Apple gave itself better dialogs for the permission prompts, which they will now equalize (perhaps just in the EU?) with the prompts they use for their own apps.
My understanding of ATTF is that first-party tracking needed no disclosure other than the information declared in the app's App Store privacy section about the information gathered. If you made a suite of 20 apps, you could track usage across all of them without issue, as long as you didn't also share that info with a third party.
The German regulator settled because the facts are simply on Apple's side. Apple settled because at the end of the day it's no skin off their back if the EU now wants to weaken privacy protections to benefit ad-tech.
Considering that ATT was about sharing an identifier to “track across other companies' apps and websites” (text definition of the ATT setting), I don’t believe this ruling is a good move for anyone on informed consent or privacy. In the name of improving competition, sometimes regulators may end up making things worse for users.
Apple doesn't do cross-company tracking, and ATT blocks third-parties from doing cross-company tracking. The rules are the same. The German anti-cartel authorities' issue is:
> In contrast, Apple’s own personalised advertising is subject to different conditions. Apple itself does not use the IDFA and cross-company data combination, but draws on user data from its own ecosystem – a wealth of data that is not available, in particular, to the large number of smaller app publishers.
Apple's own apps are still blessed with permissions that other apps have to ask for. This needs to be addressed too.
https://news.ycombinator.com/item?id=43047952
Watchdog ponders why Apple doesn't apply its strict app tracking rules to itself (theregister.com)
161 points by Logans_Run on Feb 14, 2025 | 69 comments
> Under the commitments that have now been declared binding, Apple will align the consent prompts for its own offerings and for third-party apps much more closely.
It’s a bummer (albeit an expected one) to see Apple reducing the burden for third-party publishers to collect personal data, rather than increasing the burden for themselves to collect it, thus overall raising the floor of user privacy. This is to say, when a regulator requests “everyone be treated equally to ensure competition” maybe they should also take into account how users are impacted and instead request something more nuanced like: if there are unequal standards, they must be equalized in a way that maximizes user benefit.
I don’t think it’s a bad thing necessarily.
They are doing nothing to stop the endless ads, and the pop-ups in the browser I want to kill turn them off not them grant equal access to have even more ads.
Another problem is the onward, march towards renting leasing, owning nothing endless upgrades for price, in the end I don’t expect a bunch of lawyers and bureaucrats to do anything about that. They have been paid off long time ago.
Recently in the last couple of years in particular it’s gotten to be completely out of control. I’m glad I bought a super drive before Apple discontinued it soon the way things are going you won’t even be able to have a large drive or even big memory you’ll be tied to that remote data center…
1. The competition law people are not the data protection people. From the perspective of competition law, they only care that the playing field is leveled, they don't care if you equalize down or up.
2. The EU has fumbled the ball on GDPR by not enforcing it on the tech giants that it was intended to regulate[0], to the point where a tech company enforcing the intent of the law and not the letter of the law feels like singling out competitors.
[0] In particular, the Republic of Ireland is a rotten borough for Facebook, who has all their EU offices there.
I also delight in this highlighting Apple's hypocrisy
I don't even care if they make the dialogue look a little different since they're system apps you need to use the features of your phone, but the "extras" they support should default to "Ask First" in an ideal world that is.
There are whole classes of applications that are not possible unless low level device data is exposed via APIs.
And since Apple doesn't provide the apps, the apps won't exist until Apple creates them.
You want to handle device rotation smoothly in your in-app browser?
Tough luck, WebKit's _beginAnimatedResizeWithUpdates is private, and only Apple gets to use it in Safari.
Good luck with the animation and scroll position handling. You better hope WkWebView's default behavior works for you, because you don't get to customize it and fix edge cases or the tab previews, like Apple did for their browser.
Sometimes transparency and honesty get weaponized. Especially by actors with centralized power.
(Not arguing against transparency, but against misinterpreting it as always being used in good faith.)
Maybe you'd like to use a competitor to the Photos app and don't want to use the one Apple provides?
https://medium.com/@krvoller/how-iphone-violates-apples-acce...
Ah, it was OpenHaystack: https://github.com/seemoo-lab/openhaystack#installation
> ... Apple's own apps are still blessed with permissions that other apps have to ask for. This needs to be addressed too.
But what does the "Access to photos" permission really do here? It's not like not having that permission would stop Apple from accessing them against your will, as they have access via the OS anyway. And it's clear, that when you open the Apple Photos app, that it will access your photos.
On the other hand, when you open a third party app, it may not have been clear to you that it wants to access your photos, and the company did not have prior access to them.
I still think apps should only be pre-blessed sparingly. For example, the camera app should not have GPS permission by default, as many people probably aren't aware that camera apps use that information.
Mail plugins are kind of a special case, they're REALLY "legacy", so they work by sharing process memory and being able to access way more than they should, like all your messages, possibly even passwords if the developer is clever enough.
Also notoriously difficult to build, since the Mail internal API breaks from time to time, so they're a rarity these days.
Also notoriously difficult to install.
In the case of operating systems, I simply select a different operating system, and the same principle applies to AI models. It is amusing that Microsoft and Linux are available to consumers, providing them with a choice. However, simply because the decisions made by one or the other are superior/better does not imply that everyone should be reduced to a similar low level.
Apple is not even close to being the dominant operating system or hardware platform, globally, yet you still expect them to be mediocre, akin to most of their competition.
"Access to Photos" is a complicated one: Lots of apps only needs this permission when building a custom photo selector. Like Facebook/WhatsApp/Instagram do, also Slack.
For every other app, they can use the system's default photo picker and it works without permission.
For example, the "Lunch Receipt Scanner" that my company uses: I'm happy to allow it on my phone, as it saves a lot of time, but I wouldn't want a company app having access to my entire camera roll!!!
I personally also don't like that WhatsApp/Instagram/Facebook/Slack asks for access to the whole album just to display the photo picker, but I'm pretty sure some designer or product manager made a strong case for it internally.
Main reason I don't use the in-app photo pickers for these but "share" the photo I want to upload from Photos into the app. Zero trust for these companies.
Apple will change its rules on how app providers can use user data on iPhones and iPads for personalised advertising. The Bundeskartellamt objected to the way in which Apple had designed different consent requests for Apple’s own offerings and third-party apps. Apple considers its rules (set out in its so-called “Apple Tracking Transparency Framework”, ATTF) to be compliant with competition law; nevertheless, the company offered commitments which the Bundeskartellamt has now declared binding. The proceeding has thus been concluded.
Apple’s ATTF introduced rules for third-party app providers on the use of data on iPhones and iPads. For specific forms of cross-company data use, third-party app providers must obtain not only user consent under data protection law, but also additional consent through a prompt that is predefined by Apple. However, these ATTF rules do not apply to Apple’s own offerings; Apple uses user data from its own ecosystem and therefore its own prompt to request user consent to personalised advertising.
Andreas Mundt, President of the Bundeskartellamt: “It is key that personal data and privacy are protected effectively when using apps. Apple is allowed to provide for a level of protection for its users that exceeds the minimum legal requirements. However, if Apple sets up additional rules within its ecosystem for the use of data, these rules must, under Germany’s special abuse provision for large digital companies, not treat its own offerings better than those of its competitors. This is precisely where our competition concerns arose. Apple will now align the consent requests much more closely and give third-party app providers more freedom to combine the necessary requests in a sensible way.”
Many third-party apps are, at least partly, funded through advertising. Personalised advertising can generate higher revenues for app publishers. Other apps are funded through user payments, for example for the purchase of the app or subscriptions. In these cases Apple often receives a commission, whereas Apple generally does not receive a share of the app publishers’ advertising revenue. As a general rule, personal data may in any event only be used for advertising purposes if users give their consent in accordance with the requirements of German and European data protection law.
Apple argued in the proceeding that the ATTF is meant to protect user privacy and that it is a competition law-compliant measure that also helps Apple position itself as providing a particularly high level of data protection. By contrast, the associations admitted to the proceeding, representing the branded-goods, media and advertising industries, took the view that, being a powerful gatekeeper, Apple was not allowed to set up additional, “extra-statutory” rules in the first place if these rules restrict other companies in their business activities.
In the Bundeskartellamt’s preliminary assessment, competition law generally also allows powerful companies such as Apple to take measures to protect their users’ privacy. However, the differences between the consent request used for Apple’s own offerings and the consent request predefined by Apple for third-party apps exceeded what could be justified based on differences in types of data processing. The wording, design and selection options of the request used for Apple’s own offerings had the potential to encourage users to give their consent, whereas they had the potential to discourage consent for third-party apps. In addition, third-party apps in some cases had to request consent several times even when users had already given data protection law-compliant consent.
With its operating systems and its App Store, Apple controls a key infrastructure for the distribution of apps on its devices. In addition, Apple offers its own apps and advertising space. This dual role makes Apple subject to specific competition law requirements. In the Bundeskartellamt’s preliminary assessment, there was a risk that, by setting out different rules, Apple was favouring its own offerings and impeding third-party app publishers.
Apple will modify consent prompt and simplify consent requests
Under the commitments that have now been declared binding, Apple will align the consent prompts for its own offerings and for third-party apps much more closely. This involves removing possibly discouraging symbols and wording in Apple’s predefined requests for third-party providers. The design of the consent prompts will be neutral in terms of content, wording and layout. In addition, app publishers and content providers, such as media publishers, will be given more scope to explain to users what significance personalised advertising has for their offering and their business model.
Under the commitments, Apple will also reduce the complexity of the current consent request architecture for third-party providers. In particular, app publishers will be given more freedom to combine the consent request required by Apple with the consent requests required under data protection law or connect them in a way that is clear to users. The improved conditions may also benefit advertisers and technical service providers to the advertising industry.
Andreas Mundt: “It is expressly not our aim to help achieve the highest possible levels of consent to personalised advertising. We want to ensure that users can make a free and informed decision. Users who do not wish to allow their data to be used for personalised advertising must be able to make an equally free and informed decision as users who intend to consent to such data use. The new consent requests are aimed at better enabling users to make this decision.”
The Bundeskartellamt’s proceeding only examined whether Apple was in violation of German or European competition law. It did not aim at enforcing data protection law. To avoid possible delineation issues with data protection law, the Bundeskartellamt exchanged views with the Federal Commissioner for Data Protection and Freedom of Information (BfDI) and the Bavarian State Office for Data Protection Supervision (BayLDA).
Cooperation with other European competition authorities
Competition authorities of other EU Member States have also conducted proceedings concerning ATTF, some of which have already been concluded. To ensure that European competition law is applied consistently, the Bundeskartellamt maintained close and constructive dialogue with the relevant European authorities and the European Commission within the European Competition Network (ECN) throughout the proceeding.
In two proceedings by other European competition authorities concerning ATTF, the authorities have already imposed substantial fines on Apple. Last year, the French and the Italian competition authorities imposed fines on Apple totalling 150 million and 98.6 million euros, respectively. The Bundeskartellamt’s proceeding aims at achieving that the future design of the ATTF complies with competition law. The solution now achieved in Germany forms part of this European dialogue and may also affect the future design of the ATTF in other EU Member States.
Special abuse control of large digital companies
The Bundeskartellamt’s proceeding was based on, in particular, Section 19a of the German Competition Act (GWB) and the prohibition of abuse of a dominant position under Article 102 TFEU. Section 19a GWB gives the Bundeskartellamt special powers of abuse control of large digital companies that are found to be of paramount significance for competition across markets. In a first step, the Bundeskartellamt issues a decision declaring that a company has this special competitive position. In a second step, the authority may prohibit the company from engaging in certain anti-competitive conduct.
The Bundeskartellamt issued a decision finding that Apple is of paramount significance for competition across markets in April 2023. The Federal Court of Justice confirmed this decision in March 2025.
Course of the proceeding
The Bundeskartellamt initiated the proceeding against Apple in June 2022. In February 2025 the authority informed Apple and the associations admitted to the proceeding of its preliminary legal assessment (see press release of 13 February 2025). Later in the proceeding, Apple offered commitments, which the Bundeskartellamt assessed in a market test in December 2025 (see press release of 2 December 2025). After further amendments to the commitments, the Bundeskartellamt has now declared them binding and concluded the proceeding.
Apple has four months from service of the decision to implement the changes proposed in the commitments and, before implementation, will test them together with app publishers. The commitments apply for seven years and will be monitored by an independent monitoring trustee.
Further details on the proceeding, the changes to the ATTF and their effects can be found in the accompanying FAQ document.