Apple has agreed to rewrite parts of its App Tracking Transparency system in Germany after the country’s competition authority concluded a long-running investigation into whether the privacy feature unfairly favoured Apple’s own services over third-party apps. The Bundeskartellamt has made the company’s commitments binding, requiring changes to the wording, design, and operation of consent requests shown to iPhone and iPad users. Apple has four months from service of the decision to implement the revised system.

App Tracking Transparency, usually shortened to ATT, requires apps to obtain permission before tracking users across other companies’ apps and websites, but the German case focused less on whether consent should be required than on how the choice was presented. The authority’s preliminary assessment was that Apple’s framework could make consent harder for third-party publishers to obtain while presenting requests relating to Apple’s own services differently. Apple therefore controlled both the operating system and the rules governing how rival publishers could ask users for commercially valuable data.

Under the commitments, consent requests are to become neutral in their content, wording, and layout, while publishers will receive greater scope to explain why personalised advertising supports their services. Developers will also have more flexibility to connect Apple’s ATT request with consent processes required under data protection law, reducing the likelihood that third-party apps have to ask substantially similar questions through separate interfaces. The ATT framework itself remains in place, so the settlement changes the choice architecture around tracking rather than removing the underlying privacy control.

The remedy is narrower geographically than a European-wide redesign because it applies to relevant users in Germany, with Apple’s commitments monitored for seven years by an independent trustee. Even so, the Bundeskartellamt has worked with other European competition authorities examining ATT and says the outcome could influence the framework’s future design elsewhere in the EU. A German behavioural remedy is therefore landing inside a much wider European argument over whether platform owners can invoke privacy or security rules while applying those rules differently to their own commercial activities.

Privacy rules become competition rules

ATT occupies awkward territory between two regulatory objectives that are often treated separately. Giving people more control over cross-app tracking can strengthen privacy, but when the company designing that control also sells advertising, distributes every competing app on its platform, and determines what those apps are allowed to ask users, the design of a consent screen can carry market consequences. Small differences in wording, symbols, or additional steps can alter how frequently users agree to data processing, which in turn affects advertising inventory, measurement, and the economics of ad-supported services.

Germany’s intervention does not challenge the principle that people should be asked before they are tracked. Instead, it tests whether a gatekeeper can impose a privacy standard through interfaces that create different commercial conditions for itself and companies dependent on its platform. Platform regulation is steadily moving beyond disputes about app-store commissions or hardware access into the quieter mechanics of product design, where defaults, prompts, and permissions can shape market behaviour without an explicit contractual restriction.

Apple is already dealing with that wider shift in Europe, where disputes over interoperability and platform access have begun to affect product decisions as well as compliance teams. A separate dispute over Siri and the Digital Markets Act has shown how European competition rules can reach directly into product rollout decisions, even though the German ATT case rests on a different legal route. Regulators are becoming more willing to examine how technical design reinforces the position of a company that controls an operating system, marketplace, and adjacent services.

A behavioural remedy with a long tail

Rather than imposing a one-off change and closing the file, the German arrangement creates an extended implementation and monitoring period. Apple must test the revised prompts with publishers before rollout, while the independent trustee can supervise compliance throughout the seven-year life of the commitments. App developers therefore retain a route for raising concerns if the practical operation of the redesigned framework diverges from what was agreed.

The settlement also creates a practical test of whether interface design can be neutralised without weakening privacy protections. Advertising groups and publishers have criticised ATT because restricting cross-app identifiers can make targeted advertising and measurement more difficult, while Apple has consistently defended the system as a way to give users control over tracking. Germany’s remedy attempts to separate those issues: users can still reject tracking, but Apple must not make that choice structurally harder for rival publishers than for its own services.

Implementation will determine how far the intervention travels beyond the German market, because Apple now has to translate behavioural commitments into an operating-system interface used at enormous scale. If the revised prompts work without undermining user control, other European authorities examining similar questions will have a concrete design to assess rather than an abstract argument about privacy and competition. If publishers continue to face materially different conditions, seven years of monitoring gives the Bundeskartellamt considerably more leverage than a compliance promise that disappears once the investigation closes.