GoKawiilApple will change its rules on how app providers can use user data on iPhones and iPads for personalised advertising. The Bundeskartellamt objected to the way in which Apple had designed different consent requests for Apple’s own offerings and third-party apps. Apple considers its rules (set out in its so-called “Apple Tracking Transparency Framework”, ATTF) to be compliant with competition law; nevertheless, the company offered commitments which the Bundeskartellamt has now declared binding. The proceeding has thus been concluded.
Apple’s ATTF introduced rules for third-party app providers on the use of data on iPhones and iPads. For specific forms of cross-company data use, third-party app providers must obtain not only user consent under data protection law, but also additional consent through a prompt that is predefined by Apple. However, these ATTF rules do not apply to Apple’s own offerings; Apple uses user data from its own ecosystem and therefore its own prompt to request user consent to personalised advertising.
Andreas Mundt, President of the Bundeskartellamt: “ It is key that personal data and privacy are protected effectively when using apps. Apple is allowed to provide for a level of protection for its users that exceeds the minimum legal requirements. However, if Apple sets up additional rules within its ecosystem for the use of data, these rules must, under Germany’s special abuse provision for large digital companies, not treat its own offerings better than those of its competitors. This is precisely where our competition concerns arose. Apple will now align the consent requests much more closely and give third-party app providers more freedom to combine the necessary requests in a sensible way .”
Many third-party apps are, at least partly, funded through advertising. Personalised advertising can generate higher revenues for app publishers. Other apps are funded through user payments, for example for the purchase of the app or subscriptions. In these cases Apple often receives a commission, whereas Apple generally does not receive a share of the app publishers’ advertising revenue. As a general rule, personal data may in any event only be used for advertising purposes if users give their consent in accordance with the requirements of German and European data protection law.
Apple argued in the proceeding that the ATTF is meant to protect user privacy and that it is a competition law-compliant measure that also helps Apple position itself as providing a particularly high level of data protection. By contrast, the associations admitted to the proceeding, representing the branded-goods, media and advertising industries, took the view that, being a powerful gatekeeper, Apple was not allowed to set up additional, “extra-statutory” rules in the first place if these rules restrict other companies in their business activities.
In the Bundeskartellamt’s preliminary assessment, competition law generally also allows powerful companies such as Apple to take measures to protect their users’ privacy. However, the differences between the consent request used for Apple’s own offerings and the consent request predefined by Apple for third-party apps exceeded what could be justified based on differences in types of data processing. The wording, design and selection options of the request used for Apple’s own offerings had the potential to encourage users to give their consent, whereas they had the potential to discourage consent for third-party apps. In addition, third-party apps in some cases had to request consent several times even when users had already given data protection law-compliant consent.
With its operating systems and its App Store, Apple controls a key infrastructure for the distribution of apps on its devices. In addition, Apple offers its own apps and advertising space. This dual role makes Apple subject to specific competition law requirements. In the Bundeskartellamt’s preliminary assessment, there was a risk that, by setting out different rules, Apple was favouring its own offerings and impeding third-party app publishers.
Apple will modify consent prompt and simplify consent requests
Under the commitments that have now been declared binding, Apple will align the consent prompts for its own offerings and for third-party apps much more closely. This involves removing possibly discouraging symbols and wording in Apple’s predefined requests for third-party providers. The design of the consent prompts will be neutral in terms of content, wording and layout. In addition, app publishers and content providers, such as media publishers, will be given more scope to explain to users what significance personalised advertising has for their offering and their business model.
Under the commitments, Apple will also reduce the complexity of the current consent request architecture for third-party providers. In particular, app publishers will be given more freedom to combine the consent request required by Apple with the consent requests required under data protection law or connect them in a way that is clear to users. The improved conditions may also benefit advertisers and technical service providers to the advertising industry.
... continue reading