Privacy by default, abuse by design: EU competition concerns about Apple’s new app tracking policy
With the most recent updates of its mobile operating systems, in April 2021 Apple implemented a new global App Tracking Transparency policy (the “tracking policy”). The policy obliges app developers to display an additional (Apple-designed) prompt to request permission from end users for the developer to “track” the user, even when the user has already consented to the sharing of its data through the developer’s own consent tool. Apple presents the new policy as a step to enhance privacy. Others, including the authors of this article, see it as a “bombshell for third-party mobile ad tech[1]” that, together with Google’s disabling of third-party cookies,[2] only entrenches the data supremacy of Apple and Google, and forecloses data-based competition and consumer choice across the entire Apple ecosystem. These concerns in fact have already triggered an investigation by the French Autorité de la concurrence[3] and a complaint of eight media and tech associations before the German Bundeskartellamt.[4] From the standpoint of EU law, this article describes the relevant conduct and technicalities, its impact on end users’ data privacy and on competition, and how both interests may be weighed considering the existing legislation.
I. The relevant conduct and technicalities
Since April 26, 2021, no app gets past the App Store review process if Apple’s app tracking policy is not correctly implemented.[5] As a central feature, Apple obliges app developers to show users a system-provided prompt (the “tracking prompt”) prior to the first time the developer intends to “track” a user across apps and websites (as defined by Apple). The tracking prompt cannot be swiped away but needs to be answered without any further information or clarifications. The prompt has to be shown, in particular, when an app developer intends to retrieve the so-called Identifier for Advertisers (the “IDFA”) for the first time. The IDFA is a generic string of numbers specific to each device. It is used to match information (such as the click on an ad or the download of an app) to a specific device by pseudonymizing the user’s actual identity.
Preventing app developers from tracking
If an end user disallows “tracking” within the new prompt, the app developer cannot access that user’s IDFA or track them in any other way, effectively rendering any combination and matching of data relating to the end user’s device nearly impossible. Already prior to adoption of the tracking policy, users could technically hinder an app developer from gaining access to the IDFA by opting into Apple’s “Limit Ad Tracking” (“LTA”) setting. Around 25% of end users have made such a conscious choice against tracking.[6]
A warning message
The general interface of the tracking prompt is supplied by Apple. The wording suggests that app developers are doing something “really bad.” The prompt repeatedly uses the negatively connoted word “tracking.” Thus, the prompt appears as a warning message rather than a consent form. The architecture of the tracking prompt is very different to other consent prompts Apple employs.[7] The tracking prompt may look like the following example:
Source: Apple.[8]
Little room for convincing end users
App developers can only customize the description text (so-called purpose string) within the tracking prompt where they can explain why they are asking for permission to track. Initially, Apple did not plan to let app developers use other means to inform the end user prior to the displaying of the tracking prompt, or let developers ask users to reaffirm their choice at a later point.[9] Reacting to concerns raised by the industry, Apple now allows some form of additional information, i.e. screens that an app developer can display prior or subsequent to showing the tracking prompt.
Merely an additional hurdle
Because the tracking prompt still only contains very rudimentary information, it does not fulfill the requirements for a valid consent to the processing of user data, at least under EU data protection laws. This means that the prompt (only) creates an additional opt-in requirement or hurdle for app developers to access the IDFA. End users first need to consent within the app developers’ own comprehensive consent management tools (to comply with the EU data protection laws) and then again via the abridged prompt controlled by Apple (to comply with its policy).
Tracking prompt overrules privacy law-compliant choices
In case a user explicitly consented within the app developers own tools shown first, but then rejects Apple’s required tracking prompt, the second decision overrules the first. And if an end user disallows tracking in the (second) prompt, but intends to re-allow tracking in a subsequent (third) prompt that an app developer may trigger to make the user reconsider its choice, it does not automatically re-establish that app developer’s access to the IDFA.[10] If an end user does not consent to ‘tracking’, Apple does not allow the app developer to reject the use of its app by such end user.
Very low opt-in rate
Despite Apple’s latest ameliorations, the impact of the tracking prompt is devastating for app developers. Prior to the policy’s adoption, approximately 75% of end users allowed tracking through the IDFA.[11] After adoption of the tracking policy, the allowance rate dropped to 4% in the U.S. within the first week of operation.[12] With a 12% allowance rate, the global number was higher, but still below most prior estimates. The number of opt-ins increased slightly in week two but remains very low.[13]
Impact on affected businesses
As a result of the tracking policy, app developers are severely limited in their ability to serve interest-based ads, efficiently measure the success of advertising campaigns, limit the number of times the same ad is served to a user (frequency capping), or effectively prevent ad fraud within the Apple ecosystem. According to studies, all of this will likely lead to revenue cuts of 50-65% for the affected businesses, in particular for small and medium sized app developers and advertisers.[14] According to the currently available data from market monitoring platforms, the prices for ad placements without the use of the IDFA are on average 54% lower compared to the prices of ads that can be served to users who allow access to the IDFA.[15]
II. Alleged advantages for data privacy
First things first: Privacy should be seen as a fundamental right and Apple is right in emphasizing this. For this very reason, with the General Data Protection Regulation (“GDPR”)[16] and the e-privacy Directive,[17] the EU has enacted one of the strictest overarching data protection regimes in the world. Against the background of this legislation, it is misleading, to say the least, when Apple purports that its new policy was introduced to provide end users with the means to prevent tracking without their consent. In a video accompanying the rollout of the prompt, Apple justified its changes as follows:
“[The prompt] is a feature that gives you a choice. A choice on how apps use and share your data. […] [S]some apps have trackers embedded in them that are taking more data than they need. Sharing it with third parties, like advertisers and data brokers. They collect thousands of pieces of information about you to create a digital profile that they sell to others. These third parties use your profile to target you with ads… and they can also use it to predict and influence your behaviors and decisions. This has been happening without your knowledge or permission. Your information is for sale. You have become the product. That’s why iPhone users will now be asked a single, simple question: Allow apps to track you or not? […] A simple new feature that puts your data back in your control.[18]” (emphasis added)
Strong words, strong promises
The anti-tracking message could not be any clearer (which also explains the rejection-inducing design of the tracking prompt). So, is Apple the White Knight of privacy that puts an end to all data malpractices and empowers end users to make well-informed choices to their overall good in line with the EU data privacy “Zeitgeist”?
Too nice to be true
This article will show that Apple’s misleading narrative is hypocritical [19] and twists the facts. Apple itself continues to engage in the activities it allegedly condemns, and which purportedly justify the tracking prompt in the first place. Instead of enhancing privacy, the tracking prompt will give Apple even greater power over users’ data and options to monetize it. Instead of gaining choices, end users will further lose control over their data and suffer from less privacy-enhancing competition within the Apple ecosystem.
The tracking policy does not add value to existing EU data privacy standards
Since the GDPR came into force in 2018, app developers are already obliged by law to request consent from end users prior to any use or sharing of their data for advertising purposes, and Apple controls this.
App developers must already obtain consent from end users to comply with the world’s strictest privacy laws
If app developers do not comply with the harmonized EU requirements for receiving such consent, data protection authorities, consumer associations, and competitors can and do enforce compliance. App developers rely on sophisticated industry standards[20] or their own solutions to find the right balance between properly informing the user about the use of its data and the purpose/benefits for the user – all in accordance with the legal standards.
Apple already rejects apps that do not comply with privacy laws
In addition, Apple, too, has been ensuring compliance with the applicable privacy laws. For years now, Apple has been checking whether apps meet such requirements before an app is admitted to the App Store. During the review process, Apple pays particular attention to whether the developer obtains effective user consent before collecting and merging data. In 2020 alone, Apple rejected over 215 thousand submissions for violating its detailed privacy guidelines.[21] In other words, Apple knows that, at least in the EU, users are informed and asked for their consent prior to any tracking in accordance with privacy laws.
The tracking policy leaves a combination of First-Party Data untouched, of which Apple has most
Apple’s public framing of its purported intentions is also in stark contrast to how Apple has defined what type of data combinations constitute “tracking”. According to Apple, “tracking” only refers to the combination of data with data sets of different undertakings, i.e. of unassociated companies. Such data is referred to as “Third-Party Data.” Thus, app developers who share end users’ data with other app developers need to display the tracking prompt. Conversely, the combination of different data sets collected through different services within the same group of companies (so-called First-Party Data) is not covered.[22] Hence, First-Party Data processing and sharing within a group does not trigger the tracking prompt, even though EU data protection law does not make such distinction between First- and Third-Party-Data.
A distinction in Apple’s favor
Such distinction means that, for example, it constitutes “tracking” when a small app developer shares user data gathered within its own app with advertising intermediaries for the purpose of measuring the effectiveness of advertising campaigns or fairly attributing their success (for example, attributing the installation of an app after clicking on an ad in another app to such apps’ developer or making a purchase after having been displayed an ad in an app). However, based on Apple’s definition, it does not constitute “tracking” if, for instance, Apple itself gathers and combines tons of user data across its various services and apps (e.g., App Store, Safari browser, Apple TV+, Apple News, Apple Music etc., or even through third-party in-app purchases and subscriptions) with a view to providing highly-targeted ads within its App Store (Apple Search Ads) or Apple News and Apple Stocks (Apple News Ads).[23] Accordingly, Apple does not display the tracking prompt within its own apps, not even if its app combines data with third-party apps as this example shows:
Different architecture for own and third party apps
In the same vein, Apple uses an entirely different mechanism when end users wish to opt-out from Apple’s own personalized ads. In a cumbersome process, iPhone users must go to “Settings,” then to “Privacy,” scroll down all the way to a rather hidden “Apple Advertising” button and then opt out of Apple “Personalized Ads.” Before seeing such a choice, they receive detailed – and very favorable – information on why and how Apple uses targeting information for Apple’s ‘personalized ad experience’ and what will happen when they turn it off.[24] So, is it Apple’s logic, that the combination of data is bad only if others do it?
The tracking policy is inconsistent with the GDPR and ePrivacy Directive objective of empowering consumers in Europe
Not only is it misleading to state that users were tracked without their consent prior to the adoption of the tracking prompt. The prompt is also itself at odds with existing EU privacy standards. This is because of – in Apple’s own words – the “single, simple question” that users are asked. While the prompt is indeed an efficient way to technically block access to the IDFA (as it is designed in a way that decreases the number of opt-ins), it is by no means a tool to empower users to make informed decisions as required by privacy law.
Apple artificially reduces consumer choice to a “yes or no” without revealing the consequences
EU privacy law is based upon the notion of sovereign consumer decisions. Consent to any data usage “should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her.”[25] This requirement is not met where a prompt suggests a response without revealing its consequences. Let alone that the tracking prompt neither informs end users about the details of the intended data processing, nor provides any possibility to retrieve further information and the available choices are not even the real choice. The real choice would be whether a user prefers to (i) be tracked across free apps with fewer and more relevant ads, or (ii) not be tracked but obliged to pay for the app or be exposed to more and more irrelevant ads. An appropriate choice would also provide more options but for a single “yes or no” (for example, allowing a choice as to whom the app developer may share the data with and for what purpose).
It is also contradictory that Apple is trying to defend its one-sided policy by claiming that there was a difference between “tracking” and data collection. “[T]racking is when companies collect and sell data” [26], which Apple would not do. However, leaving aside that the rest of the industry refers to the sale of data as data brokering (not tracking), Apple’s prompt does not give the user the option to (just) disallow any sale of data. It asks for consent to any data combination – which in Apple’s own words is something else. Importantly, the EU requirements under the GDPR to obtain consent (which apps need to gain in any case) are designed to reduce the information asymmetries between end users and data processors which make it challenging for users to make informed decisions. In terms of data protection, a consumer must be able to grasp this scope of his or her decision in order to effectively consent. Apple deprives users of such information and instead increases the information asymmetry once more by forcing app developers to use an additional consent mechanism that does not provide the functionality to enable informed choices (with only very little space and no option to provide additional information). And not only is too little and wrong information provided, but the wording is also a suggestive warning message. Thus, Apple nudges the user to opt against “tracking” even though he or she is not aware of the consequences of such a decision.
Apple takes control away from the end user
This is even more worrisome under privacy law if such a biased, second decision (technically) overrules previous decisions taken by the users based upon more detailed information that may have been provided by the app developer on the purpose of the data processing. Apple’s mechanism in effect considers a users’ likely well-informed choices as meaningless or invalid and makes them decide again, without explaining properly what the user should consent to this time. However, European privacy law expects that digital platforms honor users’ privacy choices made in accordance with the law and does not ask digital gatekeepers to “step in.” When a platform overrules such a choice by imposing its own suggestive prompt, it takes away the control from both the user and the app developer, ignoring their agreement and potentially disrupting their business relationship. It thereby in effect overrides the end user’s GDPR-compliant privacy settings.
The tracking policy increases data concentration and thereby further increases consumers’ dependency on Apple’s ecosystems
As seen above, at least within the EU, Apple adds very little to the current privacy standards that are already followed by app developers and policed by Apple. In addition, the tracking prompt itself is not in line with the spirit of “consumer empowerment” under EU privacy law. But the biggest flaw in Apple’s system is that it may in effect reduce existing privacy standards. This is because Apple’s distinction between First and Third-Party Data allows the combination of data within a big data ecosystem while it hinders the combination of data by small(er) competitors that may actually pursue more privacy-protective business models. The tracking prompt further entrenches the economic power of Apple’s data-driven platform[27] within its walled-off data-ecosystem, even though such power poses a great threat to privacy that data protection laws were designed to address.
The economic concerns translate into privacy concerns
By setting new, self-serving standards, Apple increases the dependency of all user groups of its platform. As a consequence, considering the lack of any countervailing buyer power, consumers simply have to accept Apple’s privacy terms and conditions on a “take it or leave it basis.” The same effects, leading to less competition and further market concentration, have been witnessed after the GDPR was introduced.[28] Highly concentrated data-ecosystems such as Apple’s pose the highest risk that users lose control over their data.
III. Disadvantages for competition
While end users gain no extra protection from Apple’s new tracking policy compared to existing EU legislation, they may lose a lot in terms of higher prices, lower quality, and less choice resulting from less competition within Apple’s walled-off ecosystem.
Data as a tool to generate quality-enhancing and price-reducing positive network effects
To assess the overall impact of Apple’s tracking policy, one needs to consider the benefits of the identifier data for app developer’s advertising business, and the benefits of such advertising, in turn, for end users. Over the last two decades, we have witnessed an unprecedented growth of digital businesses that consumers benefit from every day. A central gateway to access such digital offerings is Apple’s mobile platform, including its App Store.
Apple’s mobile platform is so attractive for end users because most apps are offered to them for free
The basis for the wealth of free (or freemium[29]) offerings on Apple devices is interest-based advertising. Tracking forms the technical backbone of such advertising[30] as it enables a matching of supply and demand. From traditional media we know that users generally do not appreciate advertising unless it is relevant for the user at the point in time the ad is displayed. Someone using an app for vegetarian cooking may appreciate an ad for a new vegan restaurant nearby but find an ad for a steakhouse obtrusive. Whether a user considers an ad as a useful source of information that decreases search and transaction costs, or instead as a burdensome distraction from the content of the app, depends on the relevance of the ad to the end user. To increase such relevance, the medium needs to know what the end user is currently or at least generally interested in.
Tracking enables efficient, high-performing ads that make most of the online content free
Tracking, including the use of the IDFA, is aimed exactly at that.[31] The collection and combination of data for interest-based advertising is a common industry standard today and is, in principle, in the joint interest of the end user, the advertiser, and the app developer. The more specific the data collected about an end user, the more relevant ads can be served to the user.[32]The more relevant the ad, the more likely it will convert into a transaction, and the more an advertiser is willing to pay for such an opportunity.[33] Better converting ads thus allows the app developer to display less and less obtrusive ads to finance its service without having to charge the end user. Plus, the more app developers can collect such data, and the more advertisers can benefit from it, the more robust the ad-based price and quality competition for and amongst the advertised businesses, all to the benefit of end users.
Most consumers prefer more ad targeting to higher app prices – and should be free to do so
Apple’s tracking prompt hinders the combination and use of data required by app developers to enhance the quality and lower the price for their services. Apple’s prompt suggests that end users may disallow any third-party sharing of data while continuing to enjoy all the benefits of such data processing at zero costs. Yet, such an option simply does not exist because app developers have to cover the costs of their apps – either through advertising or a subscription model. An honest question would have to clarify the significant repercussions of a disallowance, for example by asking: “Do you wish (i) to disallow any tracking at the costs of more and less relevant ads and/or (higher) subscription fees or (ii) allow tracking for more free apps with fewer, but interest-based ads?”
According to an empirical study of April 2021, despite being particularly privacy-focused, 75% of European citizens would decide in favor of the second option(s), i.e. “today’s experience of the internet over an internet without targeted ads, where they would need to pay to access most sites and apps.”[34] 75% is diametrically opposite to the low single-digit percentage opt-in rate that the Apple tracking prompt is currently triggering in the US.[35] Such a low rate does not prove the study wrong. Rather, it suggests that Apple’s abridged, self-serving, and suggestive prompt is not having end users’ genuine interests in mind: Apple’s prompt gives them the (false) impression that they may choose between using a free app with tracking or a free app without tracking. Behavioral economics teaches us that in such a scenario, end users will always opt for the second option of seemingly “zero own costs.”[36] However, Apple’s prompt conceals that in the long run any significant disallowing of tracking will oblige app developers to cover their costs through charging end users, i.e. by switching to a subscription model. As a result, Apple’s prompt for apps that were originally offered for free nudges those users that are actually keen on “zero own costs” to make a choice that will lead to the opposite: a shift from free ad-financed apps to subscription-based apps (with less relevant ads).
Win-win-win-situation under competitive circumstances
The fact that Apple has not considered end users’, app developers’, and advertisers’ aligned interests indicates Apple’s market power. Under competitive conditions, multi-sided intermediaries – such as app stores – compete on the basis of their ability to maximize the indirect positive network effects between their user groups. The better they align the interests of all user groups, the more attractive they become and the faster they grow.
App stores intermediate between end users and app developers. Ad-supported app businesses, in turn, match advertisers with end users. As previously noted, the quality of such matching depends on an app developer’s ability to process data about end users’ interests from its own sources and third-party sources. Accordingly, by allowing app developers and their intermediaries to combine data to increase the relevance of ads in their apps, app stores improve the matching between advertisers and end users and thereby maximize the indirect positive network effects between these user groups, from which both sides benefit. This is a win-win-situation for an app developer, end users, and advertising customers. It is also a win-win-situation for the app developer and the app store: the stronger the indirect network effects that app developers can generate thanks to the data they may collect, the higher the quality of such app and the more attractive the app store becomes for end users. The more attractive the app store for end users, the more app developers develop apps for it, etc. Thus, under competitive circumstances, allowing app developers to combine data with data from third parties to enhance their offerings should be a win-win-win-situation for all parties involved.
Change of Apple’s conduct after becoming dominant
This explains why, when still faced with competition, Apple itself had developed, introduced, and pushed the IDFA to enable app developers to enhance the quality of their services. Now Apple portrays this very technology as being consumer-unfriendly. This can be seen as a fundamental change in Apple’s business strategy after acquiring an entrenched market position: Originally, Apple needed to attract a sufficient amount of high-quality app developers to make its app store and thereby its devices attractive for end users. Following Apple’s growth, app developers now have become dependent on the App Store to reach the “must-have” audience of (single-homing) Apple device users. This allows Apple to facilitate its vertical integration into advertising markets by depriving app developers that compete for the same advertisers of the data they require to able to do so while Apple still can obtain such data.
Harming everyone else, Apple is the (sole) beneficiary
It is crucial to recall that within its app ecosystem, Apple cannot directly monetize ad-supported apps. But when app developers have to adapt to the post-IDFA era, Apple benefits in every possible scenario. As a result of Apple’s additional tracking hurdle for acquiring data required to effectively match advertisers with end users, app developers may have to leave the market for interest-based in-app advertising and switch to payment-based models. Advertisers, in turn, lose media inventory to effectively reach their audience. All of this inversely helps Apple – at all layers of its ecosystem.
Increasing Apple’s profits from commissions
Leaving app developers no choice but to charge end users (more), increases Apple’s earnings with commissions of up to 30% for every single in-app transaction involving the App Store or its in-app purchasing system.
End users and content providers switching to Apple’s digital content services
Apple itself offers many services that compete with those offered by third-party apps in its App Store. Restricting its competitors benefits Apple’s own (paid-for) digital content services. The more third-party apps charge end users (to cover their costs) and/or require a log-in (to obtain first-party data for advertising), the more end users will consider subscribing to or making purchases in Apple’s own paid offerings (such as Apple Music, iTunes Store, Apple Video/Apple TV+, Apple News+, Arcade, Fitness+ etc.). App developers may also opt for offering their services within Apple’s paid-for aggregation services instead, for example Arcade for games and Apple News+ for news content.
Expanding Apple’s ad platforms
People tend to associate Apple with high-value hardware products only. However, faced with a stagnating market for the sale of devices, Apple is actively expanding in the mobile advertising business[37]. Its advertising segment is already a lucrative multi-billion-dollar business. In lack of significant costs, this may well be Apple’s most profitable business segment. It encompasses “third-party licensing arrangements,”[38] most notably a deal with Google, pursuant to which Google pays up to $12 billion a year to appear as the default search engine on iPhones and other Apple devices.[39] Other advertising services are Apple Search Ads and Apple News Ads. Estimates for the sale of Apple Search Ads range from $2 bn in revenues in 2021 to a predicted figure of $11 bn by 2025.[40]
The more difficult it becomes to identify users’ interests through the collection and sharing of data following Apple’s new tracking policy, the less effective interest-based (display) advertising through third-party data combination becomes. This in turn will likely shift advertising budgets to either (i) search-based advertising (where the users’ current interest is revealed through its search query) – to the benefit of Apple Search Ads or higher/continued payments from Google,[41] or (ii) to (display) advertising based upon combined First-Party-data – to the benefit of Apple’s own apps such as News or Stocks (benefiting of Apple’s combined vast First-Party-data). A shift towards more Apple-intermediated ads is particularly likely for app installation campaigns for which Apple Search Ads within the App Store are already in the pole position. Just a few days before the final implementation of the tracking prompt, Apple announced that it will boost its ads business by adding additional advertising slots in the “suggested” apps section in its App Store search page.[42] Together with the new Apple tracking policy, industry insiders suggest that this may be an attempt by Apple to make the App Store the “primary discovery point for apps again.”[43]
Shielding Apple’s ecosystem
In any case, Apple’s ecosystem benefits in the sense that it is shielded from competition with other platforms. This is because Apple’s tracking policy will likely increase switching costs for end users. The more Apple services an end user uses and the higher its payments for paid-for apps or in-app content, the higher its cost for switching to another mobile platform such as Android because the end user would lose its previously purchased content. Their past purchases are sunk costs, leading to a lock-in. The same is even more true for Apple’s own apps, which cannot be used on other mobile platforms. Apple is aware of the lock-in it creates and has refrained from offering interoperability with its services for exactly this reason in the past.[44] Similarly, this leads to a higher willingness to pay ever-increasing prices for further Apple devices. So the more end users will need to pay for services offered via Apple devices, the more they will also (need to) pay for such Apple devices. This creates a self-reinforcing scheme to exploit dependent customers within an incontestable ecosystem.
IV. Trade-off between privacy and competition
Antitrust law perspective
There is general consensus today that in data-driven digital markets the ability to collect and combine relevant data can be essential to unleash the full potential of technology. As EU Competition Commissioner Margrethe Vestager rightly pointed out, “[c]ompetition can’t work if just a few companies control a vital resource that you need to be able to compete – and if they refuse to share it with others. Right now, it looks as though data is becoming one of those vital resources.”[45]
Appreciating the value of data to compete effectively, the sharing of data is generally seen as welfare-enhancing[46]
This is the case, at least, where only such sharing enables small- and medium-sized firms to generate the network effects required to enter a market and challenge an incumbent. Accordingly, competition authorities have acknowledged that data pooling systems,[47] data sharing,[48] data access rights,[49] and data portability[50] may benefit consumers as such measures can reduce barriers to enter digital markets, in particular if such markets are currently dominated.
Depriving rivals of essential data constitutes an abuse of dominance
In traditional settings, conduct of an undertaking dominating an upstream market that deprives downstream rivals of an input they require to compete effectively could be seen as an abuse of dominance.[51] This is particularly obvious where the rivals do not seek to obtain any input from the dominant firm but are hindered from generating such input themselves.[52] Hence, seen from a competition law perspective, Apple’s effort to reduce app developers ability to collect and share data from their end customers in order to combine them with third-party data through their advertising intermediaries, even when the end user consented to such combination, ticks all the boxes of an infringement. It creates additional barriers to enter both the digital content market and the market for interest-based-in-app advertising, particularly when Apple can obtain the data that developers cannot obtain.
Privacy law perspective
As described above, thus far Apple has failed to present convincing evidence that the tracking prompt is necessary to preserve end users’ personal data. Neither has it explained how presenting end users with a two-sentence “yes or no” prompt to block an app developer’s third-party tracking is meant to increase end users’ data sovereignty where many more options and variations exist. However, even if one were prepared to assume a privacy interest in Apple’s tracking prompt that Apple can claim on behalf of end users, this does not automatically mean that such interests outweigh the interests in continued competition, and thereby immunizes the conduct from antitrust scrutiny.
Weighing privacy and competition
Due to the novelty of the legal regimes, the appropriate balancing between privacy and (digital) antitrust laws has not yet been fully researched.[53] In its Facebook/WhatsApp decision, the EU Commission opined that “any privacy-related concerns […] do not fall within the scope of the EU competition law rules but within the scope of the EU data protection rules.”[54] The EU Court of Justice[55] and the US FTC[56] expressed a similar resistance to use antitrust law to address privacy-related concerns. If privacy concerns may not expand the scope of antitrust, it would suggest, in turn, that privacy defenses may not limit the scope of antitrust. In any case, it is apparent that any data privacy interest may not overrule any countervailing interest in data-driven competition because overall the latter may very well create more consumer welfare than the former. It appears appropriate therefore that when a genuine privacy interest for a particular conduct is presented, antitrust authorities should take account of such interest and balance it with the competition concerns caused by this conduct. Such balancing “would include considering, on one hand, the centrality or importance of the principle being invoked in data privacy law, and, on the other hand, the degree to which competition is impeded by the alleged misconduct.”[57] In this process, particular attention needs to be paid to the common objective of antitrust law and data privacy laws to enhance consumer sovereignty by increasing their freedom of choice.[58] According to the German Federal Supreme Court’s Facebook decision, this common ground implies, inter alia, that when due to high market concentration the consumers’ freedom of choice is already impaired, antitrust law “imposes particular obligations on the dominant undertaking that account for the consumer choices that could be expected in a competitive process. This applies all the more the stronger the conduct of the dominant company at the same time secures or strengthens its market position on the affected or neighboring markets.”[59]
In the current case, any balancing tips in favor of competition
In our view, Apple’s claimed privacy interest on behalf of end users is minimal at best, while the foreclosure of competition and strengthening of Apple’s market position is huge. Moreover, instead of providing end users with detailed choices as regards their preferred personalization of the user experience of each app (for example, by allowing an app developer to share data for some purposes or with specified third parties, as industry solutions[60] allow), Apple in effect reduces such choice again to an “all or nothing” solution. In particular, as has been correctly pointed out in a joint statement of the UK competition authority (CMA) and the UK privacy authority (ICO), “[i]t is important to note [..] that neither competition nor data protection regulation allows for a ‘rule of thumb’ approach, where intra-group transfers of personal data are permitted while extra-group transfers are not”[61]. This is exactly what Apple did.
Statutory balancing standards vs. private gatekeeper market regulation
More fundamentally, in the interest of securing consumers’ free choice[62] or keeping markets contestable,[63] it appears to us legitimate for a public authority to impose a competition-enhancing obligation on a dominant undertaking that goes beyond what existing data privacy laws require from that undertaking.[64] In turn, it appears unacceptable for a private dominant undertaking to unilaterally implement competition-reducing conduct under the pretext of privacy laws when such conduct is neither required nor encouraged by such laws.
Where a legislator has weighed privacy and third-party rights – such as through the GDPR – gatekeepers may not set such balancing unilaterally aside
There is well established reading by competition authorities of the EU[65] and its Member States[66] that when specific laws for the protection of particular consumer interests exist, it is not upon a dominant undertaking to set up and enforce its own rules to address such interests or to use them to justify any anti-competitive conduct. This must also apply to privacy laws. The complex balancing of the fundamental privacy interests of consumers with those potentially countervailing business interests of data collecting and sharing companies under ethical and economic perspectives is a highly political task. In Europe, the legitimate legislator has carried out such balancing and enacted a comprehensive, world-leading privacy standard - the GDPR, which is consistently adjusted to new developments. The GDPR recognizes the function that the sharing of data has for the economy and wider society. It does not generally prioritize a citizen’s right to information self-determination via other interests but strikes a trade-off of all fundamental rights affected by the use of personal data in the form of the current consent requirements.[67] In such a setting, it is not upon a private undertaking to second-guess such balancing in its own commercial interest by imposing additional privacy-related (consent) obligations on its business users. This is even more apparent where such undertaking imposes such obligations as a pre-condition to access end users that may not otherwise be reached. If such gatekeeper over-expands any alleged data privacy interests or interprets the statutory privacy obligations of its business users beyond their actual scope, it unjustifiably limits the legitimate and beneficial use of data sharing by its business users, and thereby restricts their fundamental rights and society’s interest in media plurality and fair, unimpaired competition. If, in addition, such undertaking also competes with such business users for the very same end users, such excessive privacy shields can quickly amount to an abuse of dominance that needs to be condemned. Otherwise, both data privacy and competition laws would lose out.
V. Conclusion
Enabling the gathering and combination of data can improve products and services and enhance consumers’ choice and user experience. In the authors’ view, by depriving business users of such opportunities, Apple’s new tracking prompt merely restricts competition (and thus increases existing data power) without achieving additional privacy protection of end users. Under EU privacy laws, end users already have to freely consent to the use of their data for advertising purposes based upon all relevant information. If Apple used the tools already available today as it pledges and openly advertises – to block access to the App Store for those apps that do not comply with EU privacy laws – there would not be an issue. In contrast to the objective of privacy laws to enable well-informed decisions, Apple’s abridged tracking prompt makes end users falsely believe that they can have it both ways – pay nothing for apps and disable targeted advertising. By leaving end users uninformed about the actual repercussions of their disabling of tracking, users that actually prefer free (ad-financed) apps over payment-based apps are misled into disallowing the combination of third-party data that forms the economic basis for their preferred ad-financed business model. As a result, instead of increasing end users’ data sovereignty, the Apple prompt will lead to higher costs, less choice and less competition to the disadvantage of everyone within Apple’s walled-off ecosystem, apart from Apple itself.
Prof. Dr. Thomas Höppner is a Partner and Philipp Westerhoff is a Senior Associate in the Berlin office.
Footnotes
[1] See A. Schiff (AdExchanger), Apple WWDC 2020: A Version Of Intelligent Tracking Prevention Is Coming To The App World, June 22, 2020, https://bit.ly/3hi7HRm.
[2] See Texas et al. v Google, Civil Action No.: 4:20-CV-957-SDJ, amended complaint (Mar. 15, 2021), https://bit.ly/3aYmAo6; See CMA, CMA to investigate Google’s ‘Privacy Sandbox’ browser changes, press release, Jan. 8, 2021, https://bit.ly/3xXbRnI. (“Their cases rely on the assumption that under the pretext of privacy, Google is foreclosing competition by creating a closed ecosystem (‘walled garden’) when advertising budgets are shifting towards Google.”)
[3] See Autorité de la concurrence, Targeted advertising / Apple’s implementation of the ATT framework. The Autorité does not issue urgent interim measures against Apple but continues to investigate into the merits of the case, press release, March 17, 2021, https://bit.ly/3tyunzl.
[4] See J. Espionza (Financial Times), German groups file Apple antitrust complaint as it makes privacy changes, Apr. 26, 2021, https://on.ft.com/3o4MFXJ. Disclaimer: The authors are representing this group of complainants.
[5] See Apple, User Privacy and Data Use, https://apple.co/3hfAEh1. See also Apple, Upcoming App Tracking Transparency requirements, Apr. 20, 2021, https://apple.co/3eyS6LB.
[6] The percentage of iOS LAT users increased from 16% at the start of 2019 to 25% in the middle of 2020, see Z. Bass-Specktor (AppsFlyer), Impact of Apple (iOS) Limit Ad Tracking on attribution, Apr. 5, 2021, https://bit.ly/3yaH3jk.
[7] E.g., Apple’s consent prompt to access a user’s location data. See Apple, About privacy and Location Services in iOS and iPadOS, https://apple.co/3vWd50D.
[8] See Apple, User Privacy and Data Use, https://apple.co/3hfAEh1.
[9] According to Apple’s guidelines, an app developer is not allowed to “precede the system-provided alert with custom messaging that could confuse or mislead people.” See Apple, Human Interface Guidelines - Accessing User Data, https://apple.co/2RaMxtK. According to industry reports, Apple interpreted this rule very widely and rejected a number of apps, see K. Madding (adjust), Opt-In Design Do’s & Don’ts for Apple’s App Tracking Transparency (ATT) on iOS 14, Feb. 11, 2021, https://bit.ly/2Q2IHlR.
[10] This only navigates the end user to the device’s system settings where the user can go through the burdensome process of finding the proper settings to re-enable tracking for the respective app.
[11] See n. 6, supra.
[12] See S. Axon (arsTechnica), 96% of US users opt out of app tracking in iOS 14.5, analytics find, May 7, 2021, https://bit.ly/3vRCTec.
[13] Daily updates on the opt-in rate are available here: https://bit.ly/3twgrG4.
[14] See E. Egan/ S. Satterfield (Facebook), A Path Forward for Privacy and Online Advertising, Oct. 2, 2020, https://bit.ly/3qTjRl1; See D. Levy (Facebook), Speaking Up for Small Businesses, Dec. 16, 2021, https://bit.ly/3eGQ0cV. This is consistent with findings from Google on the effect of disabling third-party cookies, also see D. Ravichandran/N. Korula, Effect of disabling third-party cookies on publisher revenue, Aug. 27, 2019, https://bit.ly/3qSnsQi.
[15] See https://bit.ly/3fn03CK for weekly updated data on the development of the relative cost-per-mille (CPM) of no-IDFA iOS traffic.
[16] EU Regulation No. 2016/679, https://bit.ly/3hBANvo.
[17] EU Directive 2002/58/EC, https://bit.ly/3fqo9wy.
[18] See Apple’s video on the tracking prompt released Apr. 26, 2021, https://bit.ly/3hDHwoq.
[19] Apple helped build this industry, e.g., by providing the IDFA in the first place, and did not raise any concerns for as long as it served its needs. In other words, for as long as Apple needed third-party tracking to make the entire ecosystem more attractive for all user groups, tracking using the IDFA was just fine.
[20] One of such industry solutions is IAB Europe’s “Transparency and Consent Framework” (“TCF”). The TCF is an industry tool that supports companies within the digital advertising ecosystem as they manage their compliance obligations under the GDPR and ePrivacy Directive when processing personal data or accessing and/or storing information on a user’s device, such as cookies, advertising identifiers, device identifiers, and other tracking technologies. A number of data protection authorities have been consulted during the development phase of the TCF, see https://bit.ly/3a9Vhqw.
[21] Apple, App Store, https://apple.co/3uHNYyC.
[22] According to Apple, “‘Tracking’ refers to linking data collected from your app about a particular end-user or device, such as a user ID, device ID, or profile, with Third-Party Data for targeted advertising or advertising measurement purposes, or sharing data collected from your app about a particular end-user or device with a data broker. “Third-Party Data” refers to any data about a particular end-user or device collected from apps, websites, or offline properties not owned by you.” See Apple, App privacy details on the App Store -Tracking, https://apple.co/3xUB961.
[23] Apple, Apple Advertising & Privacy, https://apple.co/3vXPkFI.
[24] Apple, Control personalized ads on the App Store, Apple News, and Stocks, https://apple.co/3o6Mz1T: “Turning off personalized ads will limit Apple’s ability to deliver relevant ads to you but will not reduce the number of ads you receive.”
[25] Recital (32) of the GDPR.
[26] See P. Schiller, Apple Fellow, May 18, 2021, testimony in Epic v. Apple (U.S.) as quoted by D. Atkins, Law360, Apple's Phil Schiller Defends Data Practices In Epic Trial, https://www.law360.com/amp/articles/1385816.
[27] A study found that “in the absence of tracking, economic power would concentrate in the hands of the largest four or five technology companies because they are independent of circulated tracking data.” See J. Deighton/ L. Kornfeld, The Socioeconomic Impact of Internet Tracking, Feb. 2020, https://bit.ly/3vQHFsu, p. 3.
[28] See, e.g. CMA-ICO, Competition and data protection in digital markets: a joint statement between the CMA and the ICO, May 19, 2021, para. 51, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/987358/Joint_CMA_ICO_Public_statement_-_final_V2_180521.pdfM. S. Gal/ O. Aviv, The Competitive Effects of the GDPR, Mar. 4, 2020, J of Comp Law & Econ (2020), https://bit.ly/3uZV2Xt; Also see C. Peukert/ S. Bechtold/ M. Batikas/ T. Kretschmer, European Privacy Law and Global Markets for Data, June 29, 2020, https://bit.ly/3hBMIcu, p. 25-26.
[29] “Freemium” is a business model whereby basic services are provided free of charge while more advanced features or upgrades must be paid for.
[30] See J. Deighton/ L. Kornfeld, The Socioeconomic Impact of Internet Tracking, Feb. 2020, https://bit.ly/3vQHFsu, p. 4.
[31] See id.
[32] See C. Tucker, Online Advertising and Antitrust: Network Effects, Switching Costs, and Data as an Essential Facility, CPI Antitrust Chron., Apr. 2019, p. 4-6.
[33] See CMA-ICO, n. 28, para 18.
[34] IAB, Latest Research Shows EU Citizens Understand and Appreciate the Ad-Supported Internet, Apr. 23, 2021, https://bit.ly/3hlvoZe.
[35] See id.
[36] See D. Ariely, Predictably Irrational, 2009, p. 57-60.
[37] See A. Bluestein/ R. Shields (Adweek) Apple Is Quietly Ramping Up Its Ad Game With Search Ads Expansion, Apr. 24, 2020, http://bit.ly/3rABYx0 (freely accessible under http://bit.ly/2OImGaU). Apple’s expansion plans are also evidenced by its current job openings, including more than 100 (software) engineers and analysts all around the globe to support its growing advertising platforms (as per May 11, 2021), see https://apple.co/3vV57VA. Recent hires include high ranking ads targeting experts, see M. Peterson (AppleInsider), Apple hires Facebook ads manager, 'Chaos Monkeys' author Antonio Garcia Martinez, May 10, 2021, https://bit.ly/3yd9ZHI.
[38] See Apple Inc. 2020 Form 10-K, https://bit.ly/33BvaVJ, p.1.
[39] See K. Duffy, Google paid Apple up to $12 billion for a search engine deal that disadvantaged competitors, landmark antitrust suit claims, Oct. 21, 2020, https://bit.ly/3y8QkZw.
[40] See P. Haggin (Wall Street Journal), Apple’s Privacy Changes Are Poised to Boost Its Ad Products, Apr. 27, 2021, https://on.wsj.com/3y2cOLx; Also see Reuters, Apple could raise annual ad income to $11 billion by 2025: JPMorgan, Nov.15, 2019, https://reut.rs/3rzjPQo.
[41] If demand for Google Ads (previously AdWords) increases, ad auction prices rise. Higher Google earnings from such ads will justify and ensure the high payments to Apple for using Google as default search engine, with no cannibalizing effects. Since Apple Search Ads are for apps and Google Ads for websites, Apple’s growth in App Store advertising does not question the de facto revenue sharing deal with its biggest revenue customer Google. Both tech giants have split up the markets for search-based advertising on mobile devices.
[42] See H. Murphy/P. McGee (Financial Times), Apple to boost ads business as iPhone changes hurt Facebook, Apr. 22, 2021, https://on.ft.com/3eXmNcv. Also see BBC, Apple puts more adverts in App Store after ad-tracking ban, May 5, 2021, https://bbc.in/3eznwkP, reporting on internal discussions on Apple’s hypocrisy in that regard. For a product overview see Apple, “Book Search tab campaigns”, https://apple.co/3f7HMZX.
[43] E. Seufert, as quoted in the Financial Times, see H. Murphy/P. McGee, Apple to boost ads business as iPhone changes hurt Facebook, Apr. 22, 2021, https://on.ft.com/2SQTC3a.
[44] With regard to Apple’s conscious lock-in strategy, see Apple-internal communication reveled in the process of Epic’s lawsuit about whether iMessage should be offered on Android, see J. Porter, Apple says iMessage on Android ‘will hurt us more than help us’, Apr. 9, 2021, https://bit.ly/2SLQ6Hq.
[45] See M. Vestager, EU Competition Commissioner, Making the data revolution work for us, Feb. 4, 2019, https://bit.ly/3u6zxTH.
[46] See CMA-ICO, n. 28, paras 19, 29; I. Graef/ T. Tombal/A. Steel, Limits and Enablers of Data Sharing – An Analytical Framework for EU Competition, Data Protection and Consumer Law, Nov. 2019, p. 3.
[47] See European Commission, Press Release, Antitrust: Commission opens investigations into Insurance Ireland data pooling system, May 14, 2019. [48] See European Commission, Guidelines on the applicability of Article 101 of the Treaty on the Functioning of the European Union to horizontal co-operation agreements, para. 57.
[49] See Autorité de la concurrence, 9 Sept. 2014 - GDF Suez, https://bit.ly/3osEPYr.
[50] See OECD, Data portability, interoperability and digital platform competition – Background Note, DAF/COMP(2021)5, p. 11-19, https://bit.ly/2RqrYJW.
[51] See ECJ, 6 Mar. 1974, case 6/73 – Commercial Solvents; 17 Feb. 2011, case C-52/09 – TeliaSonera; US: Eastman Kodak v Image Technical Services Inc, 504 US 541, 112 SCt 2072 (1992).
[52] This distinguishes the case, in particular, from a refusal to deal. It is not about Apple refusing to share any data it collected with rivals. It is about Apple placing an artificial barrier between app developers and its end users so that the former may no longer gather the data from the latter to adjust its offerings to their needs.
[53] See E. Douglas, The New Antitrust/Data Privacy Law Interface, The Yale Law Journal Forum, Jan. 2021, p. 647-683.
[54] European Commission, Oct 3, 2014, M.7217, para. 164 – Facebook/WhatsApp.
[55] ECJ, Nov. 23, 2006, case C-238/05, para. 63 – Asnef-Equifax/Ausbanc “any possible issues relating to the sensitivity of personal data are not, as such, a matter for competition law, they may be resolved on the basis of the relevant provisions governing data protection.”
[56] FTC, 11 Dec. 2017, File No. 071-0170, p. 2 – Google/DoubleClick, “Not only does the Commission lack legal authority to require conditions to this merger that do not relate to antitrust, regulating the privacy requirements of just one company could itself pose a serious detriment to competition in this vast and rapidly evolving industry”.
[57] E. Douglas, n. 53, p. 681.
[58] See CMA-ICO, n. 28, p. 18 et sub.; German Federal Supreme Court, 23 June 2020, KVR 69/19 – Facebook, para. 123. On consumers’ sovereignty of decision-making as an objective of digital antitrust law, see also J. Crémer/ Y. de Montjoye/ H. Schweitzer, Competition Policy for the digital era, 2019, p. 77; see also P. Marsden/ R. Podszun, Restoring Balance to Digital Competition, 2020, p. 39, 46-48.
[59] German Federal Supreme Court, 23 June 2020, KVR 69/19 – Facebook, at para. 123.
[60] CMA-ICO, n. 28, para. 82, see also paras 77-78.
[61] E.g., IAB’s TCF 2.0, see n. 20, supra.
[62] As in German Federal Supreme Court, 23 June 2020, KVR 69/19 – Facebook.
[63] This may justify, for instance, the envisaged prohibitions for digital gatekeepers regarding the combination and use of data in Article 5 (a) and 6 para. 1 (a) of the proposed EU Digital Markets Act.
[64] T. Körber rejects (even) such power as the balancing of affected interests would be a task for the legislator (see Körber, Is Knowledge (Market) Power?, p. 30 https://bit.ly/3ykWrKk). This argument must, even more so, preclude undertakings’ competence to set new privacy standards.
[65] See, to that effect, the EU Commission’s Communication on the Commission's enforcement priorities in applying Article 82 of the EC Treaty to abusive exclusionary conduct by dominant undertakings (2009/C 45/02), para. 29: “It is not the task of a dominant undertaking to take steps on its own initiative to exclude products which it regards, rightly or wrongly, as dangerous or inferior to its own product” (with references to EU jurisprudence).
[66] See, e.g., French Tribunal de Commerce de Paris, Feb. 10, 2021 – Oxone v Google, https://bit.ly/33JJjAo, at para. 40, ruling that where consumer protection is already ensured by an official control mechanism, a dominant undertaking may not use consumer protection as a justification to evict business users for alleged ignorance of consumer interests.
[67] See CMA-ICO, n. 28, para. 17.