Germany’s Bundeskartellamt announced on 17 August 2026 that it had declared Apple’s commitments on App Tracking Transparency binding, closing a competition-law proceeding open since 2022 without a fine or a finding of infringement. Apple has four months from service of the commitment decision dated 13 August 2026 to redesign its consent prompts for users with a German App Store billing address and a device located in Germany. The commitments then apply for seven years following their implementation, monitored by an independent trustee.
What Was Wrong With the Old Prompt?
The objection was not about tracking itself, but about how differently Apple designed the consent request for its own advertising versus the one it predefines for third-party apps. Andreas Mundt, the authority’s president: “It is key that personal data and privacy are protected effectively when using apps. Apple is allowed to provide for a level of protection for its users that exceeds the minimum legal requirements. However, if Apple sets up additional rules within its ecosystem for the use of data, these rules must, under Germany’s special abuse provision for large digital companies, not treat its own offerings better than those of its competitors.”
Apple’s own PA prompt had the potential to encourage users toward “yes,” under the authority’s preliminary assessment. The ATT prompt Apple predefines for third-party apps had the potential to discourage consent instead, through a warning hand symbol, the word “tracking” rather than “personalised advertising,” less room to explain the request, and the order in which the selection options appear. Some publishers ended up serving a consent prompt more than once for requests already covered under data protection law.
What did the Bundeskartellamt decide on Apple’s ATT?
The Bundeskartellamt declared Apple’s commitments binding under Section 19a of the German Competition Act and Article 102 TFEU, closing the proceeding without fining Apple or finding it in breach. Apple must strip discouraging symbols and wording from the ATT prompt, align the wording and choice order of the ATT prompt and its own PA prompt more closely, and give third-party publishers up to 4,000 characters to explain their request, instead of the one or two sentences Apple currently prescribes. The changes apply only to a German App Store billing address plus a device located in Germany, though the Bundeskartellamt says the outcome “may potentially also affect” how Apple designs the ATTF in other EU member states.
Three Ways to Combine the ATT Prompt With a CMP
Publishers running a separate consent management platform for GDPR and ePrivacy purposes get a text button and a second-layer page inside the new ATT prompt, plus a choice of three architectures.
| Option | How it works | Key constraint |
|---|---|---|
| 1. Combine into one prompt | First-layer disclosures sit in the Customizable Purpose String, granular settings on the second-layer page; ATT and CMP choices are uniform; only one prompt is shown | Requires that all requirements under data protection law are met in the individual case; one Allow or Reject then applies to both the ATT prompt and the CMP |
| 2. Separate prompts, cross-referenced | CMP and ATT prompt run separately; the ATT prompt notes that consent was already given under data protection law | Declining in the CMP means the publisher may not display the ATT prompt or use the IDFA; consenting lets the publisher re-show the ATT prompt 12 months after its last display |
| 3. Separate prompts, unchanged | CMP and ATT prompt run separately with no reference to each other, as before | The ATT prompt still uses the new layout and wording; the CMP is unchanged |
No Fine, and Not a Push for More Consent
France and Italy fined Apple over ATT last year, 150 million euros and 98.6 million euros respectively. Germany instead specified a design, with an independent trustee monitoring compliance on the authority’s behalf. Mundt was explicit that raising consent rates was never the goal: “It is expressly not our aim to help achieve the highest possible levels of consent to personalised advertising. We want to ensure that users can make a free and informed decision. Users who do not wish to allow their data to be used for personalised advertising must be able to make an equally free and informed decision as users who intend to consent to such data use.”
Apple rejected the preliminary assessment but offered the commitments anyway. Apple told MacRumors: “While we believe the current ATT prompt provides a clear, easy-to-understand and effective way to keep users in control of their data—an opinion shared by the German data protection authorities—we have agreed to make changes to the text and formatting of the prompt at the FCO’s request.” The Bundeskartellamt’s own FAQ frames that shared opinion more narrowly: the data protection authorities generally view the ATTF “positively from a data protection policy perspective” but do not consider it “a necessary measure under data protection law.”
What Changes, and When
Apple must roll the changes into iOS and iPadOS, inform publishers, and test the new prompts with them first through what the Bundeskartellamt calls Beta Seed Testing. No service date is public, so the four-month clock cannot yet be pinned to a calendar date. Once the prompts ship, the trustee monitors compliance for seven years, reports regularly to the Bundeskartellamt, and can mediate if a publisher believes Apple breached the commitments.
Anyone tracking ATT opt-in behavior in Germany should expect a structural break in the series once the new prompt lands. A separate study found ATT barely moved developers toward charging upfront, while the share of surviving apps disclosing linked data more than doubled, from 10.4% to 24.1%. Publishers already juggling Google’s IP-based ad personalization in the EEA and the TCF settings publishers must check now have a Germany-specific ATT architecture to plan around too.
Sources: Bundeskartellamt press release, MacRumors.