Targeted advertising: the Autorité de la concurrence imposes a fine of €150,000,000 on Apple for the implementation of the App Tracking Transparency (“ATT”) framework

Background

The Autorité de la concurrence has fined Apple €150,000,000 for abusing its dominant position in the sector for the distribution of mobile applications on iOS and iPadOS devices between April 2021 and July 2023.

The Autorité had previously rejected a request for interim measures in the case, while deciding to pursue the investigation into the merits.

As part of its investigation into the merits of the case, the Autorité found that while the objective of the App Tracking Transparency (“ATT”) framework is not at its core problematic, how ATT is implemented is neither necessary for nor proportionate with Apple’s stated objective of protecting personal data.

The introduction of the framework led to multiple consent pop-ups being displayed, making the use of third-party applications in the iOS environment excessively complex. The Autorité also found that the rules governing the interaction between the different pop-up windows displayed undermined the neutrality of the framework, causing definite economic harm to application publishers and advertising service providers. In this respect, the Autorité noted that ATT as implemented by Apple penalised smaller publishers in particular since, unlike the main vertically integrated platforms, they depend to a large extent on third-party data collection to finance their business.

The ATT framework introduced by Apple on 26 April 2021

Apple introduced the ATT framework in April 2021, when version 14.5 of the iOS and iPadOS operating systems was launched for its smart mobile devices. The ATT framework asks iPhone or iPad users, with a view to better protecting their privacy, for their consent to data collection on third-party applications in the iOS and iPadOS ecosystem operated by Apple, by displaying a pop-up window in a partially standardised format. This consent, requested before any use of a newly downloaded application from the App Store, authorises the application in question to collect user data for targeted advertising purposes. If consent is given, the application can access the Identifier for Advertisers (“IDFA”), the identifier by which each device can be tracked through its use of third-party applications and sites.

**In a decision dated 17 March 2021, the Autorité refused the request for interim measures and ordered the continuation of the investigation into the merits of the case**

On 23 October 2020, in anticipation of the introduction of the ATT framework as announced by Apple, several associations representing various online advertising players (media, internet networks, advertising agencies, technical intermediaries, publishers, mobile marketing agencies) lodged a complaint with the Autorité de la concurrence. The ATT framework was seen as an obstacle to targeted advertising to Apple device users, a major source of funding for application publishers and other online advertising players.

In its decision dated 17 March 2021, the Autorité decided not to issue interim measures but indicated that the investigation into the merits of the case would continue.

The ATT framework is neither necessary nor proportionate

While Apple is free to enact consumer protection rules in addition to those imposed by regulation, this possibility is on condition that, given its specific responsibility as a dominant operator in the market for the distribution of mobile applications on iOS terminals, Apple reconciles this legitimate objective with respect for competition law.

A dominant operator that runs a digital platform can direct the economic model of the operators listed on its platform, limit their commercial freedom and influence the quality and diversity of the offering to internet users. As a result, the implementation by a dominant operator like Apple of rules for accessing a digital platform that are disproportionate or lack objective justification may affect the functioning of the markets where the economic operators listed on the digital platform are active and, ultimately, harm consumer interests.

However, while the principle of the ATT framework is not problematic in terms of the likely benefits for users as regards privacy protection, the Autorité found that how the framework is implemented is abusive within the meaning of competition law, in particular as the implementation methods artificially complicate the use of third-party applications and distort the neutrality of the framework to the detriment of small publishers financed by advertising.

An artificially complex framework that specifically penalises publishers of third-party applications in the iOS environment

The Autorité found that the ATT framework imposed by Apple is not necessary, insofar as the consent obtained is not valid under the applicable laws, in particular the French Data Protection Act.

In practice, the fact that publishers that so wish cannot rely on the ATT framework to comply with their legal obligations means that they must continue to use their own consent collection solutions, known as consent management platforms (“CMPs”). The result is that multiple consent pop-ups are displayed, making the use of third-party applications in the iOS environment excessively complex, as observed by the French data protection authority (Commission nationale de l’informatique et des libertés – CNIL) in a 2022 opinion issued at the request of the Autorité.

Operating rules that undermine the neutrality of the framework

Furthermore, the rules governing the interaction between the different pop-up windows displayed undermine the neutrality of the framework. While advertising tracking only needs to be refused once, the user must always confirm their consent a second time. The resulting asymmetry prevents the informed consent that ATT is supposed to facilitate. Definite harm has thereby been caused to application publishers and advertising service providers, which could be avoided by marginal modifications to the ATT framework, as recommended by the CNIL, and therefore seems all the more unjustified.

Asymmetry of treatment between Apple and publishers

Lastly, the Autorité found an asymmetry in how Apple treated itself and how publishers were treated. While publishers were required to obtain double consent from users for tracking on third-party sites and applications, Apple did not ask for consent from users of its own applications (until the implementation of iOS 15). Due to this asymmetry, the CNIL fined Apple for infringing Article 82 of the French Data Protection Act, which transposes the ePrivacy Directive.

The asymmetry remains today insofar as Apple has introduced a single “Personalized Advertising” pop-up to collect user consent for its own data collection, while continuing to require double consent for third-party data collection by publishers.

A particularly harmful framework for small publishers

Although the introduction of ATT has impacted all application publishers, the framework has been particularly harmful for smaller publishers that do not enjoy alternative targeting possibilities, in particular in the absence of sufficient proprietary data.

For several players, including Ad4Screen, the loss of business for smaller players should be contrasted with “players with their own data ‘ecosystem’ [that] can leverage their position to strengthen their offering without using IDFA or cookies”. This player cites, in particular, the example of Meta and Google, which can track users’ journeys after they have seen an advert.

**An example of collaboration with the CNIL: data protection taken into account by the Autorité in its analysis**

On 12 December 2023, the Autorité and the CNIL published a joint declaration entitled “Data protection and competition: a common ambition”, confirming their desire to deepen their already well-established cooperation. On 19 December 2024, the CNIL published the conclusions of a mission entrusted to Bruno Lasserre to examine the consequences of the interplay between data protection and competition for the CNIL and its regulatory practice.

The Autorité and the CNIL work for the benefit of consumers of digital products and services, who also have rights to the protection of their data. On the one hand, personal data protection policy aims to protect users against any harmful collection and use of their data. On the other hand, competition policy aims to guarantee the conditions for free, undistorted competition between companies in the marketplace, in the interests of consumers, by promoting innovation, diversity of supply and attractive prices. Despite distinct public policy objectives, there is a certain convergence of objectives, in the broadest sense, between the two regulatory frameworks, in that both are ultimately implemented for the benefit of users.

At the request of the CNIL, the Autorité issued an opinion on draft recommendations on mobile applications in September 2024. This request was the first concrete expression of the commitments made by the two institutions in their joint declaration signed in December 2023.

The case at hand is yet another example of cooperation between the Autorité and the CNIL. The Autorité received two opinions from the CNIL on various questions relating to the applicability of privacy legislation raised by the case, which the Autorité took into account in its competitive analysis.

These two opinions showed that bringing the ATT pop-up into compliance with competition law would not have led Apple to downgrading the effectiveness of its privacy protection system. Invited by the Autorité to comment as part of the investigation into the merits, the CNIL stated that: “making publishers systematically collect user consent twice for the same purpose constitutes an unnecessary and artificial complexity, insofar as it seems that the ATT framework could easily, subject to a few modifications, also be used to collect the consents required by French law and the GDPR”. The CNIL also indicated that: “a marginal improvement in how the ATT framework is configured, which does not affect the readability of the pop-up, [...] would retain the user protection offered by the ATT framework [...] (refusal as simple as acceptance, mention of tracking), without having the disadvantage of creating a complex and excessive system for the user”.

The case shows that competition law and the right to privacy are not mutually exclusive, but both aim to guarantee a fair and transparent market that safeguards consumer interests and well-being

**The Autorité has imposed a fine of €150,000,000 on Apple for abusing its dominant position in the sector for mobile application advertising on iOS and iPadOS terminals**

In view of the seriousness of the facts, the duration of the infringement (between 26 April 2021 and 25 July 2023) and Apple’s economic power, the Autorité has decided to impose a fine of €150,000,000 on Apple Distribution International Limited (ADI) and Apple Inc., as perpetrators, and Apple Operations International Limited and Apple Inc., as parent companies.

In addition to the fine, the Autorité has ordered Apple to publish the summary of the decision on its website for seven consecutive days.