Germany makes Apple align ad-consent rules for third-party apps

Germany's federal competition authority, the Bundeskartellamt, has closed a probe into Apple's iPhone privacy feature by accepting binding commitments that give third-party app developers the same flexibility to combine consent prompts that Apple's own advertising services already have.

The case, concluded on 17 August 2026, ran not on data-protection grounds but under Section 19a of the German Competition Act (GWB), the country's special abuse provision for large digital companies. President Andreas Mundt said the regulator's concern was that Apple's additional rules, beyond what data-protection law requires, "must not treat Apple's own offerings better than those of its competitors." (Bundeskartellamt press release)

The technical trigger was the consent design of the Apple Tracking Transparency framework, which the regulator's filing labels ATTF. ATTF forced every third-party app that wanted to track users across other companies' services to display Apple's pre-defined cross-company consent prompt, while Apple's own services used a separate flow for data that stays inside the Apple ecosystem. In the Bundeskartellamt's reading, this gap put third-party apps on consent rules that were not the rules Apple applied to its own services, the asymmetry that triggered the agency's competition concern. Trade press coverage in AppleInsider and MacObserver framed the issue as consent-prompt asymmetry rather than a wholesale attack on ATTF.

Apple's commitments now require the company to "align the consent requests much more closely" and to give third-party app providers more freedom to combine the data-protection-law consent and the ATTF consent in a single prompt, in what Mundt called "a sensible way." The commitments are binding under German competition law, but the Bundeskartellamt did not issue an infringement decision and imposed no fine. Apple has maintained throughout that ATTF is competition-law compliant, and accepted the commitments without conceding any underlying violation. (MarketScreener / Dow Jones)

The economic backdrop is the regulator's, not Apple's. Many third-party apps are funded by advertising, while Apple takes a commission on in-app purchases and does not share third-party ad revenue. Mundt's framing, that Apple can exceed minimum privacy standards but its "additional rules" cannot discriminate, pulls the design of a privacy feature into the review perimeter of a competition authority.

The German action is the third EU competition hit Apple has taken over how it implements privacy and routing features. France's Autorité de la concurrence fined Apple €150 million (about $162 million at March 2025 exchange rates) in March 2025 over related ATT implementation issues. The European Commission found Apple in breach of the Digital Markets Act's anti-steering obligations in June 2025, in a decision the Commission labelled IP 25/1085. Privacy and routing features on gatekeeper platforms are now reviewable both as data-protection questions and as competition ones, and consent UX sits inside that perimeter.

The open question is scope. The case was opened under German law against Apple's German entity, but ATTF is a global platform rule that ships to every iPhone. If Apple implements the alignment only in the German App Store, the fix is narrow; if it implements it EU-wide to match its DMA obligations, the fix is structural. The Bundeskartellamt's announcement does not say, and the trade-press coverage has not filled that gap. For third-party developers, what changes tomorrow depends on that answer, and on whether Apple opens the same combined-prompt flexibility to its own advertising stack.