Italy fines Apple €98.6 million for making developers ask users twice

The Italian Competition Authority imposed a €98,635,416.67 fine on Apple Inc., Apple Distribution International Ltd, and Apple Italia S.r.l. on December 22, 2025, for abusing its dominant position in the market for platforms distributing apps to iOS users. The decision marks the latest European regulatory action against Apple's App Tracking Transparency framework, which competitors and regulators increasingly view as anticompetitive despite its stated privacy objectives.

The investigation, opened on May 2, 2023, and expanded on October 8, 2024, centered on the restrictive nature of Apple's ATT policy from a competition law perspective. According to the Italian authority's executive summary, the policy requires third-party developers to obtain specific consent for data collection and linking for advertising purposes through Apple's standardized ATT prompt. However, the prompt does not meet privacy legislation requirements regarding consent acquisition, forcing developers to deploy their own consent management platform prompt in addition to Apple's mandatory interface.

This double consent requirement creates what the authority described as an exploitative abuse by a dominant undertaking pursuant to Article 102, letter a) of the Treaty on the Functioning of the European Union. The investigation revealed that third-party developers must request consent a second time for the same purpose—collecting and linking data for advertising—creating unnecessary friction in the user experience while disadvantaging competitors.

The authority emphasized it does not challenge Apple's potentially legitimate decision to strengthen user privacy protections within iOS. Rather, the decision takes issue with imposing measures that are "excessively burdensome for developers and disproportionate to the privacy-protection objective allegedly pursued by Apple," according to the executive summary. The Italian Data Protection Authority confirmed in its August 4, 2025, opinion that Apple could have achieved the same privacy protection objectives through means less restrictive to competition.

Apple holds what the Italian authority characterized as an "absolute dominant position" in the market for supplying developers with platforms for online app distribution to iOS users. This dominant position allowed Apple to unilaterally impose the ATT policy rules on third-party developers in April 2021 without consulting those developers beforehand. The App Store serves as the exclusive distribution channel for iOS applications, giving Apple complete control over developer access to the platform's user base.

The investigation found that the increased burden of the consent-acquisition process led to reduced consent rates for advertising profiling among third-party developers following ATT's introduction. User data represents a key input for personalized online advertising—higher-quality and larger data volumes improve the ability to identify users genuinely interested in advertised products, services, or apps. Restrictions on collecting, linking, and using such data harm developers whose business models rely on advertising space sales, as well as advertisers and advertising intermediation platforms.

Smaller operators face disproportionate harm from ATT restrictions. These companies access more limited data and therefore encounter greater difficulties profiling users for advertising purposes compared to larger platforms with extensive proprietary data ecosystems. The authority noted that companies like Meta and Google adapted more easily to ATT's limitations because they maintain substantial first-party data sets unavailable to smaller publishers.

The investigation documented actual economic effects from Apple's conduct. Developers and advertising platforms experienced reduced revenues while advertisers faced increased costs following ATT's implementation. Consent rates dropped to between 11% and 15% after the framework launched with iOS 14.5 in April 2021, dramatically limiting access to the Identifier for Advertisers that enables targeted advertising and attribution.

Evidence demonstrated that Apple could have achieved privacy protection objectives without imposing double consent mechanisms. The Italian Data Protection Authority's opinion confirmed that marginal modifications to ATT would have created a system protecting privacy while allowing developers to collect valid consent in a single step. The current implementation creates structural bias against consent: users refusing tracking need only decline once, while users wanting to accept tracking must confirm their choice twice—once in ATT and again in the developer's consent management platform.

The ATT rules appear capable of generating direct financial benefits for Apple itself. According to the authority's findings, App Store services revenues increased through higher commissions collected from developers through the platform. Apple's advertising division, which is not subject to the same stringent rules imposed on third parties, ultimately benefited from increased revenues and higher volumes of intermediated advertisements.

Apple launched ATT in April 2021 with iOS 14.5, requiring apps to display a standardized pop-up asking users for permission before tracking their activity across other companies' apps and websites. The system gave users control over how their data is used for advertising purposes. When a user opens an app, ATT requires the app to display Apple's standardized prompt asking permission to "track your activity across other companies' apps and websites." Users can choose "Allow" or "Ask App Not to Track." If tracking is refused, the app cannot access IDFA.

Apple's own advertising practices operate under different rules than those imposed on third parties. Until iOS 15's release in September 2021, Apple didn't request prior consent for its own advertising practices while imposing strict rules on others. Even after introducing consent for its own services, Apple uses a single "Personalized Ads" prompt for its data collection while requiring double consent for third-party publishers. The ATT controls are prominently displayed, while settings controlling Apple's own advertising tracking are buried deeper in the Settings menu under Privacy > Apple Advertising.

The case represents significant coordination between competition and data protection authorities. The Italian Competition Authority conducted its investigation in consultation with the European Commission, other national competition authorities, and the Italian Data Protection Authority. This collaborative approach signals that privacy and competition need not be viewed as opposing values but as complementary goals contributing to a healthier digital ecosystem.

The Italian decision follows France's March 31, 2025, ruling that imposed a €150 million fine on Apple for similar ATT-related competition violations. The French Competition Authority determined Apple's implementation created "unnecessary complexity for users and unfairly disadvantaged smaller application publishers." Both European decisions emphasize proportionality concerns—privacy protection measures must not impose anticompetitive burdens exceeding what is necessary to achieve legitimate objectives.

German authorities announced in February 2025 that Apple's app tracking rules may violate competition law, with the Bundeskartellamt finding Apple defined "tracking" narrowly to only cover data processing across companies, exempting its own practice of combining user data within its ecosystem. Andreas Mundt, President of the Bundeskartellamt, stated that Apple maintains extensive access to user data through its digital ecosystem, allowing the company to generate significant advertising revenue by offering personalized advertising in its App Store.

The regulatory scrutiny extends beyond Europe. Multiple competition authorities worldwide have examined Apple's implementation of privacy measures that competitors argue create competitive advantages for Apple's own services while restricting third-party developers. Industry observers note the timing of Apple's April 10, 2025, announcement that Apple Search Ads would register with AdAttributionKit, coming just eleven days after the French penalty, suggests the company may be addressing concerns about preferential treatment of its advertising services.

AdAttributionKit, formerly known as SKAdNetwork, now covers 77% of all referral-based conversions to the App Store according to recent industry data. The integration means app advertisers no longer need to manage two different attribution methods, eliminating duplicate conversion reporting that previously occurred across AdServices API and AdAttributionKit systems. However, privacy advocates argue these technical changes fail to address the fundamental competition concerns identified by European regulators.

The Italian authority found that Apple's conduct amounts to an exploitative abuse that started in April 2021 and continues. The decision establishes that the terms of the ATT policy are imposed unilaterally, harm the interests of Apple's commercial partners, and are disproportionate to achieving the company's stated data protection objectives. These three elements constitute the exploitation prohibited under Article 102 TFEU.

Marketing professionals face ongoing uncertainty about iOS advertising measurement and attribution. The dramatic reduction in IDFA access following ATT implementation fundamentally altered how advertisers can target and measure campaigns on Apple's platform. Developers and advertisers without substantial proprietary data ecosystems struggle to maintain advertising effectiveness under the current framework.

The principle of proportionality stands at the center of the Italian decision. While fully supporting the objective of ensuring users' consent is full, free, and informed, the authority found that Apple could have achieved the same level of privacy protection through means less restrictive of competition. This would have prevented unilateral imposition of additional burdens on third-party developers, avoiding the double consent requests for advertising purposes that create competitive disadvantages.

The decision has implications for how dominant platforms implement privacy measures. Companies cannot use privacy as justification for rules that disproportionately burden competitors while benefiting their own services. Regulators increasingly scrutinize whether technical implementations serve legitimate privacy objectives or function as competitive barriers protecting platform owners' commercial interests.

European authorities continue developing consistent approaches to balancing privacy protection with fair competition requirements. Consent management platform implementations face scrutiny across multiple jurisdictions as regulators examine whether user interface design choices genuinely serve user interests or manipulate consent decisions to benefit platform owners.

The advertising technology ecosystem adapts to evolving regulatory requirements. Google AdMob introduced consent syncing for European regulations messages on November 10, 2025, synchronizing user consent decisions across multiple apps to reduce redundant consent prompts. These developments demonstrate ongoing tension between privacy protection, user experience, and competitive fairness in digital advertising markets.

Apple's response to the Italian decision remains to be seen. The company can appeal the ruling through Italian courts and ultimately to European Union judicial authorities. Previous competition enforcement actions have taken years to resolve through appeals processes, creating extended periods of regulatory uncertainty for developers and advertisers operating on iOS platforms.

The stakes extend beyond financial penalties. European regulators possess authority to mandate behavioral remedies requiring companies to modify business practices found to violate competition law. If Apple's appeals prove unsuccessful, regulators could order specific changes to how ATT operates, potentially requiring the company to allow developers to obtain consent through a single prompt meeting both Apple's technical requirements and privacy legislation standards.

Industry stakeholders welcome increased regulatory attention to platform privacy implementations. Mobile Marketing Association members have argued since ATT's announcement that Apple weaponized privacy concerns to gain competitive advantage. The regulatory findings confirm what many in the advertising industry have asserted—that Apple created double standards imposing strict consent requirements on third parties while using preferential approaches for its own tracking.

The Italian decision contributes to a broader pattern of European enforcement addressing how dominant platforms leverage technical control over ecosystems to advantage their own services. Recent months have seen significant GDPR enforcement actions targeting major platforms' data practices, with Spanish courts ordering Meta to pay €479 million in damages for unfair competition resulting from GDPR violations in behavioral advertising.

Competition authorities increasingly coordinate with data protection regulators to address cases where privacy implementations create competitive distortions. This collaborative approach recognizes that privacy and competition law pursue complementary objectives—protecting consumers from both privacy violations and market abuses by dominant undertakings. The Italian decision exemplifies this coordination, with the competition authority explicitly relying on the Data Protection Authority's opinion regarding technical feasibility of less restrictive alternatives.

Digital advertising continues consolidating around platforms with access to extensive proprietary data. ATT restrictions disproportionately affect smaller publishers and developers lacking the data resources necessary to implement alternative targeting mechanisms. This creates market concentration favoring established platforms—precisely the outcome competition law seeks to prevent when dominant companies implement rules affecting competitors' market access.

The €98.6 million fine represents one of Italy's largest competition penalties in the technology sector. However, the financial impact on Apple remains minimal given the company's revenues. The more significant consequences involve potential requirements to modify ATT implementation and reputational effects from regulatory findings that Apple's privacy measures serve anticompetitive purposes.

Developers and advertisers must navigate ongoing regulatory uncertainty while adapting to platform restrictions on data access. Investment in first-party data collection, consent management infrastructure, and privacy-preserving measurement technologies increases as the industry adjusts to permanent changes in how personal data can be used for advertising purposes. These adaptations require significant resources that smaller market participants struggle to deploy at scale.

The Italian decision establishes important precedents for how competition authorities evaluate privacy implementations by dominant platforms. The findings make clear that genuine privacy objectives do not exempt platforms from competition law scrutiny. Companies must demonstrate that their chosen technical approaches represent proportionate means of achieving stated objectives rather than pretextual justifications for anticompetitive conduct.

European enforcement approaches contrast with regulatory frameworks in other jurisdictions. United States authorities have not pursued similar competition cases against Apple's ATT implementation, though Federal Trade Commission and Department of Justice scrutiny of technology platforms intensifies across various business practices. These divergent regulatory approaches create compliance challenges for companies operating globally while European authorities develop more aggressive enforcement postures.

The marketing community watches closely as regulatory proceedings unfold. iOS represents a substantial portion of mobile advertising inventory in developed markets, making Apple's platform rules highly consequential for advertising effectiveness and campaign economics. Any modifications to ATT resulting from regulatory enforcement could significantly impact measurement capabilities and targeting effectiveness across the iOS advertising ecosystem.

Timeline

• April 26, 2021: Apple releases App Tracking Transparency in iOS 14.5 update
• October 23, 2020: French advertising associations file complaint against Apple's planned ATT framework
• July 14, 2021: Facebook begins asking for consent under Apple's ATT requirements
• May 2, 2023: Italian Competition Authority opens ATT investigation
• June 16, 2024: Apple introduces AdAttributionKit framework
• February 13, 2025: German regulator announces ATT may violate competition law
• March 31, 2025: French Competition Authority imposes €150 million fine on Apple
• April 10, 2025: Apple announces Search Ads will register with AdAttributionKit
• April 18, 2025: Analysis of ATT fine highlights privilege disparities in digital advertising
• August 4, 2025: Italian Data Protection Authority issues opinion on ATT framework
• October 8, 2024: Italian Competition Authority extends investigation scope
• December 22, 2025: Italian Competition Authority announces €98.6 million fine

Summary

Who: The Italian Competition Authority (Autorità Garante della Concorrenza e del Mercato) issued the decision against Apple Inc., Apple Distribution International Ltd, and Apple Italia S.r.l. The investigation involved coordination with the European Commission, other national competition authorities, and the Italian Data Protection Authority. The decision affects third-party app developers who distribute applications through the iOS App Store, advertisers who purchase advertising space in iOS applications, and advertising intermediation platforms that facilitate transactions between developers and advertisers.

What: The authority imposed a €98,635,416.67 fine for abuse of dominant position in violation of Article 102 TFEU. The violation concerns Apple's App Tracking Transparency policy, which requires third-party developers to obtain user consent through Apple's mandatory ATT prompt before accessing user data for advertising purposes. Because Apple's ATT prompt does not meet privacy legislation requirements, developers must deploy additional consent management platform prompts, creating a double consent requirement for the same purpose. The authority found this double consent mechanism is imposed unilaterally, harms commercial partners' interests, and is disproportionate to achieving legitimate privacy objectives. The investigation documented reduced consent rates for third-party developers, revenue losses for developers and advertising platforms, increased costs for advertisers, and financial benefits for Apple's own advertising services.

When: The investigation opened on May 2, 2023, with scope extended on October 8, 2024. The abusive conduct began in April 2021 when Apple implemented the ATT framework with iOS 14.5 and continues to the present. The Italian Data Protection Authority issued its opinion on August 4, 2025. The final decision was announced on December 22, 2025. The conduct is characterized as ongoing because Apple has not modified the ATT implementation to address the identified competition concerns.

Where: The decision applies to Apple's operations in Italy but addresses conduct affecting the entire iOS ecosystem within the European Union. The market examined is the supply to developers of platforms for online distribution of apps to iOS users, where the App Store functions as the exclusive distribution channel. The investigation involved coordination among Italian authorities, the European Commission, and other national competition authorities, reflecting the cross-border nature of digital platform markets. The precedent contributes to developing European enforcement approaches alongside similar proceedings in France and Germany examining Apple's ATT implementation.

Why: The authority determined that Apple's implementation of ATT serves anticompetitive purposes despite stated privacy objectives. The double consent requirement disproportionately burdens third-party developers while Apple's own advertising services operate under less restrictive rules. Smaller operators without extensive proprietary data face particular disadvantages because they rely more heavily on the IDFA and cross-app tracking that ATT restricts. The authority found Apple could have achieved the same privacy protection through less restrictive means, specifically by allowing developers to obtain valid consent through a single prompt meeting both technical and legal requirements. The decision reflects broader regulatory concerns that dominant platforms cannot leverage privacy as justification for rules that unfairly advantage their own services while restricting competitors' market access.