In early March, I reported on the ongoing antitrust investigation by the French Competition Authority (Autorité de la Concurrence) into Apple’s App Tracking Transparency Framework (ATTF). At the time, reports indicated that the imposition of a fine was being considered. Germany’s Bundeskartellamt (BKartA) has also raised competition concerns in a separate proceeding.
A few days ago, the French authority announced that it has imposed a fine of €150 million on Apple in connection with its practices surrounding the ATTF. The full decision is available in French, along with a presentation summarising the key points.
Background of the French proceedings
Apple introduced the App Tracking Transparency Framework in April 2021 via an update to its operating systems. It requires third-party app developers in the iOS App Store to obtain additional user consent before accessing certain types of data for advertising purposes. Apple positioned this step as a privacy measure aimed at protecting end-users of iOS and iPadOS.
In response to complaints from industry associations, the French Competition Authority launched an investigation. It suspected Apple of abusing its dominant position and favouring its own services — a form of self-preferencing also criticised by the BKartA. The complainants argued that the ATTF was designed to intentionally disadvantage third-party advertisers.
Summary of the French decision
The relevant period considered by the authority runs from April 2021 to July 2023. While this suggests that the infringement may have ceased, the BKartA’s statements indicate that it may still consider the conduct to be ongoing. In any event, the French authority also notes a continued asymmetry in how Apple treats its own apps versus third-party apps.
The authority acknowledged that user privacy is a legitimate concern. However, it concluded that Apple’s implementation of the ATTF imposed disproportionate burdens on third-party developers. The process for obtaining user consent was deemed excessively complex, and the required pop-ups undermined the neutrality of the framework. Smaller app publishers, who rely more heavily on user data, were particularly disadvantaged.
The authority identified three key issues:
- Unnecessary complexity and misalignment with data protection law (GDPR)
- Non-neutral consent pop-ups that discriminated against third-party apps
- Unequal treatment of Apple’s own apps and third-party apps
Legitimate purpose, disproportionate means
This case illustrates how competition law applies even in non-price-related platform conduct. Apple acts as a gatekeeper between users of its operating systems and the app developers who seek access to those users. The platform hosts both Apple’s own apps and those from third parties. Competition law requires that the conditions imposed on third parties remain fair and non-discriminatory.
The French authority’s assessment framework
In its press release, the authority emphasised that dominant undertakings may adopt additional consumer protection standards, but they must comply with heightened responsibilities due to their market power. This principle is well established in abuse of dominance cases. The greater the market power, the greater the responsibility to avoid harming residual competition.
The authority applied a three-step proportionality test, similar to frameworks known from constitutional or administrative law, but adapted to the private-sector context of competition law:
- Legitimacy of purpose: A dominant undertaking may pursue its own strategic goals, provided they are not anticompetitive. However, with increasing market power, the justification must meet a higher standard of plausibility.
- Necessity of the means: The measure must be appropriate and there must be no less restrictive alternative. Again, dominant firms face higher scrutiny.
- Proportionality in the narrow sense: The burden imposed on competitors must not outweigh the legitimate aim pursued.
Although such tests are common in public law, their adaptation to private platform conduct highlights the convergence of regulatory principles across different legal domains. In German jurisprudence, for example, constitutional values are sometimes used to inform competition law interpretation. Whether EU competition law is directly bound by fundamental rights remains an open legal question.
Why Apple’s implementation was deemed disproportionate
The French authority concluded that Apple’s stated aim — privacy protection — was legitimate. In this regard, it consulted the French data protection authority (CNIL), which issued two opinions. Such inter-agency cooperation is increasingly common in data-driven competition cases.
According to CNIL, the ATTF created unnecessary duplication of user consent requirements and introduced artificial complexity. The competition authority adopted CNIL’s conclusions and summarised its findings as follows:
- Unnecessary complexity: Third-party developers were subject to additional consent mechanisms not required under general data protection law.
- Non-neutral user interface: Users had to give consent twice, but could reject tracking in a single click. This asymmetry distorted user behaviour to the disadvantage of third-party apps and advertising providers.
- Discriminatory treatment: Apple’s own apps were initially exempt from the consent requirement, while third-party apps had to comply with the full consent procedure. This practice continued until iOS 15. The CNIL had already fined Apple for this discrepancy, and the competition authority also regards the asymmetry as ongoing.
The authority noted that smaller developers were particularly harmed, as they lack alternative targeting options and face additional hurdles in accessing user data.
Fines and legal consequences
The €150 million fine appears to be based on conduct up to 25 July 2023. It remains unclear whether the French authority will take further action regarding the continued differential treatment of apps. It may be that only behavioural remedies are imposed for the ongoing conduct, especially in light of the CNIL’s separate sanction.
Importantly, double jeopardy (ne bis in idem) does not apply here. Data protection and competition law violations constitute distinct legal offences, and parallel fines are legally permissible.
Apple must also publish a summary of the decision on its website for seven days.
Broader implications
It is not yet known whether Apple will appeal. Other investigations — such as that by the BKartA — are ongoing. The European Commission is also actively enforcing the Digital Markets Act (DMA). As a result, Apple currently faces regulatory scrutiny on multiple fronts. These cases probe deeply into Apple’s proprietary ecosystem and raise the broader question of how far competition law can intervene in commercial discretion.
Beyond the fine itself, the prohibition decision may have significant implications. It could serve as the legal basis for follow-on damages claims by affected parties.
We combine academic knowledge with practical experience and strategic thinking. Our firm understands both regulatory law and market dynamics. We work at the intersection of competition, data, platforms, and digital distribution—bringing clarity to complex legal environments.
