Digital

Targeted advertising / Apple's implementation of the ATT framework. The Autorité does not issue urgent interim measures against Apple but continues to investigate into the merits of the case.

téléphone

Background

On 23 October 2020, the Autorité received a referral from several associations representing various players of the online advertising sector (media, internet networks, advertising agencies, technical intermediaries, publishers, mobile marketing agencies), and contesting practices implemented by Apple on the occasion of upcoming changes to its iOS 14 operating system. More specifically, the issue was the mandatory introduction of the App Tracking Transparency (ATT) framework for applications on iOS that would like to monitor the user activity on third party websites.

Activity tracking, based in particular on the Identifier for Advertisers (IDFA), Apple’s own identifier, enables targeted advertising, which is the source of funding for a large number of applications or websites.

The Autorité de la concurrence examined whether the measures implemented by Apple to offer users a reinforced framework of consent for the use of their personal data could be regarded as necessary and proportionate to the objective pursued. It also received an opinion from the CNIL (National Commission on Informatics and Liberty) on the issues raised. In the state of the investigation, the Autorité considered that the decision of Apple to set up a feature for collecting complementary consent to that implemented by other players in online advertising, did not appear as an abusive practice, when

 (1) a company, even if it is in a dominant position or can be considered as a structuring platform, has the freedom in principle to set rules to access its services, subject to not disregarding the laws and applicable regulations and that these rules are not anti-competitive;

 (2) the applicable regulations (GDPR and ePrivacy) do not preclude the implementation of such an obligation, while the wording adopted does not appear to induce an unfavourable bias to the monitoring procedures on third-party sites, such as imposing an unnecessary obligation or lacking proportionality, and that such a measure can facilitate, for users, the control of the use which is made of their personal data.

The Autorité therefore rejects the request for interim measures. However, it continues the investigation into the merits of the case. This should in particular make it possible to verify that the implementation by Apple of the ATT framework cannot be regarded as a form of discrimination or "self-preferencing", which could in particular be the case if Apple applied without justification, more binding rules on third-party operators than those it applies to itself for similar operations.

Apple

Apple announced in June 2020 that it would implement a user consent collection system to strengthen the protection of its users' personal data.

At the 22 June 2020 conference for application developers, Apple announced that, as part of its policy to strengthen the privacy protection of its customers, it would implement, in September 2020[1], a feature called ATT for App Tracking Transparency. This feature consists, when the holder of an iPhone visits an application downloaded via the App Store, in displaying a pop-up window which then asks for their explicit consent to authorise the sharing of their personal data to third parties for advertising purposes. With consent, third parties can access the Identifier for Advertisers (IDFA), which identifies each Apple device and enables tracking of the owner's advertising, including on third-party sites.

According to the complainants, by imposing compliance with the ATT feature on iOS applications, Apple would be abusing its dominant position

Complainant associations criticise Apple for requiring application developers to use ATT framework in order to gain access to the IDFA identifier. The consent collection via the ATT framework would condition the user's advertising tracking on third-party sites, which then allows to address them targeted advertising. In doing so, Apple allegedly imposed unfair trading conditions on application developers, which would characterise an abuse of a dominant position (prohibited by Article 102 (a) of the TFEU). They consider, on the one hand, that the ATT request is redundant and superfluous, because the obligation to obtain consent already weighs on application developers under the provisions of GDPR (EU) 2016/679 and under the e-Privacy directive. On the other hand, they consider that Apple is imposing undue additional obligations on application developers in doing so, again constituting a violation of Article 102 (d).

They therefore request the Autorité to issue urgent interim measures:

  • order Apple not to require, as it is, the use of ATT to obtain user authorisation for its advertising tracking ;
  • order Apple to engage in a constructive dialogue with industry players in order to find an acceptable solution to obtain user authorisation for their advertising tracking.

 

The facts of the case do not appear likely, in the light of the elements submitted during the proceedings, to constitute an abuse of a dominant position.

When the Autorité receives a request for interim measures, these can only be issued when the denounced practices are likely to breach competition law and in the event of serious and immediate harm to the overall economy, to the industry, to the interests of consumers or to the complaining company.

To determine whether the request for interim measures was justified, the Autorité conducted an extensive investigation under urgent procedure, hearing numerous professionals representing the various online advertising professions. The debates, during the hearing of 10 February 2021, enabled each of the stakeholders to assert their position and enrich the information gathered during the investigation. The Autorité received an opinion from the CNIL on the various issues regarding the enforcement of the legislation relating to the privacy protection raised by the case.

After analysing the information provided by the complainants, the Autorité considers, in the context of a preliminary investigation under urgent interim measures, that the introduction of the ATT framework does not appear to reflect an abuse of a dominant position on the part of Apple, leading to imposing unfair trading conditions.

  • ATT solicitation is part of Apple's privacy policy and does not appear to be unnecessary, lacking of objectivity  and of proportionality

In particular, the Autorité noted that the introduction of the ATT framework was part of Apple's long-standing strategy to protect the privacy of users of iOS products. It then noted that such an initiative fell within the framework of the margin of appreciation available to any company to determine its technical or commercial strategy, vis-à-vis its commercial partners or to lay down usage rules, including whether this company holds a dominant position or can be regarded as a structuring platform.

In this case, the establishment of a mandatory formalised framework, according to the format and wording defined by Apple, can help to keep users properly informed. The Autorité noted in this regard that the obligation to collect the ATT framework was not immediately implemented by Apple (its effective date having been postponed to March-April 2021) and that it leaves certain possibilities of adaptation for application developers. In particular, they have control over the sentence defining, in the ATT window, the purpose of monitoring personal data carried out on third-party sites; they have the option of deferring the triggering of the ATT framework , by refraining during this period from using the IDFA, to monitor activity on third-party sites. Finally, they have the possibility to send two windows to the user, before and after the appearance of the ATT request, in order to explain the need for them to be able to carry out this activity monitoring (for example to be able to fund the application or the offered service), and to convince the user to reconsider a refusal of follow-up, for example.

  • The existence of a differential process ("self preferencing") will be examined further in the context of the investigation into the merits of the case

As regards, more specifically, to the differential process between the collection of the user's consent for Apple's advertising services and that of third-party advertising services noted by the complainants, the Autorité considered that this did not result in this stage, that Apple would apply, by imposing the ATT framework on actors wishing to access the IDFA, a more rigorous process than that which it would apply to itself for similar process.

The investigation into the merits of the case will however make it possible to ensure that this process does not constitute an anticompetitive practice, in particular in that it would reflect a form of discrimination or "self-preferencing" on Apple's part.

In light of these elements, the Autorité rejected the request for urgent interim measures but decided to continue investigating into the merits of the case.

 

[1] The implementation of the system has been postponed to the end of March 2021 / beginning of April 2021.

Contact(s)

Bertille Gauthier
Bertille Gauthier
Communication officer