France’s competition regulator has imposed a fine of €150 million ($162 million) on Apple for its implementation of the App Tracking Transparency (ATT) framework, citing an abuse of its dominant position as a distributor of mobile applications for iOS and iPadOS devices between April 26, 2021, and July 25, 2023.
The Autorité de la concurrence stated that the ATT framework, introduced with iOS 14.5, iPadOS 14.5, and tvOS 14.5, has a noble objective but is implemented in a way that is neither necessary nor proportionate to its goal of protecting personal data. The framework requires mobile apps to seek users’ explicit consent to access their device’s unique advertising identifier and track them across apps and websites for targeted advertising.
According to Apple, unless permission is granted by the user to enable tracking, the device’s advertising identifier value will be all zeros, and tracking will not be possible. App developers must also state the purpose behind tracking and obtain consent from users, who can grant or deny permission.
The Autorité de la concurrence criticized the ATT framework for being “artificially complex” and failing to meet the legal obligations required under the French Data Protection Act. The regulator argued that the consent obtained via the framework is not sufficient, leading to multiple consent pop-ups being displayed to users.
The regulatory authority also pointed out two kinds of asymmetry in the implementation of the ATT framework. Firstly, consent for tracking must be confirmed by users twice, whereas refusal is a one-step process, which undermines the neutrality of the framework. Secondly, Apple did not require consent from users of its own applications until the implementation of iOS 15, whereas publishers were required to obtain double consent from users for tracking on third-party sites and applications.
The fine imposed on Apple is relatively small compared to the company’s net income of $36.3 billion on revenues of $124.3 billion in the quarter ending December 28, 2024. The order does not require Apple to make any specific changes to the ATT framework, but rather to ensure compliance with the ruling.
In response to the fine, Apple stated that the ATT prompt is consistent for all developers, including itself, and has received “strong support” from consumers, privacy advocates, and data protection authorities globally.
