Apple's Privacy Popup Was Awfully Quiet About Apple's Own Apps

You know the popup. You open a new app on your iPhone and it asks whether you’ll let it track you across other companies’ apps and websites. Most people tap “Ask App Not to Track.” Now try to remember the last time Apple’s own apps showed you that box. Germany’s competition regulator has spent years on exactly that question, and it just landed on an answer Apple won’t like.

What the popup actually does

App Tracking Transparency shipped with iOS 14.5 in April 2021. The rule is simple: if an app wants to follow you outside its own walls, it has to ask first. Hard to argue with the premise. The ad industry had been doing this quietly for a decade, and ATT dragged it into daylight.

The consequences were less tidy. Industry estimates put opt-in rates somewhere in the 20–30% range, and anyone whose business depended on cross-app targeting took the hit. Meta said publicly that ATT would cost it roughly $10 billion in a single year. But ad budgets don’t evaporate — they relocate. A meaningful chunk of that money landed in Apple’s own advertising platform, which grew from a rounding error into a multibillion-dollar business over the same stretch.

Germany’s complaint isn’t the rule. It’s the exemption.

The Bundeskartellamt — Germany’s Federal Cartel Office, and probably the most aggressive tech regulator in Europe that isn’t the European Commission — didn’t say ATT is bad. It said the same rule applied differently to Apple.

Third-party developers had to fire the popup and collect consent even to connect data between two apps they themselves owned. Apple, meanwhile, pooled data across the App Store, Apple Music, Apple News and the rest of its services, fed it into Apple Advertising, and never triggered the same prompt. Apple’s defense: data moving between Apple apps isn’t third-party tracking, because there’s no third party.

That’s a defensible reading of Apple’s own privacy definitions. It’s a much worse reading under competition law. Germany amended its competition act in 2021, adding Section 19a — a mechanism to designate firms of “paramount significance for competition across markets” and subject them to tighter rules. Apple got that designation in 2023. For designated firms, self-preferencing isn’t something a regulator has to prove is harmful case by case. It’s prohibited more or less on sight. Which means the nobility of your stated motive doesn’t do much work. If you write the rule and then route around it, you’re exposed.

Privacy is a very good shield, which is the problem

Here’s what makes this case genuinely tricky. Privacy protection is close to unfalsifiable as a public argument. Nobody wants to be the party arguing against user privacy.

So the regulators didn’t argue against it. They asked a narrower question: if this principle is important enough to impose on 30 million developers, why wasn’t it important enough to impose on yourselves? Framed that way, the privacy rationale turns on its owner. If Apple’s answer is that its data stays inside Apple, then from the user’s seat, the total volume of tracking didn’t drop nearly as much as the popup implied. It got consolidated.

France got there first. In March 2025 the Autorité de la concurrence fined Apple €150 million over ATT, focused on the design of the consent flow rather than the policy itself: third-party apps effectively had to clear two consent screens while Apple’s own surfaces cleared one. If you’ve ever run an acquisition funnel, you know what one extra click does to conversion. That was the whole case, and it worked.

What developers and users actually get

A regulatory win doesn’t automatically translate into relief for anyone building apps. Remedies here tend to collapse into two options: Apple starts showing the same popup for its own data, or Apple loosens the requirement for everyone else.

Option one hits Apple’s ad business alongside everyone else’s — fair, but a net loss all around. Option two gives developers breathing room and quietly dilutes the tracking protection users spent five years getting used to. Privacy and competition aren’t natural allies here. They’re pulling in opposite directions, and a regulator can’t optimize for both at once.

There’s a structural point worth sitting with. ATT didn’t kill targeted advertising. It restructured it. Once individual-level tracking got hard, the advantage shifted to whoever already held enormous first-party data and a logged-in user base — Apple, Amazon, Google, the walled gardens. Small ad-tech firms and independent publishers absorbed the damage. A privacy rule made the biggest players bigger. That inversion is precisely why competition authorities showed up late to a policy everyone initially applauded.

The takeaway

This isn’t a story about Apple faking its privacy convictions. It’s a story about what happens when a platform writes the rules and competes under them at the same time. The referee doesn’t have to cheat for the game to tilt.

Watch what Apple does next. It can attach the popup to its own apps, or it can quietly redefine what counts as third-party tracking. One of those treats privacy as a principle. The other treats it as an instrument. And if that prompt does start appearing over Apple News — be honest, would you tap Allow?