Apple has been ordered to stop designing data collection consent prompts that steer users away from third-party apps, following a ruling by Germany's Federal Cartel Office. The decision marks the latest front in a regulatory crackdown on the company's App Tracking Transparency (ATT) system, which critics say gives Apple's own apps an unfair advantage.

The German regulator accused Apple of creating prompts that discourage users from allowing cross-app tracking by third-party developers, while simultaneously encouraging consent for Apple's own data collection. This behavior, the office argues, violates the European Union's Digital Markets Act (DMA), under which Apple is designated as a "gatekeeper" and is required to provide a level playing field for all apps.

The ATT Controversy

App Tracking Transparency was introduced with iOS 14.5 in 2021, requiring apps to ask users for permission before tracking them across other apps and websites. While the feature was widely praised as a privacy win for consumers, it had a devastating impact on the advertising industry. According to reports, social media apps like Facebook and Snapchat lost nearly $10 billion in ad revenue in the months after the prompts launched, as most users declined tracking.

Apple has defended ATT as a tool to empower users, but regulators have questioned whether the design of the prompts is neutral. The German investigation found that the wording and placement of the prompts were not impartial, effectively discouraging users from opting in to third-party tracking. In contrast, Apple's own apps are not subject to the same prompt, naturally benefiting from this asymmetry.

"The specific design of the consent prompts steers users away from agreeing to let third-party apps use their data, while encouraging them to give consent for Apple's own services," said a spokesperson for the Federal Cartel Office.

Broader DMA Non-Compliance

The German order is part of a wider pattern of scrutiny under the DMA. In a related development, the European Commission has been investigating Apple and Meta for potential non-compliance with the landmark regulation. TechPolicy.Press recently analyzed the decisions, highlighting that both companies have been found wanting in their obligations to ensure fair competition in digital markets.

For Apple, the core issue remains its control over the iOS ecosystem, particularly its App Store policies and data access rules. The DMA requires gatekeepers to allow business users to access data generated by their activities and to refrain from using data obtained from third-party business users to compete against them. Apple's ATT prompts have been seen as violating this principle by disadvantaging competitors.

Meta, meanwhile, has been scrutinized for its "pay or consent" model, which forces European users to either agree to personalized ads or pay a subscription fee to use Facebook and Instagram. Regulators argue this creates an unfair choice, echoing the same concerns raised about Apple's prompts.

Apple's Proactive Move: Age Verification in the UK

In a separate but related development, Apple has quietly rolled out age verification features in the UK as part of iOS 26.4. The move comes just after Meta and Google were fined for failing to protect minors on their platforms, signaling that Apple is trying to stay ahead of the regulatory curve on child safety.

The age verification system is designed to restrict access to age-inappropriate content and apps, aligning with the UK's Online Safety Act. While Apple has not confirmed the exact details, the feature likely leverages on-device intelligence and parental controls to verify age without compromising user privacy. This proactive step contrasts sharply with the fines levied on competitors, and may be part of Apple's broader strategy to position itself as a privacy-first company.

What About Passcode Controls?

Amid these regulatory battles, Apple also continues to offer users granular control over their device security. For example, a popular guide on OS X Daily explains how to disable the passcode on an iPhone or iPad, giving users full autonomy over their own devices. While seemingly unrelated, this focus on user control is part of Apple's marketing narrative—and one that regulators are now probing for potential anti-competitive abuse.

Implications for Users and Developers

For users, the German ruling could lead to more balanced consent prompts, giving them a clearer, neutral choice about data tracking. For developers, it could mean a level playing field in the app economy, though the $10 billion question remains: will they be able to recover lost ad revenue if more users opt in?

The broader DMA enforcement is also a warning to all tech giants: the era of self-preferencing is coming to an end. As regulators sharpen their tools, companies like Apple and Meta are being forced to rethink their business models—not just in Europe, but potentially globally.

Apple has not yet publicly responded to the German order, but sources suggest it may appeal. The company has until the end of the month to submit a revised version of the ATT prompts.

In the meantime, the European Commission is expected to issue final rulings on the non-compliance cases against Apple and Meta in the coming months. The decisions will have far-reaching consequences for the digital advertising industry and set a precedent for how gatekeepers operate in the EU.

As the battle over data consent heats up, one thing is clear: Apple's privacy-centric image is being put to the test, and the outcomes will shape the future of mobile privacy for years to come.