Apple maintains that its rules comply with competition law. Nevertheless, it offered commitments that the Bundeskartellamt has made legally binding, closing the German proceeding.

What Germany objected to

Since Apple introduced the framework in 2021, third-party apps seeking to use data for certain forms of cross-company tracking have had to obtain ordinary data-protection consent as well as a separate Apple-prescribed permission through ATT. The strict additional requirements did not apply to Apple in the same way.

The regulator’s concern was not simply that Apple asked users for consent. It was the asymmetry between the consent journeys:

• Third-party apps could face two separate requests before using data for covered advertising-related tracking.
• Apple’s own services operated under a different consent process within Apple’s ecosystem.
• Germany’s preliminary assessment was that the third-party ATT prompt could steer users toward refusing consent, while Apple’s own personalized-ads prompt was more conducive to agreement.

In other words, the competition issue was the design and unequal application of the privacy framework—not the basic principle of asking users whether they want to permit tracking.

What Apple agreed to change

Apple’s binding commitments require changes to both the design of the prompts and the way developers can present them.

Third-party prompts must be more neutral

Apple will redesign the ATT pop-up shown by third-party apps so that its wording, presentation and visual elements do not discourage users from consenting. The commitments are intended to bring the third-party request and Apple’s own consent request much closer together.

Developers can better coordinate consent requests

Developers will receive greater flexibility to combine Apple’s tracking request with other data-protection consent requests. This is meant to reduce the unnecessarily separate “double hurdle” that can make the third-party consent flow more difficult than Apple’s own process.

The deadline and oversight are binding

Apple has four months to implement the changes after the decision is formally served. An independent trustee will monitor compliance for seven years.

The changes will reach beyond Germany

Although the investigation was conducted by Germany’s competition authority, the commitments will apply across almost all of the European Union rather than only to German users.

That makes the settlement more significant for app developers and mobile advertising businesses across Europe. A change to the consent flow can affect whether developers receive permission to use data for targeted advertising and how easily they can combine privacy disclosures with Apple’s system-level request.

What remains unchanged for users and developers

The settlement does not remove the underlying consent requirement. Third-party developers will still need users’ permission before carrying out the covered forms of cross-company tracking.

The change is instead about competitive neutrality: Apple must make the consent process for its own services and rival apps more comparable, while avoiding design choices that steer users toward one answer. The commitments therefore modify the mechanics and presentation of consent rather than abolishing privacy protections.

How France and Italy add to the pressure on Apple

Germany’s settlement is part of a wider European dispute over whether a platform can impose stricter data-consent requirements on rivals than it applies to its own services.

France’s competition authority fined Apple €150 million in March 2025 over the implementation of ATT, finding that the way the feature was applied could harm competition in mobile-app advertising. The French authority said the objective of ATT itself was not the central problem; it was the way the system was implemented.

Italy’s competition regulator later imposed a €98.6 million fine, concluding that Apple’s ATT policy hindered competition in the App Store and exploited Apple’s dominant position.

Together with the German commitments, those actions show the regulatory distinction emerging around ATT: privacy safeguards may be legitimate, but a dominant platform may face scrutiny if its privacy rules create heavier consent burdens for competing developers than for its own services. Apple’s German commitments address that concern through neutral prompts, a less fragmented consent flow and long-term compliance monitoring.

Apple maintains that its rules comply with competition law. Nevertheless, it offered commitments that the Bundeskartellamt has made legally binding, closing the German proceeding.

What Germany objected to

Since Apple introduced the framework in 2021, third-party apps seeking to use data for certain forms of cross-company tracking have had to obtain ordinary data-protection consent as well as a separate Apple-prescribed permission through ATT. The strict additional requirements did not apply to Apple in the same way.

The regulator’s concern was not simply that Apple asked users for consent. It was the asymmetry between the consent journeys:

• Third-party apps could face two separate requests before using data for covered advertising-related tracking.
• Apple’s own services operated under a different consent process within Apple’s ecosystem.
• Germany’s preliminary assessment was that the third-party ATT prompt could steer users toward refusing consent, while Apple’s own personalized-ads prompt was more conducive to agreement.

In other words, the competition issue was the design and unequal application of the privacy framework—not the basic principle of asking users whether they want to permit tracking.

What Apple agreed to change

Apple’s binding commitments require changes to both the design of the prompts and the way developers can present them.

Third-party prompts must be more neutral

Apple will redesign the ATT pop-up shown by third-party apps so that its wording, presentation and visual elements do not discourage users from consenting. The commitments are intended to bring the third-party request and Apple’s own consent request much closer together.

Developers can better coordinate consent requests

Developers will receive greater flexibility to combine Apple’s tracking request with other data-protection consent requests. This is meant to reduce the unnecessarily separate “double hurdle” that can make the third-party consent flow more difficult than Apple’s own process.

The deadline and oversight are binding

Apple has four months to implement the changes after the decision is formally served. An independent trustee will monitor compliance for seven years.

The changes will reach beyond Germany

Although the investigation was conducted by Germany’s competition authority, the commitments will apply across almost all of the European Union rather than only to German users.

That makes the settlement more significant for app developers and mobile advertising businesses across Europe. A change to the consent flow can affect whether developers receive permission to use data for targeted advertising and how easily they can combine privacy disclosures with Apple’s system-level request.

What remains unchanged for users and developers

The settlement does not remove the underlying consent requirement. Third-party developers will still need users’ permission before carrying out the covered forms of cross-company tracking.

The change is instead about competitive neutrality: Apple must make the consent process for its own services and rival apps more comparable, while avoiding design choices that steer users toward one answer. The commitments therefore modify the mechanics and presentation of consent rather than abolishing privacy protections.

How France and Italy add to the pressure on Apple

Germany’s settlement is part of a wider European dispute over whether a platform can impose stricter data-consent requirements on rivals than it applies to its own services.

France’s competition authority fined Apple €150 million in March 2025 over the implementation of ATT, finding that the way the feature was applied could harm competition in mobile-app advertising. The French authority said the objective of ATT itself was not the central problem; it was the way the system was implemented.

Italy’s competition regulator later imposed a €98.6 million fine, concluding that Apple’s ATT policy hindered competition in the App Store and exploited Apple’s dominant position.

Together with the German commitments, those actions show the regulatory distinction emerging around ATT: privacy safeguards may be legitimate, but a dominant platform may face scrutiny if its privacy rules create heavier consent burdens for competing developers than for its own services. Apple’s German commitments address that concern through neutral prompts, a less fragmented consent flow and long-term compliance monitoring.