Germany's Bundeskartellamt closed its App Tracking Transparency (ATT) proceeding against Apple on August 17, 2026, after accepting binding commitments. Apple's consent screen for third-party apps will be redesigned, and an independent trustee will monitor compliance for seven years. The result is more interesting than a typical antitrust settlement, because it treats a privacy feature as something that can be judged by both data protection principles and competition principles at once.
The strongest case for Apple's prompt
Apple's defenders make a serious argument. Under the GDPR, consent must be "freely given, specific, informed and unambiguous" (Article 4(11), Regulation (EU) 2016/679), and Recital 42 says consent is not valid where a person cannot refuse without detriment. A stark, unmissable prompt that says an app wants to track you is plainly informative. Cross-app tracking is also the most invasive form of ad profiling. A regulator that dilutes the warning risks nudging users toward saying yes.
German data protection authorities, according to ppc.land's account of the decision, viewed the framework positively as policy. They did not, however, consider it legally necessary under data protection rules.
What the competition problem actually was
The competition complaint was never that Apple offers a prompt. It was that Apple held rivals to a different standard than itself. Third-party apps had to show Apple's ATT prompt. Apple's own personalised-ads prompt worked separately, because Apple says it doesn't use the advertising identifier or combine cross-company data for its own advertising. According to ppc.land, the authority's president Andreas Mundt said the rules "must not treat [Apple's] own offerings better than those of its competitors."
France had already reached a similar conclusion. On March 31, 2025, the Autorité de la concurrence fined Apple €150 million. It accepted that protecting personal data was a legitimate objective. But it found ATT's implementation "neither necessary nor proportionate" to that objective, and said it disadvantaged smaller publishers, which depend on third-party data collection to finance their business, unlike vertically integrated platforms. France's data protection authority, the CNIL, gave the competition regulator opinions on privacy law, and confirmed that "marginal modifications" could keep privacy protection intact.
That detail matters. The French and German cases both rest on the premise that the privacy goal and a fair prompt are compatible.
What changes
Per MediaNama's report, the alternative prompt applies only in Germany, France, Italy, Poland and Romania, because of country-specific legal requirements. It is a full-page screen rather than a pop-up. It drops the word "track" in favour of plain "Allow" and "Reject" options, and developers may re-prompt users once a year, which was previously prohibited. Apple has four months from service of the decision to implement it.
The Next Web's coverage adds that the aim is a prompt that is "visually and linguistically neutral", and that developers may combine Apple's request with their own consent screens, removing a double hurdle. Notably, this is a behavioural remedy with no fine. France and Italy had already imposed fines of €150 million and €98.6 million.
Why this is the better model
Critics will say a softer prompt means more tracking. The evidence for that is not in the record yet, and the design is still opt-in. "Allow" and "Reject" are symmetrical choices, which is closer to the GDPR's demand for a genuine, unambiguous choice than a prompt weighted toward refusal. A consent screen that steers is not a stronger consent screen. It is a different kind of dark pattern, even when the steering favours the user's presumed preference.
Three features make the settlement proportionate:
- It targets the asymmetry, not the privacy goal. Apple keeps a consent gate. It must apply comparable neutrality to its own services and to rivals.
- It has verifiable enforcement. A seven-year trustee who can hear publisher complaints is a better tool than a one-off fine, because design harm is ongoing and hard to prove after the fact.
- It coordinated with data protection authorities. Aligning the remedy with GDPR consent principles reduces the risk of a competition remedy forcing a privacy violation.
The open questions
The patchwork is the weakest part. Five countries get the new prompt while the other 22 EU member states do not, and MediaNama attributes this to country-specific legal requirements, not a single EU-wide rule. That is awkward for developers who ship one app across the single market. Poland and Romania's own proceedings also sit alongside the German outcome, so the regulatory picture is not fully closed.
The annual re-prompt is the other risk. Done well, it lets a user who declined once revisit the choice with better information. Done badly, it becomes the nagging that consent law is meant to prevent. The trustee's first job will be to define where that line is.
The takeaway
European regulators are converging on something useful: privacy features from dominant platforms are not immune from competition law, and competition remedies need not weaken privacy. If the trustee keeps the rules neutral in practice, Germany will have shown that a proportionate, behaviour-focused remedy can protect users and small publishers without either fines or a blanket ban on platform consent design.