App Tracking Transparency: Combined Consent, EU Changes and Measurement

App Tracking Transparency (ATT) is Apple’s permission system for tracking across other companies’ apps and websites. A consent management platform (CMP) records choices about processing purposes under privacy law. The two systems cover different requirements, with an overlapping scope.

The Bundeskartellamt announced binding Apple commitments on 17 August 2026, following its decision of 13 August. The changes concern the design of tracking prompts and their relationship with privacy consent. The result is more flexibility for app publishers, not a blanket rule that every app now needs exactly one prompt.

Three options instead of one mandatory flow

The authority’s FAQ describes three approaches for processing that requires both ATT permission and legal consent: a combined prompt, separate prompts with a reference to consent already obtained, or separate prompts without that reference. A compliant combined approach can let one choice apply to both ATT and the consent interface for the overlapping processing. Matching outcomes are therefore not, by themselves, evidence of an invalid design.

The combined option requires the necessary information and granular choices to be presented appropriately. Other processing outside ATT’s scope may still need separate controls. The competition proceeding did not certify every implementation’s compliance with data protection law. The commitments address the authority’s preliminary competition concerns; Apple continued to dispute that assessment.

What Apple documents for implementation

Apple describes an alternative EU prompt beginning with iOS and iPadOS 27.2. Its expanded-interface API provides an optional Additional Information action and Markdown-formatted explanatory text. For Germany, France, Italy, Poland and Romania, the documentation specifies the new full-page interface; availability also depends on the device’s location and Apple Account country or region. Outside the EU, the API falls back to the original alert.

Opening Additional Information dismisses the prompt without recording an authorization answer. The callback can return notDetermined; opening the information layer is not consent. Apple also describes renewed requests after one year in the EU, subject to system restrictions. These are documented platform conditions, not evidence that a particular app or device has already completed rollout.

In the separate flow that refers to prior consent, refusal of every relevant purpose in the CMP means the ATT prompt must not follow. Returning from an information layer must therefore not trigger a new permission request regardless of the choices just made.

ATT is broader than IDFA access

ATT covers Apple’s defined cross-company tracking and sharing with data brokers, not merely reading the advertising identifier. A hashed email address does not bypass the ATT requirement. Conversely, ATT permission does not automatically authorize every processing purpose under applicable law.

A practical implementation needs the current ATT state and the applicable purpose-specific consent information. ATT has four states: authorized, denied, restricted and notDetermined. Reducing all of these to “accepted” or “refused” loses information. Records should also make the displayed information, flow version and relevant choices understandable.

The multiplication uses a conditional rate

For an illustrative population of 1,000 eligible app instances, suppose 400 have ATT permission and 300 of those also have the required consent. The joint rate is 40% × 75% = 30%. The 75% is the consent rate within the ATT-authorized group, not the consent rate across the whole population.

This identity does not depend on which prompt appeared first. A second prompt can also be shown to a different population depending on the app’s design. Multiplying two overall rates would require an additional independence assumption. The measurement must therefore record the denominator, eligibility, actual prompt exposure and unresolved states.

If the joint rate later reaches 36%, the change is six percentage points, or 20% relative to 30%. That observation alone does not identify a causal effect of the dialog. Changes in country mix, operating systems, acquisition, repeated requests or measurement can also alter the result. A controlled comparison with consistent definitions is more informative than an unqualified before/after rate.