Consent on iOS: The End of Apple's Double Standard

In August 2026, Germany's competition authority forced Apple to rework its ATT prompt. Starting with iOS 27.2, apps distributed in the EU can show a neutral screen with symmetrical buttons, combine ATT with their CMP, and ask users again one year after their last answer. The new prompt is mandatory in France, Germany, Italy, Poland and Romania.

Since iOS 14.5 shipped in April 2021, giving consent on an iPhone in Europe has felt like an obstacle course. Two consent screens in a row (the CMP, then the ATT prompt) got in the way of the user experience. France's data protection authority, the CNIL, called the setup “unnecessary and artificial complexity”, and ad tracking on iPhone collapsed. On August 17, 2026, Germany's Bundeskartellamt blew the whistle and forced Apple to rewrite its prompt in Germany. Apple is now extending that redesign across the European Union.

1. Why did consent on iOS require two screens?

Before April 2021, Apple's advertising identifier (the IDFA) worked on an opt-out basis. Publishers could measure campaign performance and target audiences, unless users went digging in their settings to turn tracking off.

The App Tracking Transparency (ATT) framework, launched with iOS 14.5, flipped that logic overnight: tracking now required an explicit opt-in. In the United States, where there is no federal equivalent of the GDPR, ATT became the one and only consent step. Europe was a different story.

For European publishers, the problem was stacking. To comply with the GDPR, apps already had to show a consent banner, run by a consent management platform (CMP). By adding its own screen on top, iOS made users answer two pop-ups in a row for the same app. The result was textbook consent fatigue.

In a May 2022 opinion to France's competition authority, the CNIL criticized this double request as “unnecessary and artificial complexity” (our translation). Apple was also playing by two sets of rules: third-party publishers faced this double hurdle in Europe, while Apple used a single “Personalized Ads” prompt for its own services.

2. How did Europe crack down on Apple's nudging?

Beyond the number of screens, the real trap was nudging: steering users' choices through design and wording. In the original ATT prompt, everything pushed toward “no”, from the prominent reject button to the warning hand icon and the repeated use of the word “track”, chosen precisely because it makes the average user uneasy.

European regulators moved fast. France's Autorité de la concurrence opened with a €150 million fine for abuse of dominance in March 2025, followed by Italy with €98.6 million in December 2025. The final act came on August 17, 2026, when the Bundeskartellamt made Apple's commitments binding for seven years, under the supervision of an independent trustee.

3. What changes with the new ATT prompt?

The commitments replace the punitive warning with a neutral interface. The word “track” and the warning hand are gone, replaced by a full-page sheet with two strictly symmetrical buttons, one to accept and one to reject. In the EU, the matching iPhone setting is also renamed “Allow Apps to Request to Link Your Activity Across Companies”.

Publishers mainly gain a customizable text area of up to 4,000 characters to explain the benefits of sharing data (the limit comes from the German commitments and does not yet appear in Apple's documentation). They can also ask users again one year after their last answer, whether they accepted or rejected.

4. How do you combine ATT and your CMP? The three options

The August 17, 2026 decision sets out three technical options for collecting permissions in apps.

Legally, a refusal in the CMP always comes first. If a user rejects all relevant purposes on the first GDPR screen, the app must not trigger the ATT prompt, and the IDFA stays locked.

5. When does the new ATT prompt become mandatory?

Announced on September 16, 2026, the alternative prompt ships with the first beta of iOS and iPadOS 27.2. It is optional across the European Union and mandatory for apps distributed in France, Germany, Italy, Poland and Romania.

This change to ATT leaves GDPR obligations untouched. Getting a “yes” on Apple's interface does not replace valid consent for processing personal data.

One big question remains open. Apple still exempts its aggregated attribution frameworks, SKAdNetwork and AdAttributionKit, from consent, and both are open to every advertiser. The clearer asymmetry lies elsewhere: Apple Ads campaigns report their data through the AdServices API, a channel third-party ad networks don't get. Given how strictly regulators view tracking without the IDFA, this is one to watch.

6. What should mobile teams do now?

iOS 27.2 means your consent collection strategy needs an update.

The first priority is to measure your current drop-off between CMP and ATT, so you know what a switch could actually gain. Then pick an option, and start drafting your 4,000-character explanation with your DPO.

Our take at Smart Bees: go for option 1, the combined prompt. On the UX side, users see one screen instead of two, which cuts consent fatigue. On the tracking side, one consent flow means one collection point to instrument, fewer states to reconcile between CMP and ATT, and QA that stays far easier to maintain over time.

Two caveats, though. First, whatever you show behind the “Additional Information” button is your legal responsibility, so get the copy signed off by your DPO. Second, a visit to that screen returns a notDetermined status until the user comes back and answers in the ATT sheet. Plan for it in your tracking plan and in your MMP setup, or those detours will show up as drop-offs.

On the technical side, caution still applies. Apple published its documentation on September 16 (a new authorization request with an expanded interface, and an Info.plist key that accepts Markdown), but iOS 27.2 is still in beta: wait for the final release before locking in heavy development work.

Sources: Bundeskartellamt, press release of August 17, 2026; Apple Developer, “Updates to App Tracking Transparency in the European Union”, September 16, 2026; Autorité de la concurrence, decision 25-D-02, March 2025; Apple Developer, “User Privacy and Data Use”, section “ATT in the European Union”.