Germany didn't ban Apple's tracking prompt. It banned Apple from writing itself a better one.

The headline going around is that Apple has agreed to soften a privacy pop-up after a German investigation, which makes it sound like housekeeping — a wording change, a nicer button, a regulator placated. That is the reported version. The binding version, set out this week by Germany's Federal Cartel Office, is narrower in language and far larger in consequence: Apple has given enforceable commitments to redesign the consent screens that govern app tracking on every iPhone and iPad in the European Union, and it has roughly four months to do it. The subject was never whether users see a prompt. It was who gets to design the prompt, and in whose favour.

The proceeding ran under Section 19a of Germany's competition act, which is a specific and unusual tool. It lets the Bundeskartellamt act against a small number of companies it has formally designated as being of 'paramount significance for competition across markets' — Apple is one of them — and, crucially, it lets the authority prohibit self-preferencing by such a firm without first fighting through the years of market-definition argument an ordinary abuse case demands. The office opened its look at App Tracking Transparency in 2022 and issued formal objections in early 2025. The standard it applied is the thing to hold onto: not 'is tracking bad,' but 'is Apple applying one rule to itself and a stricter one to everyone else.'

What the text actually objected to

The operative complaint is a design asymmetry, and it is worth stating precisely, because the summaries will not. Under App Tracking Transparency, a third-party app that wants to track a user across other apps and websites must show Apple's prompt — the one that offers 'Ask App Not to Track' as the prominent choice — and must separately collect the consent it already owes under European data-protection law. Two dialogs, two chances to decline, measurable drop-off at each. Apple's own advertising and data combination, the authority found, did not pass through the same barrier in the same way. Same activity, two different consent architectures, and the more punishing one reserved for Apple's competitors in the market for advertising. That is the textbook shape of self-preferencing: not a falsehood, but a thumb on the scale built into the interface.

The question was never whether tracking is bad. It was whether Apple may write one consent screen for its rivals and a friendlier one for itself.

The commitments track that objection clause for clause. Apple will align the consent requests for its own services with those it imposes on third-party apps, so the design and the wording no longer diverge in Apple's favour — which, in the authority's own framing, removes the incentive to load discouraging language into a prompt only rivals are forced to show. And app publishers will be allowed to combine the consent Apple mandates with the consent they are separately required to gather under data-protection law, collapsing the two-dialog gauntlet into one. That second change is the load-bearing one. It gives back the click the double prompt was quietly taxing — the opt-in that never happened because the user gave up at the first of two near-identical screens.

In force is not the useful question. Enforced is.

Here is the distinction the reporting keeps losing. These are not suggestions Apple has agreed to weigh. Under Section 19a they are binding commitments the Bundeskartellamt can enforce, and Apple offered them to close the case rather than litigate toward a prohibition it was likely to lose. The deadline is the other detail the summaries omit and the one that actually binds: Apple has committed to roll the redesign out across the EU over the coming months, not to publish a statement of intent. A commitment with a date is a different legal instrument from a principle with a press conference. When people ask whether a rule like this is 'in force,' they are asking the wrong question. It is in force. The load-bearing question is who is bound, to do what, by when — and here the answer is Apple, to a specific redesign, on a clock that has already started.

Why a decision in Bonn changes the screen in every EU country

Now the second-order effect, which is why a ruling from a national authority in Bonn deserves a technology reader's attention well outside Germany. Apple will not build a special consent flow for one member state. It has committed to change the design across the entire Union, because maintaining a separate tracking-consent architecture for Germany alone is more expensive and more legally exposed than simply adopting the stricter standard everywhere. This is the mechanism usually called the Brussels Effect, except the pen this time sits in Bonn: a national regulator sets a term, and a company that ships one product to one market propagates that term to every user it cannot be bothered to treat differently. For the same unglamorous reason, the redesign is unlikely to stop cleanly at the Union's border. It is cheaper to build one compliant screen than to maintain many.

The privacy defence, and its limit

There is a real tension here, and Apple has leaned on it for years. App Tracking Transparency was presented, not implausibly, as a privacy feature — a way to let users refuse the surveillance that funds much of the mobile-app economy. The advertising industry loathed it, and some of that loathing is simply the sound of the feature working as intended. The Bundeskartellamt did not rule that ATT is bad for privacy, and nothing in the commitments forces Apple to stop asking users about tracking at all. What the authority said is narrower and sharper: a company may pursue privacy, but a dominant company may not design its privacy mechanism so that the friction lands on its competitors and not on itself. Privacy is a defence to a great many things. Under Section 19a, it is not a defence to self-preferencing.

Who is bound, who gains

So it is worth being exact about who this binds and who it helps. Apple is bound — to a redesign, on a deadline, EU-wide, under threat of enforcement. The immediate beneficiaries are the third-party advertising and app businesses whose opt-in rates were suppressed by a consent flow their products were forced through and Apple's were not; the plausible result is a measurable rise in tracking consent for precisely the companies ATT was accused of disadvantaging. The user's position is more ambiguous, and honest coverage should say so. Aligning the prompts and merging the dialogs may lift opt-in rates exactly because friction, whatever its motive, was also depressing consent that some users, offered a cleaner path, will now grant. A fairer prompt is not automatically a more private outcome. It is a more competitively neutral one — which is what a competition authority is empowered to deliver, and all it claimed to.

The durable consequence is that the consent prompt is now a regulated competitive surface, not merely a privacy artefact, and every dominant platform designer should read the file that way. The same principle — you may set a rule, but not one you quietly exempt yourself from — is the animating logic of the EU's Digital Markets Act, which polices self-preferencing across the largest platforms on a continental scale, and the German case will feed directly into how that larger instrument is read and enforced. Apple can keep asking whether an app may track you. What it can no longer do, in the market that writes the defaults for much of the world, is make that question harder to answer 'yes' for everyone except itself. The reported story was a softened pop-up. The binding story is that the interface has been pulled inside the reach of competition law, and the clock on the first redesign is already running.