Apple ATT Changes in the EU: What App Publishers Need to Do

Apple is redesigning the App Tracking Transparency prompt for EU end users after a Bundeskartellamt decision. This post explains what is changing, who is affected, the three options for app publishers, and the setup Usercentrics recommends.

Apple is changing the App Tracking Transparency (ATT) prompt for iOS audiences in the EU. In Germany, France, Italy, Poland, and Romania, it automatically replaces the current prompt in every app that uses ATT. In the rest of the EU, apps can choose between the current prompt and the new one. What your app shows in the new prompt, and when, is up to you as the app owner.. The setup we recommend is short. Show your Consent Management Platform (CMP) first, trigger the ATT prompt when someone selects Accept All, and reference the consent they have already given in the text Apple displays. Nothing about your CMP changes.

The change follows a decision by Germany’s Federal Cartel Office, the Bundeskartellamt, and Apple is due to implement it by mid-December 2026. If your app has a large German audience, it is worth settling on an approach now, even though Apple’s final build is still being tested.

How Do ATT and Your CMP Work Together?

ATT is Apple’s system permission for tracking. Apple introduced it with iOS 14.5 in April 2021, and it asks people whether an app may track them across apps and websites owned by other companies. iOS shows the prompt, and the app supplies a short text, called the purpose string, that explains why it is asking.

A CMP does a different job. It collects consent under laws such as the General Data Protection Regulation (GDPR) and the ePrivacy Directive, for specific purposes and vendors, and it records the choice. For apps that take part in programmatic advertising, that usually means a TCF setup. The CMP is how you collect consent under European law, and ATT is Apple’s own platform requirement.

Until now, that meant two consent moments in a row, each with its own wording and design. The decision described below targets exactly that overlap.

Why Is Apple Changing the ATT Prompt in the EU?

On 13 August 2026, the Bundeskartellamt declared binding a set of commitments from Apple on how ATT works. The decision followed complaints from German industry associations, including BVDW, BDZV, and ZAW. The regulator announced it on 17 August 2026 in its official press release.

The concern was that Apple’s own services used a different consent prompt from the one third-party apps had to show. The regulator found that the wording, design, and choices in Apple’s own prompt could encourage consent, while the third-party version could discourage it. Third-party apps also sometimes had to ask again even after valid consent had been given.

The proceeding examined competition law, not data protection law. The regulator was explicit that its aim is not to maximize consent rates. The aim is a free and informed choice for every person, whether they accept or decline.

What Apple Has Committed To

Apple’s commitments cover five areas that matter to app publishers:

• Neutral wording and design: possibly discouraging symbols and wording are removed from the prompt that third-party apps show.
• A closer match to Apple’s own prompt: the prompt for Apple’s own advertising and the third-party prompt move much closer together.
• A longer purpose string: the text you supply to explain why you ask for permission can use Markdown formatting, appears on a full-page sheet, and can reference consent you have already collected. 
• An optional Additional Information button: it opens a second layer that your app controls.
• A yearly re-prompt: in the EU, apps can ask again one year after the person’s last answer, whether they allowed or declined.

The commitments run for seven years under an independent monitoring trustee. Apple has four months from service of the decision to implement them, which is why mid-December 2026 is the date to plan around.

Poland Follows With Its Own Decision

On 20 October 2026, Poland’s competition authority, UOKiK, announced a decision that makes similar commitments from Apple binding in Poland. It applies to people whose Apple Account has a billing address in Poland and whose device location is set to Poland.

Germany and Poland are two of the five countries where Apple lists the new prompt as the only version available, together with France, Italy, and Romania. In all five, the new prompt is the required approach for any app that uses ATT.

Who Is Affected by the New ATT Requirements?

The scope follows the end user, not the app publisher. Apple applies the changes based on the billing address on a person’s Apple ID and the location of their device, so where your company is based does not decide whether you are affected.

The redesigned prompt is mandatory in Germany and, according to Apple’s developer documentation, in France, Italy, Poland, and Romania. Across the rest of the EU, it is available as an option. If your iOS audience includes people in those five countries, plan to adapt your flow.

Because the prompt is optional elsewhere in the EU, you can choose between running one flow across all EU markets or a separate flow for the five countries. Which is simpler depends on how your app is built, and your app team is best placed to judge.

What This Means for Germany-Heavy Apps

Germany is where the decision was made and where the prompt is mandatory. Apps with a large German iOS audience therefore have the clearest reason to act now.

Look at how your audience splits across the five countries rather than assuming. If most of your iOS audience sits in Germany, the new prompt will reach most of the people who see your consent flow, and the setup you choose will shape what they experience.

What Are Your Options?

App publishers have three realistic options. They differ mainly in how the CMP and the ATT prompt work together, and in what each one means for your TCF setup.

Option 1: Use ATT as the Consent Step

In this setup, the ATT prompt stands in for the CMP’s own consent step, and the result is passed on to the CMP. It looks simple because it removes one screen. In our assessment, however, it does not meet TCF requirements, because an Apple system prompt cannot replace the consent interface a CMP provides. We do not recommend it.

Option 2: Reference Your CMP Consent in the ATT Prompt

Here, the CMP collects consent first. The ATT prompt then appears with a purpose string that references the consent already given, using the longer text Apple now permits. The CMP stays separate, and your TCF setup does not change. People see two connected steps instead of two unrelated ones. We expect most app publishers to choose this option.

Option 3: Keep Separate Prompts With the New Wording

You keep today’s flow, and Apple’s new wording applies. The CMP and the ATT prompt remain two separate steps with no reference between them. This asks the least of your app team, which makes it a reasonable interim choice while Apple’s build is still being tested. The trade-off is that the two prompts stay disconnected.

How Do the Options Compare?

The table below sets the three options side by side.

Option	What Happens	TCF Fit	Where It Fits
1. ATT as the consent step	ATT replaces the CMP’s choice screen	Does not meet TCF requirements	Not recommended
2. ATT references CMP consent	CMP first, then ATT referencing that consent	Your TCF setup stays unchanged	Our recommendation
3. Separate prompts, new wording	Two prompts with no reference between them	Your TCF setup stays unchanged	Acceptable for now

What Setup Does Usercentrics Recommend?

We recommend Option 2: CMP first, ATT on Accept All, and consent referenced in the Apple purpose string. It keeps the consent decision in one place, the CMP, and gives the ATT prompt a clear reason to appear. The Apple text can say that the person has already made a choice, rather than asking the question from scratch.

Putting the CMP first also keeps the order of events easy to follow. The person makes their consent choice in the CMP, and the ATT prompt that follows is a platform step that refers back to it. That is the sequence Apple’s longer purpose string makes possible, and it is the reason we expect most app publishers to move to this option.

What the Flow Looks Like

The flow has three parts:

1. The CMP banner appears first and collects consent as it does today.
2. When the person selects Accept All, the ATT prompt follows.
3. The Apple purpose string references the consent already given.

What Stays the Same, and Who Does the Work

The CMP stays separate throughout, so you do not need to rebuild your flow or touch your TCF consent setup. What changes is in your app: when the ATT prompt is triggered, and what the purpose string says.

Apple’s optional Additional Information button opens a second layer that your app controls. You can leave it out, and it does not change the CMP-first flow.

That work sits with your app team, because the change is made in your app, not in the CMP. Apple’s implementation is still in testing, so details may shift before the final build. If you would rather wait, staying on separate prompts for now is fine.

What Should App Publishers Do Now?

Start by confirming with your app team whether your iOS audience includes people in Germany, France, Italy, Poland, or Romania. Then read Apple’s developer documentation and decide between the options above. Because Apple’s changes are due by mid-December 2026, there is time to plan rather than rush. Whichever option you choose, write down the decision and the date, so your team can revisit it when Apple’s final build arrives.

Bring your legal or privacy team into the decision as well, since the option you choose changes how your consent flow is presented to people in the EU. If you do not use a CMP built for apps yet, now is a sensible moment to look at one that collects consent first and leaves your TCF setup untouched.

For Usercentrics customers, your Customer Success Manager can share our step-by-step iOS ATT implementation guide.