France Fines Apple Over App Tracking Transparency
Apple was hit with a 150 million euro ($162.4 million) fine by French antitrust regulators on Monday for abusing its dominant position in mobile app advertising on its devices via a privacy control tool.
[…]
“While we are disappointed with today’s decision, the French Competition Authority has not required any specific changes to ATT,” Apple said in a statement.
Coeuré told reporters the regulator had not spelled out how Apple should change its app, but that it was up to the company to make sure it now complied with the ruling.
Both advertisers and developers of free ad-funded apps complained loudly at the impact of ATT, as it was estimated that it would cost social media companies alone tens of billions of dollars.
Complaints were made in a number of countries – some arguing that it was unfair because Apple exempts its own apps (which are in reality subject to even tighter controls), others saying the loss of revenue forced developers to raise prices to compensate.
The intent of ATT “is not problematic in terms of the likely benefits for users as regards privacy protection,” but “how the framework is implemented is abusive within the meaning of competition law,” the agency said. Apple’s “implementation methods artificially complicate the use of third-party applications and distort the neutrality of the framework to the detriment of small publishers financed by advertising,” it said.
Third-party publishers “cannot rely on the ATT framework to comply with their legal obligations,” so they “must continue to use their own consent collection solution,” the French agency said. “The result is that multiple consent pop-ups are displayed, making the use of third-party applications in the iOS environment excessively complex.”
[…]
The agency said there is an “asymmetry” in which user consent for Apple’s own data collection is obtained with a single pop-up, but other publishers are “required to obtain double consent from users for tracking on third-party sites and applications.”
[…]
Apple said in a statement that the ATT “prompt is consistent for all developers, including Apple[…]”
Is this actually true? It sounds like when Tim Cook told Congress that Apple’s own apps have to follow the same guidelines as third-party apps. I don’t think I’ve ever seen an Apple app display the “Allow ‘App’ to track your activity across other companies’ apps and websites?” prompt. Apple has defined tracking in such a way that it doesn’t count if you own the app store, so why would they ever show that prompt? I have seen Apple apps show different prompts, and the French Competition Authority includes a screenshot of one.
Because the ATT prompt does not allow developers to specify which third-parties are receiving tracking data, developers must include a second opt-in screen that provides more details about how their data will be used. This is fairly granular — arguably too much — but Apple’s version lacks detail. If a user agrees to third-party tracking, is their consent fully informed if they do not know with which advertisers their information is being shared, or even how many? I am not sure they do.
They also seemed to disagree with how Apple defines tracking. German regulators are also interested in what amounts to self-preferencing, even if that is not Apple’s intent. The authority has not yet published the text of the decision, which will hopefully answer many of the questions I have.
One thing I am curious about is how the regulator reconciles Apple’s apparently “not problematic” attempts at improving user privacy with the callous disregard toward the same shown by ad tech companies. Trade groups representing those companies, including the French offices of the IAB and MMA, were among those who filed this complaint. Both trade groups are loathsome; their inability and failure to self-govern is one reason for this very privacy legislation. Yet Apple’s particular definition of “tracking” is something only relevant to very large platform operators like itself. There is very clearly a conflict of interest in Apple trying to apply these kinds of policies to competitors, especially as Apple expands its ads business.
It’s ostensibly “not necessary” because French and EU privacy laws are supposedly enough, and all that’s needed. And it’s unfair because now, under ATT, third-party surveillance advertisers who seek to track users across apps on iOS need to ask permission twice — first through the clear-as-a-bell “Ask App Not to Track” / “Allow Tracking” prompt required by Apple, and again through the byzantine but ultimately toothless permission requirements of France and the EU. ATT has had measurable effects because users understand it, and they prefer not to be tracked. EU and French privacy laws are largely ineffective because, in practice, they bury users with confusion.
I’m not sure these last two sentences are really true, as Heer also discusses.
Previously:
- Apple Under German Antitrust Scrutiny
- French Court Fines Apple Over Abusive App Store Practices
- French Publishers Make App Store Antitrust Complaint
- German Antitrust Probe Into App Tracking Transparency
- Plenty of Tracking Despite App Tracking Transparency
- More Users Opting in to App Tracking
- Facebook Blames Apple, Usage Declines
- Expectations When Opting Out of Tracking
- App Tracking Transparency Helps Apple’s Ads
- App Tracking Transparency Doesn’t Stop Trackers
- Does Apple News Track You?
- France to Take Legal Action Against App Stores
3 Comments RSS · Twitter · Mastodon
What are we discussing here, in hallowed tones? The unenforced self reporting of the app store privacy tags?
I want to swear in capitals, but what is the point? Apple (as well as others) are liars and thieves, it is writ large. MOST, the majority of, software developers are prone to lie and steal. Fact. It's just too easy and rules are vague, weak, and unenforced, plus, they're only human. so...
So with regards to GDPR there are the common misconceptions to deal with. The EU has NOT mandated the ghastly horrible and intentionally confusing pop-ups. Those are made by companies who want to trick people into giving away their data.
They were way too tricky, a bunch of them got hefty fines and they are getting better and better. Not sure why you guys in the US get to see these? I don't believe you get any protection under GDPR any ways...
GDPR is not ineffective but sure... the EU could have mandated one solution for all and that would have led to an Apple style solution. I'm sure plenty of people prefer having less freedom but I like the way the EU is doing it.
Visit this site and tell me if that was confusing. They are all headed that way. https://www.eutelsat.com/en/home.html
