In a significant move highlighting the stringent application of European privacy regulations, the French competition authority, Autorité de la concurrence, has imposed a fine of $162 million on Apple. This penalty comes in response to Apple’s App Tracking Transparency (ATT) tool, which the regulator identified as contravening both French and EU privacy laws by being overly complex and biased.
The basis for the fine rests on the General Data Protection Regulation (GDPR) and the French Data Protection Act, with the French authority asserting that the consent process mandated by Apple’s ATT is excessively burdensome. The ATT framework requires multiple consent pop-ups, which complicates app usage, thus infringing on the principles of transparency and ease mandated by GDPR. For more on GDPR standards, see this overview.
This decision underscores broader concerns regarding the ATT’s operational framework, which since its inception, has been a subject of scrutiny. In particular, the French data protection authority, Commission Nationale de l’Informatique et des Libertés (CNIL), highlighted that Apple’s approach exhibited an imbalance, favoring its own processes over those applied to app publishers. CNIL’s missions in regulating digital data privacy are outlined here.
The infringement period, as determined by the Autorité, spanned from April 2021 through July 2023, a timeline marked by ongoing discussions about ATT’s implications for targeted advertising. Historically, these complexities have posed barriers to revenue streams for app publishers and digital advertisers. Apple rolled out the ATT tool in April 2021 with the release of IOS 14.5, prompting users to give explicit permission to track their activities across various apps and websites.
The ramifications of the Autorité’s decision may not cease at national borders, as the European Commission has also recently charged Apple for alleged violations under the Digital Markets Act, details of which can be found here. Apple’s adjustment to meet GDPR’s compliance mandates may serve as a prevention mechanism against future sanctions by EU member states.
For further details regarding the French regulator’s ruling and to assess the broader implications of this decision, access the full report from the Autorité de la concurrence here.