App Tracking Transparency (ATT) and GDPR consent are two separate permissions. ATT is Apple's App Store rule that an iOS app must ask before tracking a user across other companies' apps and websites or reading the device's advertising identifier. GDPR consent, together with Article 5(3) of the ePrivacy Directive, is the EU legal requirement to ask for specific, informed consent before tracking. An app with users in the EU usually needs both: its own consent dialogue for each purpose, and Apple's ATT prompt for cross-app tracking.
ATT and GDPR are not the same thing
Apple's App Tracking Transparency framework, introduced with iOS 14.5 in April 2021, requires apps to ask permission before tracking users across other apps and websites. The prompt is binary: allow or deny. The GDPR, by contrast, is a legal framework that governs all personal data processing within the EU and EEA, covering far more than tracking.
Confusing these two systems is common. Both involve asking users for permission. Both use opt-in models. But they differ in scope, legal standing, granularity, and enforcement.
ATT is a platform-level technical control created by Apple. It determines whether an app can access the Identifier for Advertisers (IDFA) on a user's device. The GDPR is an EU regulation adopted by the European Parliament and the Council in 2016. It applies to organisations established in the EU and, under Article 3(2), to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour. One is a company policy enforced through App Store review. The other is law enforced by data protection authorities with the power to issue fines up to 4% of global annual turnover under Article 83.
Getting this distinction wrong has real consequences for app developers and website owners alike.
What ATT controls
ATT governs access to the IDFA - a unique device-level identifier that enables cross-app and cross-site tracking on iOS. When a user taps "Ask App Not to Track", the app receives a string of zeros instead of the real IDFA and may not track the user.
Apple defines tracking precisely. According to Apple's User Privacy and Data Use page, tracking "refers to the act of linking user or device data collected from your app with user or device data collected from other companies' apps, websites, or offline properties for targeted advertising or advertising measurement purposes." Sharing user or device data with data brokers is tracking too.
ATT does not cover first-party data collection within your own app. If your app collects analytics data and keeps it in-house without linking it to other companies' data, ATT does not apply to that activity. This is a much narrower scope than the GDPR.
What GDPR and the ePrivacy Directive require
The GDPR applies to all processing of personal data - not just tracking, not just advertising. Where consent is the legal basis, it must be freely given, specific, informed, and unambiguous. Users must understand what they are consenting to, which controller is processing their data, and for what purposes.
The ePrivacy Directive adds another layer. Article 5(3) requires consent before storing or accessing information on a user's device - this covers cookies, local storage, session storage, and device identifiers like the IDFA itself.
Where ATT offers a single binary prompt, the GDPR requires consent by purpose. A user should be able to accept analytics while rejecting advertising. ATT provides no mechanism for this distinction, so an app operating in the EU needs a separate consent layer that handles purpose-specific consent, even if ATT is already implemented.
Side-by-side comparison
| Aspect | App Tracking Transparency | GDPR and ePrivacy |
|---|---|---|
| Type | Platform policy (Apple) | Legislation (EU and EEA) |
| Scope | Cross-app and cross-site tracking, IDFA access on iOS | All personal data processing by any means |
| Consent model | Binary (Allow or Ask App Not to Track) | Granular, purpose-specific |
| Legal bases | Only permission | Six legal bases under Article 6 |
| Covers first-party analytics | No | Yes, if personal data is processed |
| Enforcement | App Store rejection | DPA fines up to 4% of global turnover |
| Geographic reach | All iOS users globally | People in the EU and EEA (regardless of company location) |
| Withdrawal of consent | Via iOS Settings per app | Must be as easy as giving consent |
| Information requirements | Short prompt with optional custom string | Full transparency: controller identity, purposes, recipients, retention |
Two permissions before an EU iOS app tracks
What the ATT prompt does not carry
The ATT prompt does not meet the GDPR's standard for informed consent on its own. The GDPR requires that users know the identity of each controller, the specific purposes of processing, the categories of data involved, and how long data is kept. ATT's single-sentence prompt cannot convey all of this.
ATT also ignores legal bases other than consent. Under the GDPR, processing can be lawful under legitimate interest, contractual necessity, or legal obligation - none of which ATT accounts for. These are separate decisions: an app may rely on one legal basis for some processing and still need ATT permission for IDFA access.
The IAB Transparency and Consent Framework (TCF) adds a further layer. Apps serving programmatic advertising in the EU through the framework need TCF v2.3 consent strings that record vendor-level permissions, and v2.3 strings have been mandatory since 28 February 2026. ATT's binary signal cannot produce a valid TCF consent string.
ATT opt-in rates and their impact
Opt-in rates for ATT vary widely by app category and by how the request is presented. Developers who explain what the user gains before Apple's system prompt appears have generally reported higher rates than those who show the prompt cold, but published figures come from industry measurement firms and change from year to year.
Low opt-in rates cut the data available for advertising measurement. This has accelerated the shift towards first-party data, server-side tagging and modelled conversions to fill the gaps.
Competition authorities pushed back against ATT
ATT has drawn scrutiny from competition authorities rather than privacy regulators. On 31 March 2025, France's competition authority fined Apple 150 million euros, finding that the way ATT was implemented was neither necessary for nor proportionate to its stated aim of protecting personal data. It pointed to multiple consent pop-ups, a design where accepting tracking took an extra confirmation step, and lighter requirements for Apple's own apps.
Italy's competition authority, the AGCM, fined Apple about 98.6 million euros in December 2025. It found that the ATT prompt did not meet privacy-law requirements, so developers had to ask users twice for the same purpose, and that the rules were disproportionate to their privacy goal.
Germany took a different route. The Bundeskartellamt sent Apple a preliminary assessment in February 2025, and on 17 August 2026 it made Apple's commitments binding and closed the proceeding without a fine. Apple committed to neutral consent prompts for its own and third-party apps, to remove discouraging symbols and wording, and to let app publishers combine Apple's request with their own data protection consent request. Apple has four months from service of the decision to make the changes, and the commitments run for seven years.
As of October 2026, the core complaint across these cases is not that ATT asks for consent - it is that Apple applied a stricter consent standard to third-party apps than to its own services.
Practical implementation for app developers
If your app has users in the EU, plan for both ATT and a consent mechanism that meets the GDPR's standard. The typical flow works as follows:
- Show your own consent dialogue first, covering each data processing purpose with granular opt-in controls
- If the user consents to advertising or tracking purposes, trigger the ATT prompt
- Activate cross-app tracking only if both the GDPR consent and the ATT permission are granted
- Store and respect the records of both choices independently
For websites rather than apps, ATT is irrelevant. Websites operate in browsers, not the iOS app environment, and cannot access the IDFA. Website owners need a cookie banner that handles GDPR cookie consent and, depending on their audience, opt-out rules such as the CCPA's.
Handling the "double consent" problem
Users in the EU who meet both a GDPR consent dialogue and an ATT prompt may experience consent fatigue. This double request is what Italy's competition authority criticised. The practical answer is to join the two flows so the user sees one coherent consent journey rather than two disconnected prompts, which Germany's commitments now allow.
Pre-permission screens - shown before the ATT system prompt - can explain why tracking permission is requested and what the user receives in return. This also helps meet the GDPR's requirement that consent is informed.
Questions about ATT and GDPR
Does App Tracking Transparency replace the need for a cookie consent banner?
No. ATT only controls tracking and access to the IDFA within iOS apps. Websites do not use the IDFA and are not affected by ATT. Even within apps, ATT does not meet the GDPR's requirement for granular, purpose-specific consent.
Do I need ATT consent if my app only collects first-party analytics?
If your analytics data stays within your app and is not linked with other companies' data for advertising or shared with data brokers, ATT does not apply. You may still need GDPR consent for processing personal data through analytics.
Can ATT consent count as GDPR consent for tracking purposes?
Not on its own. GDPR consent must be specific, informed, and granular by purpose. The ATT prompt is binary and does not identify individual data controllers or processing purposes in the detail the GDPR requires.
What happens if a user allows ATT but rejects GDPR tracking consent?
You must respect the more restrictive choice. If GDPR consent for advertising is denied, you cannot use the IDFA for advertising even if ATT access is granted. Both permissions must be in place for cross-app tracking to be lawful in the EU.
Is Apple removing ATT in the EU because of competition fines?
No withdrawal has been announced. Instead, in August 2026 Germany's Bundeskartellamt made Apple's commitments to change the ATT prompts binding. The French and Italian fines concern competition law and Apple's unequal treatment of its own services, not the idea of asking for tracking consent.
Does ATT apply to Android apps?
No. ATT is an Apple-only framework for iOS, iPadOS, and tvOS. Android uses its own advertising ID, which users can reset or delete, but Android does not use a mandatory pre-tracking prompt like ATT.
Check what your website tracks before visitors choose
Whether your users arrive through a browser or a native app, consent is your responsibility. For your website, Kukie.io finds and sorts the cookies and trackers it sets and holds the non-essential ones until visitors choose.
