France Fines Apple €150M for Weaponizing Privacy Against Competitors

France's competition authority has fined Apple €150 million ($162M) for leveraging its privacy framework, App Tracking Transparency (ATT), to distort competition.

The case underscores how privacy, when implemented asymmetrically, can become a strategic tool that undermines both market fairness and user agency.

The fine, issued by the Autorité de la Concurrence, concludes a multi-year investigation into Apple's practices between April 2021 and July 2023, during which the company rolled out ATT across iOS and iPad. While ATT's stated goal — limiting user tracking without consent — is broadly aligned with privacy best practices, French regulators found that its design disproportionately disadvantaged third-party developers and ad networks, particularly smaller publishers that rely on targeted advertising revenue to survive.

Protecting user privacy or securing dominance?

Apple introduced ATT in iOS 14.5, requiring apps to ask users for explicit permission before accessing the Identifier for Advertisers (IDFA). However, the Autorité, backed by France's privacy watchdog CNIL, found that ATT did not apply evenly. Apple's own apps were initially exempt from the same double-consent requirements imposed on third-party apps, and even after aligning superficially in iOS 15, Apple continued to benefit from simplified consent flows, such as using a single pop-up for its own data collection.

This asymmetry in consent mechanisms created an uneven playing field. Third-party apps were forced to use complex consent management platforms (CMPs), resulting in confusing and redundant pop-ups that degraded the user experience — while Apple's apps maintained streamlined tracking pathways. The result, according to the CNIL, was not just bad for competition — it also reduced the effectiveness of meaningful, informed user consent, turning ATT into a barrier rather than a tool for privacy empowerment.

Critically, the framework's design failed to meet legal standards for consent under France's Data Protection Act and the GDPR. The CNIL emphasized in a 2022 opinion that ATT could have been implemented in a compliant, user-friendly way with only minor modifications. These findings suggest that the harm was not an inevitable consequence of privacy enforcement, but rather the result of strategic choices made by Apple as a dominant gatekeeper.

The French regulator framed this as a textbook abuse of dominance: a platform operator using privacy architecture not only to bolster its own position but to economically harm downstream players — particularly smaller developers without proprietary data ecosystems. While large platforms like Meta and Google have alternative user tracking methods, many indie app developers rely almost entirely on IDFA and third-party data aggregation for monetization. The loss of that capability, coupled with user friction introduced by ATT's complex flows, had measurable economic consequences.

This case highlights how privacy features can be misused as gatekeeping tools when platform owners control both data and distribution. Protecting user privacy shouldn't come at the cost of fair competition — and privacy itself must be safeguarded from becoming a lever of market power.