For five years the industry argued that Apple’s tracking prompt was designed to be refused. On 17 August 2026 a competition authority agreed in writing — and then did something no fine had done. It specified the fix.
Germany’s Bundeskartellamt announced that it has made a set of Apple commitments binding under Section 19a of the German Competition Act and Article 102 TFEU. The subject is App Tracking Transparency: the modal that decides whether an iOS app may use the IDFA, and by extension whether most of the mobile advertising industry can measure anything at a user level. The authority’s finding was not that ATT is illegal. It was narrower and sharper — that Apple applied a stricter, more discouraging design to third parties than to its own advertising business, and that this asymmetry is what competition law bites on.
Apple has four months from service of the 13 August 2026 decision to implement the changes in iOS and iPadOS, with beta seed testing involving publishers beforehand. The commitments run for seven years, policed by an independent monitoring trustee with dispute-resolution authority.
01What the Bundeskartellamt actually decided
Strip the procedural language and five concrete obligations remain.
Neutrality. Apple must remove potentially discouraging symbols and wording from its own predefined request, and make the prompts neutral in content, wording and layout. Trade coverage of the decision reports that this reaches the warning-hand symbol and the word “tracking” itself — the two elements the industry has complained about since 2021.
Alignment. The wording and the ordering of the options in Apple’s ATT request must be brought into line with the Personalized Ads request Apple shows for its own advertising. This is the heart of it. The authority’s objection was never that consent is required; it was that two prompts asking materially similar questions were built to produce different answers.
Publisher voice. App publishers get a Customizable Purpose String reported at up to 4,000 characters, against the one or two sentences available today, plus a second-layer text button that can link to granular settings or further information. Publishers move from a caption to an argument.
Combination. Publishers may now merge Apple’s mandatory request with their own data-protection consent flow, keep separate prompts that cross-reference each other under a twelve-month re-display rule, or run the two independently. Three lawful paths where there was one awkward one.
Duration and enforcement. Seven years, with an independent monitoring trustee. Andreas Mundt, the authority’s president, framed the principle plainly: “Users who do not wish to allow their data to be used for personalised advertising must be able to make an equally free and informed decision as users who intend to consent.” Elsewhere in the same coverage: if Apple sets up additional rules within its ecosystem, those rules must not treat its own offerings better than competitors’.
Apple’s response has been notably unrepentant: it agreed to change the text and formatting of the prompt at the authority’s request, while maintaining that ATT protects user privacy and is compliant with German competition law. Apple is not conceding the principle. It is conceding the pixels.
02A specification, not a fine — and why that’s the story
France fined Apple €150 million over ATT. Italy fined it €98.6 million. Neither produced a redesigned prompt. Germany issued no fine at all and got one.
That contrast is the actual news, and it is easy to miss under antitrust headlines. A fine prices a behaviour and lets the company decide whether the price is worth paying. A binding commitment decision specifies the behaviour, and a trustee checks the specification. For a company with Apple’s balance sheet, only the second instrument has teeth.
A fine tells you what a behaviour costs. A specification tells you what the screen has to say. Only one of those is enforceable against a company that can afford the fine.
It also creates a template. Regulators copy each other’s remedies far more readily than their theories of harm, because a remedy that has already survived negotiation with the defendant is cheap to adopt. France, Italy, Poland and the European Commission all have live or recent ATT interest, and none of them now has to design one from scratch. Whether it spreads is unknown — but the useful mental model is that this decision is less an event than a reference implementation.
03The asymmetry the decision does not remove
Here is where the analysis has to get uncomfortable, because the fix is narrower than the problem it is aimed at.
In November 2021, Eric Seufert laid out the case that ATT structurally advantaged Apple’s own ad network. His argument had four limbs: Apple treats data collected through its own store and payments rails as first-party and therefore exempt; Apple Ads reporting is granular where competitors get the coarse, delayed, partially randomised output of SKAdNetwork; Apple’s attribution lookback window was set longer than the industry norm; and competitors could not access equivalent data for opted-out users. His first proposed remedy was to standardise the consent prompt language across ATT and Apple’s own ads personalisation.
Five years later, a German regulator has ordered exactly that first remedy. The other three limbs are untouched.
And the third limb is the one that matters most operationally, because it is documented by Apple in public. Per Apple’s own attribution help pages, the AdServices attribution API uses only Apple’s first-party data and returns campaign, placement, ad group and keyword-level attribution without identifying individual users or devices. What changes with the ATT answer is narrow: when a user has asked an app not to track them, AdServices returns a standard payload without a click or impression date; when tracking permission has been obtained, it returns a detailed payload that adds the click or impression date, rounded to the minute.
Sit with the size of that difference. A third-party network denied ATT consent loses user-level attribution entirely and falls back to a delayed, bucketed postback. Apple Ads denied ATT consent loses a timestamp. Both are genuinely privacy-preserving. They are not remotely the same commercial event.
→ WHAT THE DECISION DOES AND DOESN’T TOUCH
One limb of four
The prompt design asymmetry is being fixed in one market. The first-party data exemption, the reporting-granularity gap between AdServices and SKAdNetwork or AdAttributionKit, and the attribution-window difference are all outside the scope of the German commitments. Anyone telling you this decision levels iOS measurement is overselling it.
Apple documents the resulting mess honestly, which is more than most platforms manage. Its own guidance notes that AdAttributionKit may register a click from a third-party network that AdServices is, by design, unaware of — so both the third-party network and AdServices could claim the same conversion. That overlap is not a bug in anyone’s SDK. It is the predictable consequence of two attribution systems with different visibility running over the same install, and it is the same double-counting logic we traced through paid and organic in the cannibalization piece.
04Opt-in rates: what the numbers are and why vendors disagree
Every article about this decision is going to reach for an opt-in rate. Most will pick one and present it as the number. There isn’t one, and the spread is instructive.
| Source | Figure | Data vintage | What it actually measures |
|---|
| Adjust | 35% global average | Q2 2025 | Share opting in among users shown the prompt; 34.5% in Q2 2024, 34% in Q2 2023 |
| PPC Land, reporting the German decision | 38%, up from 35% a year prior | Early 2026 | Industry opt-in rate as characterised in coverage of the case |
| AppsFlyer | 39% weighted, 26% per-app, 29% median | Q2 2021 | Authorized ÷ (Authorized + Denied), with legacy LAT users counted as denied |
Three points about that table, and none of them is “average these.”
First, the AppsFlyer figures are five years old — published as preliminary insights from roughly 550 early-adopter apps the company itself flagged as potentially unrepresentative. They are here because they are still quoted as current in a depressing number of 2026 posts. If you see 39% cited without a date, that is where it came from.
Second, the denominators differ. AppsFlyer folded Limit Ad Tracking users from earlier iOS versions into the denied bucket even though those users never saw the new prompt, which it acknowledged made its number a floor. Adjust measures among users actually shown the prompt. Averaging the two produces a figure that describes nothing.
Third, the variance within any single dataset dwarfs the variance between them. In Adjust’s Q2 2025 data, sports games opted in at 50% and education apps at 14%; by geography, Brazil 50%, UAE 49%, Turkey 42%, Canada 29%, Australia 27%. Neither breakdown includes Germany — worth saying out loud in an article about a German decision: there is no clean public German baseline to measure the redesign against. If you want one, you have to instrument it yourself, before the change ships.
4
Months Apple has to ship the redesign
7
Years the commitments bind
4,000
Characters of publisher purpose string
1
Markets covered, out of 175 storefronts
054,000 characters is a copywriting brief, not a code change
The most actionable item in the whole decision is also the least discussed. Publishers reportedly move from one or two sentences of pre-prompt explanation to a Customizable Purpose String of up to 4,000 characters, plus a second-layer button linking to granular settings or additional information.
Four thousand characters is roughly 600 words. That is not a permission string — it is a landing page inside a system modal, and it will be won or lost by writing rather than engineering. Most teams will paste in their privacy policy summary and wonder why nothing moved.
The teams that gain will treat it as conversion copy and test it, because the second-layer structure implies a two-stage flow with a measurable drop-off between the stages. Things worth varying: whether you lead with what the user gets or what you lose; whether you name a specific benefit or make a general appeal; whether the second layer carries granular controls or reassurance. That is the discipline of custom product page testing, applied to a surface nobody has been allowed to test before. One caution: a longer field is also a longer rope, and overclaiming is a compliance exposure in a market that just demonstrated it reads Apple’s screens closely.
→ FREE 10-POINT AUDIT
Find out how much of your iOS spend depends on the prompt
We open your Apple Ads account, separate the measurement that survives an ATT denial from the measurement that doesn’t, and show you where your reported ROAS is actually coming from. One hour. Senior strategist. No pitch.
Book my free audit →
06Why this lands hardest where the money is
Consent economics are not evenly distributed. A lost IDFA costs you in proportion to what the user was worth, which is why the same regulatory change is a footnote for one business model and a strategy meeting for another.
On iOS that skew is extreme. Sensor Tower’s State of Mobile 2026, covering 2025, puts combined App Store and Google Play consumer spend at $167 billion against 149 billion downloads — and the store split of that spend is famously lopsided in Apple’s favour while the download split runs the other way. We derived the per-download consequence in the ARPU piece, and the direction is not in dispute even where the exact multiple is: an iOS download is worth several times an Android one in consumer spend. Derived figure — the per-download ratio is a division of two published aggregates, not a reported statistic, and it moves with whichever store-spend source you use.
Two consequences follow for anyone reading this decision.
The first is that measurement loss is most expensive precisely where users are most valuable — the same structural trap we called the expensive-user paradox. Every percentage point of opt-in is worth more on iOS than the equivalent point anywhere else.
The second is the one that matters for media planning. Buying declared intent on the App Store does not route through the ATT prompt at all. When a user types a query into App Store search and taps your ad, the intent is stated rather than inferred, the auction is at the point of decision, and the attribution — campaign, ad group, keyword, placement — arrives from Apple’s first-party rails regardless of what that user told the tracking modal. That is not a loophole to exploit; it is a structural property of the channel, and it is why Apple Ads has been the least turbulent line in an iOS media plan through five years of measurement upheaval.
It is also why “does this hurt Apple Ads?” is the wrong question. If German opt-in rises, third-party measurement there improves and Apple’s stays where it was — a narrowed relative advantage, not an absolute loss. For scale on the base being defended: Services revenue of about $30.7 billion in the June 2026 quarter, up 12% year over year, with the CFO citing a June-quarter record in advertising. Apple still discloses no advertising revenue line item, so nobody outside Cupertino can size the exposure precisely.
07The four-month plan for iOS growth teams
None of the following requires knowing how the redesign lands, which is the point — they are all things that pay off under either outcome.
1. Instrument the German cohort separately, this week
You have roughly four months to establish a pre-change baseline, and no public German opt-in benchmark exists to borrow. Split ATT authorisation status by storefront in your own analytics now. If you wait until the prompt changes, you will spend the following year arguing about what your before looked like.
2. Draft and test the long purpose string before you need it
Treat 4,000 characters as a creative asset with a brief, not a legal field. Write three versions, decide in advance which metric you are reading, and have them reviewed by whoever signs off your store copy. The engineering work here is trivial; the writing work is not, and the writing work is the part with lead time.
3. Audit which of your reported numbers survive a denial
Take a live campaign and ask, mechanically, what remains in reporting if every user in it denies ATT. For Apple Ads: campaign, ad group, keyword and placement attribution remain; the timestamps do not. For a typical third-party network, you fall back to postback-level data. Teams are routinely surprised by how much of a dashboard rests on the consented minority — and by how differently that minority is composed across channels.
4. Do not rebuild your stack around a lift that hasn’t happened
There is no published estimate of how much German opt-in will move, because there is no precedent for this remedy anywhere. The prompt could get materially friendlier and users could keep declining — the premise of the decision is that people should be able to refuse freely, and many will. Budget for a change in signal quality, not a return to 2020.
5. Keep the intent channel weighted
Through the terms rewrite, the creative-asset policy and now a consent-design order, App Store search has been the least disturbed part of an iOS plan — for a structural reason rather than a lucky one. If your allocation drifted away from it, this is a reasonable quarter to revisit that, alongside the API migration deadline, the other fixed date on the 2027 calendar.
08What nobody knows yet
An honest list, because the confident version of this article would be wrong in a month.
- The redesigned prompt has not been seen. Four months from service is a deadline, not a ship date, and beta seed testing with publishers comes first. Every mock-up circulating now is speculation.
- No German opt-in baseline is public. Neither of the major vendor benchmark sets breaks out Germany. Any before-and-after you read next year will be built on somebody’s private data.
- Scope beyond Germany is unresolved. Apple has not committed to a single global prompt design, and it has said it considers the existing design compliant. A shipped-everywhere outcome is plausible on engineering-simplicity grounds and entirely unconfirmed.
- The interaction with the July 2026 terms rewrite is unmapped. If Apple ads can be delivered on non-Apple surfaces, which consent regime governs the data behind them? We raised this in the terms analysis and it is still open.
- Apple discloses no advertising revenue. Every estimate of what ATT is worth to Apple’s ad business, in either direction, is modelled from outside.
- SKAdNetwork 5 never shipped. Any roadmap that assumes it is planning against a product that does not exist.
09The takeaway
The Bundeskartellamt did something more consequential than fine Apple: it wrote down what the screen has to say and appointed someone to check. That is a genuinely new instrument, it applies to one market, and it addresses one of the four asymmetries the industry has been complaining about since 2021.
For iOS growth teams the practical read is unglamorous. Nothing about your bidding changes this quarter. The near-term work is baseline instrumentation and 600 words of persuasive copy, and the near-term risk is over-modelling an opt-in lift that has not been measured anywhere. Meanwhile, the part of your media plan that runs on declared intent at the point of decision keeps working exactly as it did — not because it dodged the regulation, but because it never depended on the prompt in the first place.
The channel least disturbed by five years of consent upheaval is the one where the user tells you what they want before you have to guess.
Watch Germany. Instrument it. Don’t rebuild for it yet.