{"id":12836,"date":"2026-08-27T06:30:00","date_gmt":"2026-08-27T04:30:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/uncategorized-en\/app-tracking-transparency-one-prompt-instead-of-two\/"},"modified":"2026-10-24T05:46:45","modified_gmt":"2026-10-24T03:46:45","slug":"app-tracking-transparency-after-the-german-antitrust-decision-one-prompt","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/data-privacy\/app-tracking-transparency-after-the-german-antitrust-decision-one-prompt\/","title":{"rendered":"App Tracking Transparency: Combined Consent, EU Changes and Measurement"},"content":{"rendered":"

App Tracking Transparency (ATT) is Apple\u2019s permission system for tracking across other companies\u2019 apps and websites. A consent management platform (CMP) records choices about processing purposes under privacy law. The two systems cover different requirements, with an overlapping scope.<\/p>\n

The Bundeskartellamt announced binding Apple commitments on 17 August 2026, following its decision of 13 August. The changes concern the design of tracking prompts and their relationship with privacy consent. The result is more flexibility for app publishers, not a blanket rule that every app now needs exactly one prompt.<\/p>\n

Three options instead of one mandatory flow<\/h2>\n

The authority’s FAQ describes three approaches for processing that requires both ATT permission and legal consent: a combined prompt, separate prompts with a reference to consent already obtained, or separate prompts without that reference. A compliant combined approach can let one choice apply to both ATT and the consent interface for the overlapping processing. Matching outcomes are therefore not, by themselves, evidence of an invalid design.<\/p>\n

The combined option requires the necessary information and granular choices to be presented appropriately. Other processing outside ATT’s scope may still need separate controls. The competition proceeding did not certify every implementation’s compliance with data protection law. The commitments address the authority’s preliminary competition concerns; Apple continued to dispute that assessment.<\/p>\n

\"ATT:
Overlapping processing \u00b7 legal requirements still apply.<\/figcaption><\/figure>\n

What Apple documents for implementation<\/h2>\n

Apple describes an alternative EU prompt beginning with iOS and iPadOS 27.2. Its expanded-interface API provides an optional Additional Information action and Markdown-formatted explanatory text. For Germany, France, Italy, Poland and Romania, the documentation specifies the new full-page interface; availability also depends on the device’s location and Apple Account country or region. Outside the EU, the API falls back to the original alert.<\/p>\n

Opening Additional Information dismisses the prompt without recording an authorization answer. The callback can return notDetermined<\/code>; opening the information layer is not consent. Apple also describes renewed requests after one year in the EU, subject to system restrictions. These are documented platform conditions, not evidence that a particular app or device has already completed rollout.<\/p>\n

In the separate flow that refers to prior consent, refusal of every relevant purpose in the CMP means the ATT prompt must not follow. Returning from an information layer must therefore not trigger a new permission request regardless of the choices just made.<\/p>\n

ATT is broader than IDFA access<\/h2>\n

ATT covers Apple’s defined cross-company tracking and sharing with data brokers, not merely reading the advertising identifier. A hashed email address does not bypass the ATT requirement. Conversely, ATT permission does not automatically authorize every processing purpose under applicable law.<\/p>\n

A practical implementation needs the current ATT state and the applicable purpose-specific consent information. ATT has four states: authorized<\/code>, denied<\/code>, restricted<\/code> and notDetermined<\/code>. Reducing all of these to \u201caccepted\u201d or \u201crefused\u201d loses information. Records should also make the displayed information, flow version and relevant choices understandable.<\/p>\n

The multiplication uses a conditional rate<\/h2>\n

For an illustrative population of 1,000 eligible app instances, suppose 400 have ATT permission and 300 of those also have the required consent. The joint rate is 40% \u00d7 75% = 30%. The 75% is the consent rate within the ATT-authorized group<\/em>, not the consent rate across the whole population.<\/p>\n

This identity does not depend on which prompt appeared first. A second prompt can also be shown to a different population depending on the app’s design. Multiplying two overall rates would require an additional independence assumption. The measurement must therefore record the denominator, eligibility, actual prompt exposure and unresolved states.<\/p>\n

If the joint rate later reaches 36%, the change is six percentage points, or 20% relative to 30%. That observation alone does not identify a causal effect of the dialog. Changes in country mix, operating systems, acquisition, repeated requests or measurement can also alter the result. A controlled comparison with consistent definitions is more informative than an unqualified before\/after rate.<\/p>\n

\n

Questions and answers<\/h2>\n

Must the two recorded choices always differ sometimes?<\/h3>\n

No. The authority explicitly permits a combined choice for qualifying overlapping processing. A near-zero share of mixed outcomes can also arise from user preferences or measurement errors. Outcome frequencies alone prove neither unlawful coupling nor lawful consent. The implemented controls and information need examination.<\/p>\n

What follows from a later ATT refusal?<\/h3>\n

Tracking that requires ATT authorization must stop even if a separate consent record still says yes. The app can read the current state through ATTrackingManager.trackingAuthorizationStatus<\/code>. The effect on other processing depends on its purposes, legal basis and the consent flow; continuing all processing or revoking every unrelated permission automatically would both be overbroad rules.<\/p>\n

What is the implementation timetable?<\/h3>\n

The authority gives Apple four months from service of the decision. The commitments run for seven years from implementation, with independent monitoring. A press-release date is not automatically the service date. For analysis, the actual app version, operating system, region and flow variant matter more than assuming one universal changeover date.<\/p>\n<\/div>\n

\n

Sources<\/h2>\n