Apple has been hit with a €150 million fine by France’s competition regulator, the Autorité de la concurrence, for its App Tracking Transparency (ATT) system implementation.
While a smaller fine than expected, the regulator’s decision follows an in-depth investigation into the merits of the case, even after the authority had previously rejected a request for interim measures.
While the French regulator acknowledged that the objective of the ATT system – enhancing user privacy – is not inherently problematic, it found that the methods of its implementation were “neither necessary nor proportionate” to achieve that goal.
The Autorité de la concurrence highlighted that the introduction of ATT has led to a “multiplication of consent collection windows,” excessively complicating the user experience within the iOS environment for third-party applications. Furthermore, the regulator emphasised that the rules governing the interaction between these various consent prompts “undermine the neutrality of the device, causing definite economic harm to application publishers and advertising service providers.”
In a statement, the regulator noted that the ATT system – as implemented by Apple – particularly disadvantaged smaller publishers. Unlike major vertically integrated platforms, these smaller players heavily rely on the collection of third-party data to fund their operations.
App Tracking Transparency
Apple introduced its App Tracking Transparency (ATT) system on 26 April 2021, with the launch of iOS and iPadOS version 14.5. The system requires apps to explicitly request users’ permission to track their activity across other companies’ apps and websites.
This consent is sought through a partially standardised pop-up window displayed before a newly downloaded app can be used. If consent is granted, the app can access the Identifier for Advertisers (IDFA)—a device identifier that allows user tracking for targeted advertising.
The investigation by the Autorité de la concurrence was initiated following concerns raised by several associations representing various online advertising stakeholders, including media organisations, internet networks, advertising agencies, technical intermediaries, publishers, and mobile marketing agencies.
In anticipation of the implementation of ATT, which they perceived as a significant obstacle to targeted advertising for Apple device users – a crucial revenue stream for many app publishers and online advertising businesses – these groups contacted the regulator on 23 October 2020.
Despite these concerns, the regulator initially decided against issuing interim measures on 17 March 2021.
ATT implementation deemed unnecessary and disproportionate
While the Autorité de la concurrence recognises Apple’s prerogative to enact consumer protection rules beyond existing regulations, it stressed that this is conditional, especially given Apple’s dominant position in the iOS mobile app distribution market.
The regulator asserted that Apple has a “particular responsibility” to reconcile its legitimate objective of privacy protection with the principles of competition law.
Autorité de la concurrence elaborated on this point, stating that a dominant platform operator like Apple can significantly influence the economic models of businesses operating on its platform, limit their freedom to operate, and impact the quality and diversity of offerings available to internet users.
Consequently, when a dominant player implements access rules that are disproportionate or lack objective justification, the regulator concludes that it can negatively affect the functioning of related markets and ultimately harm consumer interests.
Although the principle of the ATT solicitation itself was not criticised due to its potential privacy benefits for users, the regulator concluded that the “practical implementation methods of this system are abusive within the meaning of competition law.”
Specifically, these methods were found to “artificially complicate the journey for users of third-party applications and distort the neutrality of the system to the detriment of small publishers financed by advertising.”
Artificially complex system penalising third-party app publishers
The Autorité de la concurrence determined that the ATT system imposed by Apple is “not necessary” because it does not facilitate the collection of valid consent under applicable law, particularly the Data Protection Act.
The regulator explained that publishers who wish to comply with their legal obligations cannot solely rely on the ATT prompt and are forced to continue using their own consent collection solutions, known as Consent Management Platforms (CMPs).
This results in a “multiplication of consent collection windows,” which “excessively complicate[s] the journey of users of third-party applications within the iOS environment.”
This observation was also noted by the National Commission for Information Technology and Civil Liberties (CNIL) in a 2022 opinion issued at the authority’s request.
Furthermore, the Autorité de la concurrence found that the “rules governing the interaction between the different windows thus displayed undermine the neutrality of the system.”
The regulator pointed out a key asymmetry: while a refusal of advertising tracking only needs to be made once, acceptance of such tracking always requires a second confirmation from the user. This imbalance, according to the authority, “prevents the collection of informed consent that the ATT is supposed to promote” and has caused “definite harm to application publishers and advertising service providers.”
The regulator also noted that minor modifications to the system, as recommended by the CNIL, could have avoided these issues.
Asymmetry of treatment between Apple and publishers
The authority also highlighted a significant “asymmetry in the processing between that which Apple reserved for itself and that which it applied to publishers.”
Initially, while third-party publishers had to obtain double consent from users for tracking on their sites and apps, Apple did not request consent for its own applications (until the implementation of iOS 15).
This discrepancy previously led the CNIL to impose a penalty on Apple for violating Article 82 of the Data Protection Act, which transposes the ePrivacy Directive.
The Autorité de la concurrence noted that this asymmetry persists, with Apple now using a single ‘Personalised Advertising’ window to collect user consent for its own data collection, while still requiring a double opt-in for third-party data collection by publishers.
While the implementation of App Tracking Transparency has affected all application publishers, the French regulator concluded that the system is “particularly harmful for the smallest among them.” These smaller publishers, often lacking sufficient proprietary data, do not benefit from alternative targeting possibilities.
The regulator cited the example of Ad4Screen, which stated that the business loss for smaller players contrasts sharply with larger “players with their own data ‘ecosystem’ [who] will therefore be able to take advantage of the situation and strengthen their offering without using IDFA or cookies.”
Ad4Screen specifically mentioned Meta and Google as examples of companies that can track a user’s journey even after they have seen an advertisement.
In light of the findings and the duration of the infringement, the Autorité de la concurrence decided to impose a fine of €150,000,000 on Apple Distribution International Limited (ADI) and Apple Inc. as the perpetrators, and on Apple Operations International Limited and Apple Inc. as the parent companies.
In addition to the financial penalty, the regulator has mandated that Apple publish a summary of the decision on its website for a period of seven consecutive days.
See also: Google bolsters Android security for app developers and users
Looking to revamp your digital transformation strategy? Learn more about Digital Transformation Week taking place in Amsterdam, California, and London. The comprehensive event is co-located with IoT Tech Expo, AI & Big Data Expo, Cyber Security & Cloud Expo, and other leading events.
Explore other upcoming enterprise technology events and webinars powered by TechForge here.
