France fines Apple €150M for “excessive” pop-ups that let users reject tracking

https://arstechnica.com/tech-policy/2025/03/france-fines-apple-e150m-for-excessive-pop-ups-that-let-users-reject-tracking/

by sebastian_z • 1 year ago

250 196 1 year ago

arstechnica.com

nottorp2• 1 year ago

Actually Apple were fined because they don't apply the same standard to their own pop-ups that allow users to reject tracking. On Apple popups you seem to need one click, while on 3rd party popups you need to confirm twice.

So the fine seems to be for treating 3rd parties differently from their own stuff.

They could make their own popups require double confirmation instead...

bredren• 1 year ago

The agency said there is an "asymmetry" in which user consent for Apple's own data collection is obtained with a single pop-up, but other publishers are "required to obtain double consent from users for tracking on third-party sites and applications."

gruez8• 1 year ago

What's even the "double confirmation" that's required?

1. the ATT permission prompt from iOS

2. a prompt from the app itself

refulgentis6• 1 year ago

Yes

ezfe• 1 year ago

Right, but that second click isn't coming from Apple and they can't control it. The article specifically says that many apps feel like they need additional consent which means they have to request it through two channels.

If Apple doesn't feel like they need additional consent and/or doesn't use ATT-blocked systems then they don't need that.

This is stupid.

leereeves• 1 year ago

The article specifically says that many apps feel like they need additional consent

Are they right about that? Does Apple provide the app with confirmation that the user consented, and if they do, is it legal to rely on that confirmation?

bilbo0s2• 1 year ago

Right.

I'm not sure this is fixable?

Or maybe there is widespread misunderstanding of the requirements in this scenario? But I also thought the rule was tough enough to require verifying that extra consent? Maybe it's not?

Truly confused here.

maccard4• 1 year ago

The article specifically says that many apps feel like they need additional consent which means they have to request it through two channels.

Surely the same argument can be applied to the cookie law - many sites feel like they need consent therefore it's unfair over people who think they only need one prompt.

crazygringo4• 1 year ago

I'm genuinely confused. Where's the double part?

When I install an app I get a single popup asking whether I want to share with advertisers or not.

I don't have to do anything twice.

Is it different in Europe or something? Is there a second popup there, and if so, what?

tarentel• 1 year ago

I'm assuming there are additional GDPR compliance asks in Europe when using apps. If that's the case I don't see how that is Apple's fault. I wish this article was a bit better but after reading a few of them I still don't get what the actual complaint is.

AlanYx• 1 year ago

This is for system-level permissions. In third-party apps, the app asks whether you want to enable X permission and then you get an OS-level confirmation request. It's not just in Europe.

Likely they'll fall back in Europe to double-prompting as well in system apps.

tedunangst3• 1 year ago

I'm actually okay with the Apple Camera app asking me once and the Domino's Pizza app having to ask me twice. Who are the consumers being harmed here?

pests2• 1 year ago

Domino's?

arrosenberg3• 1 year ago

It's anti-competitive. Apple owns the platform and is giving preference to it's own apps on that platform. Every non-Apple app that competes with an Apple app is harmed.

surgical_fire3• 1 year ago

It doesn't really matter if you are "fine" with their anti-conpetitive behavior. They should comply to regulations properly.

burnte2• 1 year ago

You might be ok with it, but the regulators want Apple to treat third parties the same way they treat their own apps, and that's a good thing. Either everyone would generate two prompts, or no one, but excluding yourself is just favoritism.

llm_nerd• 1 year ago

The Camera app wouldn't need an ATT confirmation, of course. Apple has some other products which do feature targeted advertisements, including News and even the App Store itself.

Apple created this problem for itself when they decided that they wanted to double dip and become advertisers (while conveniently making advertisement less effective for everyone else). The amount they net from it surely can't be worth the trouble is causes. It's also simply scummy and always puts conflicting interests at play.

Still don't understand the two versus one confirmation thing. I have tracking entirely disabled so apps can't even request it, but it'd be nice to see some workflow of how Apple's tracking works versus everyone else. The complaint almost seems that Apple apps simply do track your details and use them for targeting, without any confirmation (which Apple argues is okay because there is no third party getting the deets), where others have to do the confirmation.

golli• 1 year ago

And if it weren't a dominos app, but an otherwise identical or better third party app? Which through this now has a disadvantage compared to Apples app. Making it worse (regardless of how small or large that downside is) compared to whatever Apple offers, not because of having the worse product in the category, but because Apple also happens to own the otherwise unrelated operating system.

st3fan2• 1 year ago

I don't think the Camera app asks for permission to use the Camera.

You could argue that choice is questionable because Apple needs to follow its own rules, but also .. it is the Camera app. I think if you don't want the Camera app to use the Camera you probably should not have opened the app at all.

ATT (App Tracking Transparency) is the dialog that says something like "Facebook would like permission to track you across apps and websites owned by other companies. Your data will be used to ... $AppProvidedExcuseHere." with "Allow Tracking" and "Ask App Not To Track" buttons.

ATT is the First consent.

The SECOND consent this case is about is the in-app consent that needs to happen according to French law. I can't give an example of that because I do not live in France but I assume this is probably some horribly designed page inside a French app that asks you to share your data with the ad surveilance industry.

johnnyanmac8• 1 year ago

it's not the consumers, it's the competitors. Instead of comparing apples to pizas, compare something like the Notes app compared to a 3rd party notes app. Any web/app dev knows each extra click adds friction and reduces retention, so that extra pop up can be a subtle advantadge to the one who manages the platform.

aiauthoritydev• 1 year ago

The pen pushers in France. As a consumer your choice does not matter much as much as the government servants who have decided that they know what is good for you.

wdr1• 1 year ago

Are you also okay with Apple only asking once for Apple Advertising and making other advertising ask twice?

I don't mean ads for Apple products. I mean the ads that Apple sells in News, the App Store, where they track your behavior to personalize the ads you see and to see if you ever buy what the ad is selling.

sitkack4• 1 year ago

You should decide for everyone whether Apple gets a pass.

octacat• 1 year ago

Apple has its own trackers and ad services. But it treats itself specially. While other apps need to ask. Maybe I don't want some apps from apple to have the same permissions, as other apps from apple. It is basically bundling. I agreed for one app from apple to share data, not for all apps from apple. Oh, and don't let me start about wording they use on these pop-ups... Like when I download some app from the internet, which is signed, notarized and so on, it still asks: oh, you downloaded this app from the internet (surprise!)... Instead of: "ok, you downloaded from internet, it has sign, notarification, developer is already delivering software for 10 years and have 20 million users, so looks safe to run...". Basically, fear inducing messages instead of actually useful from security sense.

woah• 1 year ago

If the EU isn't fining someone for tracking users too much, they're fining them for not tracking users enough.

microtonal2• 1 year ago

That's not what is going on here, right? The complaint is that the consent process is much harder for third-party apps than Apple apps and Apple cannot give itself advantages because Apple is a gatekeeper w.r.t iOS.

A simple yes-no for third-party applications makes it easier for the user to reject tracking and doesn't make the process more cluttered than for Apple apps.

pertymcpert4• 1 year ago

Where did you get that part from?

Third-party publishers "cannot rely on the ATT framework to comply with their legal obligations," so they "must continue to use their own consent collection solution," the French agency said. "The result is that multiple consent pop-ups are displayed, making the use of third-party applications in the iOS environment excessively complex."

It's not harder at all. France are just mad that their small advertisers have to ask for permission again which is their own choice.

diggan• 1 year ago

List of 2560 GDPR enforcements: https://www.enforcementtracker.com/

Granted, not all are fines for tracking users, but all sorts of violations. Reasoning is included in the table.

izacus• 1 year ago

Having US corporations fund our infrastructure, culture and subsidy programs is amazing!

sylware• 1 year ago

Any update on noscript/basic (x)html interop of french administration web sites?

It is good to straighten the other guys, hopefully they do not forget about themselves.

dmitrygr• 1 year ago

"We will not tell you how to fix what we found to be 'wrong', reserve the right to find your fixes 'wrong' again, and will charge you more"

At which point do we admit that this is simply extortion?

jayd16• 1 year ago

Reminds me of app store submissions.

johnnyanmac8• 1 year ago

Meanwhile, if they gave a specific solution

"at what point do we admit that the EU is strongarming US tech to their will"?

You can't win here.

92834092322• 1 year ago

Most of you won't read the past the headline but this isn't accurate

The agency said there is an "asymmetry" in which user consent for Apple's own data collection is obtained with a single pop-up, but other publishers are "required to obtain double consent from users for tracking on third-party sites and applications." The press release notes that "while advertising tracking only needs to be refused once, the user must always confirm their consent a second time."

They take issue with Apple making it easier for their apps but applying a different standard for third parties. I think this fine is fair.

bberenberg2• 1 year ago

Is Apples third party though? I don’t know, genuinely asking.

If no, then first party vs third party having different standards of consent seems reasonable?

92834092322• 1 year ago

This is referring to Apple's first party apps so no they aren't third party. I can understand why someone would make that argument but the French regulator argument here is that in the spirit of competition, third-parties should have the same barrier to entry as Apple's first party apps and I can see the argument they are making.

MR4D• 1 year ago

I’m curious how things like this play into Trumps recent reciprocal tariff threats.

microtonal2• 1 year ago

Probably it will. Vance even threatened to leave NATO if the EU regulates X. But EU countries are not satellite states of the US. At some point we just have to draw a line in the sand and stand by our own values, even if it comes at an expense. It's not as if tariffs and the retaliatory tariffs it will lead to is good for the US economy either.

It's all just silly.

kazen44• 1 year ago

a lot of european nations are also discussing on how to create more inhouse and become digitally sovereign from US tech firms. (the dutch government for instance[0])

5 or even 10 years ago this would have been unthinkable in dutch politics, even if this has been called out a lot as a risk in tech circles.

[0] https://www.dutchitchannel.nl/news/602753/tweede-kamer-neemt...

drivebyhooting2• 1 year ago

Do other apps require double consent or is it actually a dark pattern they’ve adopted:

* explain and prompt the user for consent

* if they acquiesce pop the real modal

* otherwise bide your time and try again later

The reason for this is because once you receive a rejection in the official modal you are not allowed to ask again.

gruez8• 1 year ago

Do other apps require double consent or is it actually a dark pattern they’ve adopted:

It's specifically recommended by apple.

https://developer.apple.com/design/human-interface-guideline...

drivebyhooting2• 1 year ago

In adtech and social media it is a calculated strategy to maximize user compliance.

nemothekid• 1 year ago

Apple's recommendation (as posted) actually doesn't look like double consent to me - in fact, their recommendation calls out that it should be treated like a consent form (You shouldn't be able to exit the explanation page, only continue).

App Publishers have instead used the explanation page as a "soft" consent form, so they can bug you later without being disabled at the system level.

TheJoeMan• 1 year ago

Or snapchat repeatedly asking for my contacts access knowing it’s denied.

sitkack4• 1 year ago

Or WhatsApp not allowing you name contacts unless you gave it access to your entire address book so FB can have your entire FOAF graph.

wkat42423• 1 year ago

Yes this practice should really be banned.

It's constantly whinging it's been denied camera access too. I really hate that app but some people I talk to use it.

ilnavigante• 1 year ago

Speaking of dark patterns: if you try to initialize your Mac without logging in to your iCloud account, the installation process doesn't ask you to encrypt your drive, so everything is in clear by default...

airstrike• 1 year ago

can we start also fining companies for not easily offering "no and never ask again"? the "maybe later" trend needs to die ASAP

gruez8• 1 year ago

No good deed goes unpunished. Don't protect users' privacy, and you get flak from regulators for "not doing enough". Protect users' privacy, and you get flak from regulators because it's "too complex and hurts small companies that rely on advertising revenue". You see similar levels of cynicism directed at Google. When firefox banned third party cookies, it was almost universally welcomed, but when Chrome does it the cynics come out and say how it's actually some sort dastardly ploy to cement their position in the ad market because third party adtech firms are disproportionately harmed.

ipaddr• 1 year ago

One benefits directly while the other doesn't. Plus many people complained.

gruez8• 1 year ago

One benefits directly while the other doesn't.

That's the exact of cynicism I'm talking about. It doesn't matter whether banning third party was good for users or not, only whether Google (or Mozilla) stood to benefit. This is absolutely toxic because it means objectively good changes get shouted down.

Plus many people complained.

For what, Firefox?

briandear4• 1 year ago

The advertising industry was who filed the complaint, it wasn’t a bunch of normal users. If the ad industry wasn’t so shitty, I might give them the benefit of the doubt.

Nullabillity• 1 year ago

The difference is that Firefox didn't do it as an excuse to sneak in a new tracking system instead.

gruez8• 1 year ago

You mean this? https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

thebruce87m3• 1 year ago

Benoit Coeure, the head of France's competition authority, "told reporters the regulator had not spelled out how Apple should change its app, but that it was up to the company to make sure it now complied with the ruling,"

Sounds like a good shakedown to me. Wait until they tweak it then fine them again for getting it “wrong”. I wonder if they even got the chance to change anything before they were fined the first time. And all because the regulator wants users to be advertised to more?

refulgentis6• 1 year ago

"told reporters the regulator had not spelled out how Apple should change its app, but that it was up to the company to make sure it now complied with the ruling,"...shakedown

I wonder if this sheds light: if they said exactly what to do, there's a strong argument that they went too far when business regulators became UI designers.

Wait until they tweak it then fine them again for getting it “wrong”

I don't worry too much about it, I used to work at Google, companies and regulatory authorities are in constant contact. Generally, I haven't yet seen a company claim to have addressed a situation then gotten fined again.

And all because the regulator wants users to be advertised to more?

I can't find that bit in the article and I haven't heard it before: could you share some more?

thebruce87m3• 1 year ago

I can't find that bit in the article and I haven't heard it before: could you share some more?
The Autorité also found that the rules governing the interaction between the different pop-up windows displayed undermined the neutrality of the framework, causing definite economic harm to application publishers and advertising service providers.

https://www.autoritedelaconcurrence.fr/en/press-release/targ...

“Economic harm to … advertising service providers” says it implicitly.

enasterosophes• 1 year ago

I can't find that bit in the article and I haven't heard it before: could you share some more?

The second paragraph has what you want. From the article:

The App Tracking Transparency (ATT) framework used by Apple on iPhones and iPads since 2021 makes the use of third-party applications too complex and hurts small companies that rely on advertising revenue ... The system harms "smaller publishers in particular since, unlike the main vertically integrated platforms, they depend to a large extent on third-party data collection to finance their business," the agency said.

Is there another way to interpret this than that the agency wants to protect advertizing and data collection practices by small businesses?

eptcyka• 1 year ago

Funny how this is exactly the process that one has to go through for getting an app through a review for an app store - you're told you've done something wrong, and it is up to you to fix it. The reviewer will never point out the specific issue they have with your submission.

apt-apt-apt-apt• 1 year ago

Worse yet, if you fail to identify and fix it after several attempts, your entire account and all your apps get permanently banned with no feasible recourse.

iamkonstantin• 1 year ago

Regulation around competition is quite clear. It’s unfortunate that Apple is the kind of company that only reacts after getting sued or fined instead of doing the right thing in the first place.

joshstrange• 1 year ago

So much dumb in this article that it's hard to figure out what's actually going on.

I have to assume this this is the same "issue" with all Apple permissions. They can only be requested once by the app and if the user denies it then the user has to dig into Settings to turn it on later. To avoid/work around this a lot of app developers prompt the user before they trigger the OS-level prompt so that if the user says "no thanks" they don't "burn" their one chance to request a permission.

Apple, it seems, doesn't use those "pre-consent" screens so it's only 1 dialog. Also, to my knowledge, Apple doesn't allow it's apps to prompt with the system dialog multiple times either so they are on equal footing it appears.

As always it's important to see who is complaining/behind this:

The French investigation was triggered by a complaint lodged by advertising industry associations.

Ahh, got it.

The "Autorité de la concurrence" seems to suffer from the same issue almost all government regulators suffer from, they know fuck-all about technology which is perfectly summed up with this:

Benoit Coeure, the head of France's competition authority, "told reporters the regulator had not spelled out how Apple should change its app, but that it was up to the company to make sure it now complied with the ruling,"

Not only is it a "You need to make _A_ change but we won't tell you what it is"-type thing which is super annoying [0] but "Apple should change its app". If you don't understand the difference between an "App" and an "OS" then you should not be making rules for either.

ATT is a 100% win for consumers and I don't for a second believe the BS around "but what about small businesses!", just look at all the people championing small business, it's check notes, ahh, yes, Facebook and large ad agencies, bastions of small business /s.

[0] Yes, it's even more annoying when Apple does it to developers and I think we are all feeling a little bit of Schadenfreude over it.

jonplackett• 1 year ago

Can we just frikkin ban tracking completely and just see how that goes?

I do not really care if some businesses can no longer make money in the way they like to. I’m sure they’ll figure it out if they have to. Businesses existed for a loooooong time without tracking their customers. I’m sure they can do it again.

wkat42423• 1 year ago

Yeah I so wish the EU would simply do this.

alabastervlog• 1 year ago

If governments would just ban the bad shiat app vendors do that Apple tries to curb, that’d be great, as it’d remove the main reason I have little practical choice but to use Apple devices.

FridgeSeal• 1 year ago

Some apps have a “pre permissions” pop up telling users about what permissions they’re about to ask for, before then initiating the iOS permissions pop up.

The Apple apps go straight to the permissions pop up.

How is it Apples fault they do this?

klabb3• 1 year ago

I think with Apple you agreed to let them do human experiments in the EULA when you’re unboxing your device. With yet-another-tower-defense games the agreement needs to be done on a per-app or at least per-publisher basis.

The native iOS permission dialog is only a consent about what the app can do locally, and doesn’t list the 1034 close partners that they will share your DNA with.

Makes me think.. one potential risk here is that vendors will band together under a common ”publisher” where apps can piggyback on consent from previous apps, just like the big guys do but without being part of the same feudal kingdom. Wouldn’t surprise me if this already happens.

the_clarence• 1 year ago

This is such a bizarre move from Apple honestly. They're acting like they're letting users make a choice when realistically all users are going to choose not to get tracked. It's like a "do you want to install malware?" button. They just did it for the lulz and to hurt the finances of companies they don't like.

kjreact• 1 year ago

Wow, do you work for these ad-tech companies? You’re totally correct that I don’t want to be tracked and I’m happy that Apple is trying to protect me from these predatory companies. If “hurt[ing] the finances” of these privacy invasive companies is your definition of “companies they don’t like” please sign me up. It’s a bizarre thing to say any one actually wants to be tracked.

briandear4• 1 year ago

Shouldn’t a user be able to choose if they want to be tracked? Of everyone says no, I’m not sure that’s a problem — unless your business model is intrusive tracking.

lvl155• 1 year ago

At this point, I am convinced EU fines American tech companies for fun.

epolanski5• 1 year ago

And you're wrong.

That being said in that specific case this is odd because in general:

- EU (albeit not France) gives plenty of time to OS developers to adapt and often talks to them directly when they are as big as Apple

- The timing makes it look like with a different less disruptive administration it would've went differently

In any case US companies abusing any possible loophole for paying pennies for decades in Europe don't get any sympathy by me.

johnnyanmac8• 1 year ago

It still surprises me how far the US has declined in pretty much all qualities of life. But Hacker News still has this sect of a community that despite EU regulations. Ones they crave from American governments.

Like, do we want protections from corporations or to continue to let them stomp on using hopes they become the corporation one day?

caseyy• 1 year ago

I would ordinarily say something along the lines of “don’t blatantly break laws and you won’t be fined”, but this is a minor implementation detail. There are so many bigger fish to fry in consumer rights space that it just looks petty. And it’s questionable whether a law is even broken.

MonkeyClub• 1 year ago

150M is ridiculously low for a company with a 3.34T market cap.

It's the equivalent of fining a millionaire 150 EUR, or a regular person fifteen cents.

That's not a fine, it's a show put on for people who can't do division.

freetime2• 1 year ago

Agree it's a slap on the wrist for Apple. But the punishment fits the "crime" in this case, in my opinion. Enough to pay for the legal costs of enforcement, and get Apple's attention. But nothing terribly punitive, which I don't think is warranted in this case.

I believe Apple's goal with the popups is to protect consumers' privacy from 3rd party apps, which is admirable. But where they went wrong is that they didn't apply the same process to themselves.

pertymcpert4• 1 year ago

Do you actually agree with the fine?

Don't give users a choice in tracking: complaints Give users a choice in tracking: now it's too many pop ups

epolanski5• 1 year ago

The issue here is that Apple only needs one click to sell your data (and yes they do it, they made 11B $ on ads last year) and others need two.

In fact Apple is making more and more money on ads because they limit data access to third parties, but still sell yours in search and store.

GuB-42• 1 year ago

It is not the right question. The goal is not to destroy Apple, it is to force them into compliance. In order to force them into compliance, you only need the fine to be higher than what it costs to comply.

And €150M is a lot of money, you can have on the order of a thousand people working on the problem for a year to get even. I am sure they can figure out a way.

Same idea with, say, a parking ticket for nonpayment. It may be nothing to a millionaire, but the important part is that in the long run, it is more cost effective to simply pay for parking.

lodovic• 1 year ago

Same idea with, say, a parking ticket for nonpayment. It may be nothing to a millionaire

It's telling that the former CEO of Apple was famous for driving a car without plates, and parking in handicapped parking spaces, just because he could.

crazygringo4• 1 year ago

Comparing a fine with market cap doesn't make a lot of sense.

More logical is to compare it to their yearly profit. Net income was $74B last year.

So the fine is ~0.2% of that, which is pretty significant for something as tiny as having two pop-up messages rather than a single combined one.

And for a regular person making $50K/yr, it would equate to a $100 fine. Not fifteen cents.

epolanski5• 1 year ago

No, you'd need to first take the expenses out of the person's salary. Assuming the person needs 35k to live it's a 30$ one.

briandear4• 1 year ago

Perhaps they should fine the companies that want to do such intrusive tracking? Apple’s not sharing data with third parties for their internal stuff, that’s a big difference when Dominos wants to share with someone that isn’t Dominos.

ddxv2• 1 year ago

Apple only blocks sharing links from outside the app Dominos app to other apps (bolstering Apple's ad monopoly). Apple does nothing to stop Domino's from sharing the actual important data 3rd parties track in the Domino's app.

shuckles4• 1 year ago

Huh? Basically every sentence in your comment is wrong. Apps can link to other apps. There's an entire framework called Universal Links to support this. And Apple is the only platform maker that requires apps to ask for permission before sharing data for tracking.

johnnyanmac8• 1 year ago

Apple’s not sharing data with third parties for their internal stuff

Yes, they do.

Apple does not sell your personal data including as “sale” is defined in Nevada and California. Apple also does not “share” your personal data as that term is defined in California.

From their privacy policy (C. 1/31/2025) It's enough to comply for a definition under a single state in a single country. They make a billion off ads so I'm sure they loophole the heck out of that.

chillacy2• 1 year ago

You can make still money off untargeted ads (just not as much).

edelbitter• 1 year ago

pop-ups that let users reject tracking

No pop-up is needed to reject what is already banned union-wide. Therefore, a banner that is trying to collect my explicit+specific+informed+voluntary consent to partially lift that ban is not a "pop-up that lets users reject". Its a "pop-up that lets users surrender" some of their rights & freedoms.

vachina• 1 year ago

Yearly EU tax bill

bjornsing• 1 year ago

Refreshing to see a huge fine for too many pop-ups. It’s usually the other way around, which can be frustrating for those of us who don’t like pop-ups.

ChrisRR• 1 year ago

To Apple, that's just a Tuesday

barelysapient• 1 year ago

I think Apple will need to make a new phone line. Call it the ePhone.

In a few years we can compare who got it right.

France fines Apple €150M for “excessive” pop-ups that let users reject tracking

Related Stories