On 17 August 2026 the Bundeskartellamt declared Apple's commitments on its App Tracking Transparency Framework (ATTF) binding and closed a proceeding it opened in June 2022. The settlement has been covered already. The more interesting part is how the oversight is built: an independent monitoring trustee, a seven-year term, and a four-month implementation window with publisher testing. Set beside the French and Italian fines on the same framework, it is a different theory of what competition enforcement should deliver.
The strongest case for the harder line
The critics deserve a fair hearing. The German media and advertising associations that complained rejected Apple's proposals after the December 2025 market test and wanted a prohibition decision under Section 19a, according to their statement. Their argument is that a firm that is both gatekeeper and advertiser should not write the rules for its own competitors' consent screens, and that a negotiated outcome lets Apple keep control of the design. Fines also carry a deterrent signal that commitments do not. Those are serious points.
What the German design actually contains
The Bundeskartellamt's objection was that Apple showed different consent prompts for its own apps and for third-party apps. The two differed in wording, design and the number of steps, and the authority said they may contain dark patterns. Under the commitments, Apple removes discouraging symbols and wording from the third-party prompt and makes the design neutral in content, wording and layout. Publishers get more room to explain personalised advertising and to combine Apple's request with their own data-protection consent requests.
Three features carry the oversight:
- A trustee. PPC Land's account of the authority's FAQ says the trustee supervises compliance, reports regularly to the authority, and takes disputes from publishers directly. Where it cannot resolve one, it consults the Bundeskartellamt.
- A seven-year term. The press release says seven years. The same FAQ account says the clock starts at implementation, not at the decision date.
- A four-month window. Apple has four months from service of the decision to implement the changes, and it tests them with app publishers beforehand.
Fines punish the past; a trustee governs the product
France's competition authority fined Apple €150 million in March 2025, finding that it used ATT to leverage a dominant position in mobile app advertising. Italy's AGCM followed on 22 December 2025 with €98.6 million. It objected to developers in the EU having to show both an ATT prompt and a GDPR prompt, where Apple's own apps need a single tap. Apple said it would appeal the Italian decision.
A fine is a one-off signal about the past. It tells publishers little about what the prompt should look like next year, and an appeal can leave the underlying design contested for years. The German model puts the same question, whether Apple's prompt treats rivals neutrally, into an ongoing process. A publisher with a complaint has a named channel that does not require litigating. Reporting on the decision notes that Germany chose behavioural remedies rather than a fine, and that the changes reach almost all of the EU.
The scope point needs care. The FAQ account describes the binding commitments as covering users with App Store billing addresses and devices in Germany. The authority says the outcome may influence ATTF design in other member states, but that is not a binding obligation. The wider EU reach reported by the press is Apple's own extension, not something the German decision compels.
Why this is the more proportionate tool
The case for this model rests on what each remedy costs. The authority framed the goal narrowly: not to maximise consent, but to let users make a free and informed choice either way. It also did not object to Apple introducing ATT itself, only to its design. That is a targeted fix. It preserves a privacy feature many users value and removes the asymmetry that disadvantaged rivals. A blunt prohibition or a large fine would have mostly created litigation.
The model still has risks, and a pro-innovation reading should name them:
- Trustee capture and cost. A seven-year monitoring regime is only as good as the trustee's independence and the speed of dispute resolution.
- Design lock-in. Consent interfaces change with operating systems and privacy law. Seven years is long, and commitments written in 2026 must not freeze the prompt against improvements.
- Narrow scope. The proceeding examined only competition law. The authority consulted the federal data protection commissioner and the Bavarian data protection authority to avoid overlap, but it did not rule on data protection.
What to watch
The test is empirical. Within the four-month window, publishers should be able to see the neutral prompt in beta testing. After that, the useful evidence is the trustee's dispute log: how many complaints arrive, how fast they close, and whether consent rates for third-party apps move. If they do, Germany will have shown that Section 19a can deliver an enforceable product standard. If not, the complainants' demand for a prohibition will look better in hindsight.
For other regulators the lesson is practical. A fine gives a headline and an appeal. A bounded, monitored commitment gives affected businesses a working remedy, and it keeps the intervention proportionate to the harm it targets.