Apple’s App Tracking Transparency framework was billed as a privacy feature. Germany’s competition regulator says it was also a competitive advantage — one that favoured Apple’s own apps over everyone else’s.
On Sunday, the Bundeskartellamt — Germany’s federal competition authority — announced it has concluded proceedings against Apple after the company offered binding commitments to change how its tracking consent prompts work. The regulator found that Apple’s own apps used a different, friendlier consent design than the one third-party apps were forced to use.
What the Regulator Found
The Bundeskartellamt’s announcement is precise about the problem. Apple’s App Tracking Transparency Framework (ATTF) requires third-party app providers to obtain additional consent — beyond existing data protection law — before using user data for personalised advertising. Apple provides a predefined consent prompt for this purpose.
But Apple’s own apps do not use that prompt. They use Apple’s own consent request, which the regulator found had “the potential to encourage users to give their consent.” The third-party prompt, by contrast, had “possibly discouraging symbols and wording” that could push users the other way.
Andreas Mundt, president of the Bundeskartellamt, put it directly: “If Apple sets up additional rules within its ecosystem for the use of data, these rules must not treat its own offerings better than those of its competitors. This is precisely where our competition concerns arose.”
The regulator was careful to note that Apple is allowed to set privacy standards above the legal minimum. The issue was not the privacy protection itself — it was the asymmetry between how Apple treats itself and how it treats rivals.
What Apple Agreed to Change
Under the binding commitments, Apple will:
- Align the consent prompts for its own offerings and third-party apps more closely, removing “possibly discouraging symbols and wording” from the third-party version
- Make the design of consent prompts “neutral in terms of content, wording and layout”
- Give app publishers and content providers more scope to explain what personalised advertising means for their business model
- Reduce the complexity of consent requests, allowing publishers to combine Apple’s ATTF consent with data protection law consent in a single, clear flow
Apple maintains its framework is competition-law compliant. The company offered the commitments anyway, and the Bundeskartellamt declared them binding — closing the proceeding without a formal finding of abuse.
The Dual-Role Problem
The Bundeskartellamt’s reasoning turns on Apple’s dual role. Apple controls the operating system and the App Store — the key infrastructure for app distribution on its devices. It also offers its own apps and advertising space. That combination triggers specific obligations under Germany’s abuse provision for large digital companies.
The regulator’s preliminary assessment found that the differences between Apple’s own consent prompt and the third-party prompt “exceeded what could be justified based on differences in types of data processing.” In plain terms: Apple could not explain why its own apps needed a friendlier prompt than everyone else’s.
The proceeding also touched on a commercial tension. Apple generally does not take a share of app publishers’ advertising revenue, but it does take a commission on app purchases and subscriptions. If third-party apps earn less from advertising because users decline tracking at higher rates — while Apple’s own apps face a friendlier prompt — the structure could shift revenue toward Apple’s monetisation model.
How This Fits the Broader Pattern
This is not the first time Apple’s privacy framing has faced regulatory scrutiny. The EU’s Digital Markets Act and Germany’s specific abuse provision for large digital companies both target gatekeeper behaviour where a platform’s own products get better treatment than third parties on the same platform.
The ATTF case is notable because Apple has consistently framed its privacy features as user protection, not competitive strategy. The Bundeskartellamt’s response is nuanced: it accepts that Apple can set high privacy standards, but draws the line at applying those standards unevenly. The framework is fine. The asymmetry is not.
Apple’s Siri AI launch and broader AI strategy depend on the same ecosystem where these rules apply. If Apple’s AI features get preferential treatment in how user data is collected and used — the same structural question the Bundeskartellamt just answered for advertising — the precedent from this case could extend further.
NZ Angle
New Zealand does not have an equivalent to Germany’s abuse provision for large digital companies. The Commerce Commission enforces competition law, but the threshold for action against a global platform like Apple is high, and the legal tools are designed for domestic market abuse, not ecosystem-level gatekeeper behaviour.
That means NZ app developers who rely on the App Store are effectively subject to rules set by foreign regulators — the EU, Germany, and increasingly the UK’s Competition and Markets Authority. When Germany forces Apple to level the playing field, NZ developers benefit. When no regulator acts, they operate on Apple’s terms.
❓ FAQ
Did Germany find Apple broke the law? The Bundeskartellamt raised competition concerns in its preliminary assessment. Apple offered commitments to address them, and the regulator declared those commitments binding. The proceeding was concluded without a formal finding of abuse.
What is App Tracking Transparency? Apple’s framework, introduced in 2021, requires apps to ask users for permission before tracking their activity across other companies’ apps and websites. It was marketed as a privacy feature.
Why was Apple’s own prompt different? Apple argued the differences reflected different types of data processing. The regulator found the differences exceeded what that justification could support — the wording, design, and options encouraged consent for Apple’s apps while discouraging it for third parties.
Does this affect users outside Germany? Apple’s commitments are binding in Germany, but consent prompt changes typically roll out globally because maintaining separate designs per country is operationally complex. The EU’s Digital Markets Act covers similar ground at the bloc level.
