France's Antitrust Regulator Fines Apple $162 Million Over App Tracking Transparency Framework

France's competition regulator, the Autorité de la concurrence, announced today it has fined Apple €150 million. The decision stems from findings that Apple abused its dominant position concerning how its App Tracking Transparency (ATT) framework was implemented on iOS and iPadOS devices between April 2021 and July 2023.

The Autorité clarified that while the objective of ATT wasn't inherently problematic, its implementation raised competition concerns. The regulator stated that how ATT was rolled out was "neither necessary for nor proportionate with Apple's stated objective of protecting personal data."




A key issue highlighted was the complexity introduced for users and developers. The Autorité found that the ATT framework led to "multiple consent pop-ups being displayed, making the use of third-party applications in the iOS environment excessively complex." This complexity arose partly because the consent obtained via ATT was deemed "not valid under the applicable laws, in particular the French Data Protection Act," forcing publishers to continue using their own consent management platforms (CMPs) alongside ATT.

The regulator also determined that the rules governing how these pop-ups interacted "undermined the neutrality of the framework." Specifically, it noted an asymmetry: "While advertising tracking only needs to be refused once, the user must always confirm their consent a second time." This, the Autorité argued, "prevents the informed consent that ATT is supposed to facilitate," causing "definite economic harm" to app publishers and ad providers.



Furthermore, the decision pointed out an "asymmetry of treatment between Apple and publishers." Initially, Apple didn't require the same consent prompts for its own applications. While this changed partly with iOS 15, the Autorité stated the asymmetry persists because "Apple has introduced a single 'Personalized Advertising' pop-up to collect user consent for its own data collection, while continuing to require double consent for third-party data collection by publishers."


The Autorité noted the framework particularly impacted smaller publishers. It stated that ATT "penalised smaller publishers in particular since, unlike the main vertically integrated platforms, they depend to a large extent on third-party data collection to finance their business."

Collaboration with France's data protection authority, the CNIL, was also mentioned. The CNIL provided opinions suggesting ATT's implementation created "unnecessary and artificial complexity" and that "marginal modifications" could align it with legal requirements without harming privacy protection.

Considering the findings, the duration of the infringement, and Apple's market position, the Autorité imposed the €150 million fine. Apple has also been ordered to publish a summary of the decision on its website.