary.

Why this matters for the marketing community

App Tracking Transparency has shaped mobile advertising economics since April 2021. Without consent, apps cannot read the advertising identifier used for attribution, frequency capping and audience targeting across other companies' apps and sites. One four-year study found that ATT shifted 0.07 per cent of apps to paid downloads.

In Germany, the terms of that gate are now written down in a binding competition decision with an outside monitor. For publishers and app developers, three provisions stand out. The one-off re-ask creates a single window in which every German user who has not switched off the settings switch can be asked again, under a prompt that no longer uses the word "track" and no longer shows a privacy warning symbol. The consent-referencing language lets a publisher's consent tool and Apple's prompt work as a sequence rather than two separate interrogations. And the anti-circumvention clause, including the fee ban, keeps Apple from changing the economics of access for seven years.

The text also leaves questions open. It does not set any target for consent rates, and Andreas Mundt, the Bundeskartellamt's president, said on August 17 that helping to achieve the highest possible consent levels for personalised advertising was expressly not the authority's aim. It does not explain why the English sample prompt omits the "possibility" wording the commitment requires. It names a 4,000-byte limit where earlier materials said 4,000 characters. And it binds Apple only in Germany, even as Apple applies a redesigned prompt in four more EU countries under terms no regulator has published. Competition cases elsewhere - France's 150 million euro fine on March 30, 2025 and Italy's ruling in December 2025 - addressed the same framework but produced penalties, not a public rulebook.

For advertisers buying German app inventory, the immediate effect depends on how many developers take up the one-off prompt and how users respond to a screen that describes data linking instead of tracking. Neither is knowable from the document. What it does establish is that Apple's own Personalized Ads prompt and third-party prompts must now look and read alike in Germany - the point on which the competition case turned, and the reason self-preferencing concerns brought a privacy feature before a competition authority in the first place.

Timeline

Summary

Who: Apple Inc. and Apple Distribution International Ltd., which offered the commitments; Germany's Federal Cartel Office (Bundeskartellamt), which declared them binding; app developers and publishers distributing iOS and iPadOS apps in Germany; and German users of Apple devices. The offer is signed by Kyle Andeer, Apple's vice president for products and regulatory law.

What: A 23-page commitment text that redesigns the App Tracking Transparency prompt and Apple's own Personalized Ads prompt for Germany, adds an optional "Additional Information" button leading to a developer-controlled second-layer page, lets developers refer to consents already collected, allows a one-off re-ask after implementation and a yearly re-ask after each answer, bars Apple from charging for IDFA access or otherwise circumventing the terms, sets 15-working-day review targets, and installs an independent monitoring trustee for seven years.

When: The offer is dated August 7, 2026. The decision is dated August 13 and was announced on August 17, 2026. Implementation is due within four months, which by PPC Land's count points to mid-December 2026, and the commitments then run for seven years.

Where: Germany, for users whose Apple Account billing address and device location are both German, with a 30-day transition for users who meet only one condition. Apple applies a redesigned prompt in France, Italy, Poland and Romania too, under terms that are not public.

Why: The Bundeskartellamt's preliminary view was that Apple's tracking rules treated third-party apps less favourably than Apple's own advertising services. Apple disputes that view but offered the commitments to close the case under Section 19a GWB and Article 102 TFEU, while keeping the right to seek changes if courts, data protection authorities or new laws pull in another direction.