Decision 25-D-02 of March 31, 2025

Under the terms of the present decision, the Autorité de la concurrence (hereinafter the “Autorité”) is sanctioning Apple for having abused its dominant position on the European market for the distribution of mobile apps on iOS devices, in violation of Articles 102 of the Treaty on the Functioning of the European Union (hereinafter ‘‘TFEU”) and L. 420-2 of the French Commercial Code (Code de commerce).

This decision follows a complaint by the associations Interactive Advertising Bureau France (IAB France), Mobile Marketing Association France (MMA France), Union des entreprises de conseil et achat media (UDECAM) and Syndicat des Régies Internet (SRI) and then a further complaint by the Groupement des éditeurs de contenu et de services en ligne (GESTE) concerning practices implemented by Apple in connection with the introduction of its App Tracking Transparency (hereinafter “ATT”) framework.

Apple is a vertically integrated company, which manufactures smart mobile devices (iPhones and iPads) and the iOS operating system that powers them. Apple also distributes apps for its mobile devices via its own App Store, which is pre-installed on its smartphones. Apple’s ecosystem is based on a closed system: on the one hand, third-party device manufacturers cannot obtain an iOS licence from Apple to use its operating system on their own smartphones and, on the other hand, until the obligations of the Digital Markets Act (hereinafter “DMA”) came into force, app publishers could not distribute their apps on iOS smart mobile devices on any app store other than Apple’s App Store.

Based on the App Store, and in light of the criteria set out in decision-making practice and case law to date, the Autorité has concluded that Apple is in a dominant position on both the publisher- and consumer-facing sides of the distribution of mobile apps on iOS devices.

Access to Apple advertising identifiers, by which app publishers that distribute their apps on the App Store can access user data and, thereby, add value to their advertising offerings, is subject to GDPR rules. Publishers therefore have to obtain users’ consent.

To meet this objective, Apple introduced a framework requiring publishers to obtain users’ consent for the collection of their data on third-party apps (“third-party tracking”), the ATT framework or prompt.

According to Apple, the ATT prompt was designed as an interface using simple, standardised wording to facilitate user information and choice as regards third-party tracking. However, the consent obtained is not valid under the applicable data protection regulations, meaning that app publishers must display at least a second consent window, known by industry standards as a consent management platform (hereinafter “CMP”), to authorise third-party tracking on apps downloaded to an iPhone or iPad.

Although Apple is free to enact consumer protection rules that go beyond those imposed by regulation, it may only do so if this legitimate objective is not at odds with competition law, given its specific responsibility as a dominant operator in the market for the distribution of mobile apps on iOS terminals.

A dominant operator that runs a digital platform can direct the economic model of the operators listed on its platform, limit their commercial freedom and influence the quality and diversity of the offering to internet users. As a result, the implementation by a dominant operator like Apple of rules for accessing a digital platform that are disproportionate or lack objective justification may affect the functioning of the markets where the economic operators listed on the digital platform are active and, ultimately, harm consumer interests.

However, the Autorité found that the design and implementation of the ATT prompt were neither necessary for nor proportionate with Apple’s privacy protection objectives.

On the one hand, the fact that publishers that so wish cannot rely on the ATT prompt to comply with their legal obligations means that they must continue to use their own consent collection solutions. The result is that multiple consent pop-up windows are displayed, making the use of third-party applications in the iOS environment excessively complex

On the other hand, the rules governing the interaction between the different pop-up windows displayed automatically undermine the neutrality of the prompt. While ad tracking only needs to be refused once, users must always confirm their consent a second time. The resulting asymmetry prevents companies from obtaining the informed consent that ATT is supposed to facilitate, which is likely to have negative consequences for both users and app publishers, in particular those that depend on advertising for the profitability of their business.

This seems all the less justified given that marginal changes to the ATT prompt, as recommended by the French data protection authority (Commission nationale de l’informatique et des libertés – CNIL), would avoid penalising app publishers and advertising service providers, without undermining the appeal of the prompt in terms of privacy protection.

Invited by the Autorité to comment as part of the investigation, the CNIL stated that: “a marginal improvement in how the ATT prompt is configured, which does not affect the readability of the pop-up window, so that the window can be used to obtain valid consent [...] would retain the user protection offered by the ATT prompt [...] (refusal as simple as consent, mention of tracking), without having the disadvantage of creating a complex and excessive system for the user”. Contrary to what Apple maintained as part of the investigation, bringing the ATT prompt into compliance with competition law would not have led to a downgrade in the efficiency of its privacy protection system.

In addition, the investigation found that the ATT prompt penalises smaller publishers in particular. While these operators depend to a large extent on third-party data collection to finance their business, Apple, like the main vertically integrated platforms, is not dependent on third-party tracking insofar as it has access to large quantities of “proprietary” personal data within its ecosystem, the collection of which is not affected by ATT.

In view of this, the Autorité considered that the rules for implementing the ATT prompt constituted unfair trading conditions within the meaning of Articles 102 TFEU and L. 420‑2 of the French Commercial Code, insofar as they were not objective, not transparent and were applied discriminatingly. It has therefore imposed a fine of €150,000,000 on Apple Distribution International Limited, Apple Operations International Limited and Apple Inc., jointly and severally.