.svg)
We recently shared information about Apple’s decision to update its App Tracking Transparency (ATT) framework, which requires apps to ask permission before tracking a user's activity across other companies' apps and websites for personalized advertising.
Germany’s competition authority, the Federal Cartel Office (FCO) or Bundeskartellamt, initiated the change in a decision expressing concerns that Apple gave its own app a competitive advantage by requesting consent differently for its own apps and for third-party apps.
We now have more visibility into Apple’s plans for ATT, including how the new prompt works, how it interacts with the CMP banner, what countries are concerned, and what companies should start doing now. Find it all in this article.
iOS 27.2: What changes for ATT?
Following the initial announcement from Apple that ATT will be updated to address the Bundeskartellamt concerns, the company released more information in its recent iOS & iPadOS 27.2 Release Notes and across its documentation:
As part of agreements with select European competition authorities, Apple is introducing changes to its App Tracking Transparency framework in the European Union. Beginning with iOS 27.2 and iPadOS 27.2, developers will have the option to use an alternative version of the App Tracking Transparency system prompt in the EU.
- Apple, User privacy and data use (Source: Apple Developer documentation)
The company is introducing a new, expanded prompt, required in 5 countries (France, Germany, Italy, Poland, and Romania) where it’ll appear automatically (even with the old ATT call), and optional elsewhere in the European Union (EU). Outside of the EU, the current ATT prompt remains the same.
As anticipated in our initial reporting, the new prompt has also been updated visually. Instead of a small alert with a short question, it now features a full-page interface asking for permission to link users’ activity with data from other companies (rather than “tracking”). The prompt also shows two buttons (“Allow” and “Reject” instead of “Ask app not to track”), and app publishers can add their own wording, plus an optional “Additional information” link (which will allow app publishers to link the ATT prompt to the CMP banner).
How does the new ATT prompt work with a consent banner?
Beyond how it looks, how does the new ATT prompt behave when users respond to it? Linking it to your consent banner is optional. The table below shows what happens with each choice, including when the two are connected:
Considering that linking the prompt to your banner is optional, what are some of the potential benefits for publishers to do it?
Why link the new ATT prompt with your consent banner?
Until now, app publishers have had to ask users twice, once through the ATT prompt to access the IDFA and once through the CMP banner for consent under data protection law.
The new ATT prompt lets publishers combine the two by customizing the explanation text and adding an “Additional information” link, creating a single prompt that can carry both questions, either through the text itself or by opening the consent banner.
Linking them is optional, but publishers that take this route may see reduced consent fatigue and a higher overall consent rate by asking one question instead of two.
Open questions that remain to be clarified
Although Apple's latest communications brought a lot of clarity about the next evolution of its ATT framework, some questions remain open-ended, including how a framework like the Transparency and Consent Framework (TCF) would work with the new prompt, and how much CMPs will be able to record from the prompt (for versioning and proof of consent purposes, for example). Despite these gaps, our Chief Privacy Officer sees the direction as positive for publishers:
As usual, Apple communicates poorly and works badly with the industry, probably on purpose, so as not to make life easy for the app publishers who depend on it. It is still a step forward. ATT was never required by the GDPR in the first place, which means publishers can now link their CMP banner to the ATT prompt to reduce the consent fatigue Apple created and lift their opt-in rates. Good work by the Bundeskartellamt.
- Thomas Adhumeau, Chief Privacy Officer at Didomi
What that means for you depends on where your users are and how you manage consent today.
What should app publishers do now?
What you need to do depends on where your users are, and how you manage consent today. Starting with your users:
- Your app has no users in the EU: Nothing changes for you. Outside of the EU, the current ATT prompt remains the same.
- You have users in the EU, but none in France, Germany, Italy, Poland, or Romania: The new ATT prompt is optional, so you can keep the current one or adopt the new one and, if you link it to your consent banner, ask users once instead of twice.
- You have users in France, Germany, Italy, Poland, or Romania: Your users will see the new ATT prompt once iOS 27.2 reaches their devices, regardless of whether you update your app. Test how your app behaves, and decide whether to add your own explanation text and link your consent banner to the ATT prompt.
Now, regarding your consent management setup:
- You’re a Didomi customer: Your app shows the ATT prompt, not the Didomi SDK, so your current setup continues to work once your users update to iOS 27.2. You have the option to connect the prompt and your consent banner using the “Additional Information” button by using Apple’s new API and providing the explanation text. Learn more in our documentation.
- You use a CMP other than Didomi: Ask your CMP provider how it plans to support updates to Apple ATT, and how it ensures that consent collected through the new prompt is recorded. If you’re looking to switch to Didomi, learn how.
- You don’t have a CMP: The changes to ATT don’t change your obligations and requirements under applicable data protection laws. Research whether you need to collect valid user consent to process data for advertising, and compare your options in our guide to the best CMP for mobile apps in 2027.
Importantly, our product team is already working on this, and we’ll share more as soon as we can:
We’ve already started reviewing Apple’s technical specifications and are working to ensure Didomi works smoothly with the new ATT prompt. Your current setup keeps working as it does today, and connecting the prompt to your Didomi banner is optional. We’ll keep our customers informed well ahead of any change.
- Safaa E., Product Manager at Didomi
We will continue to monitor the situation and communicate as more information comes out, including implementation steps. Follow us on LinkedIn and subscribe to our monthly newsletter to stay in the loop:
{{sign-up-didomi-newsletter}}
Apple ATT: Frequently asked questions (FAQ)
Is the new ATT prompt mandatory?
In France, Germany, Italy, Poland and Romania, users will see the new prompt once they update to iOS 27.2, whether or not you update your app. In the rest of the EU, the new prompt is optional, and the current prompt stays the same outside the EU.
Does ATT replace a CMP?
No. ATT controls access to the IDFA, while consent under EU data protection law is a separate requirement. Linking the two prompts can streamline the experience, but the new ATT prompt doesn’t remove the need for a valid consent mechanism where the law requires one.
How often can the ATT prompt be shown in the EU?
Once a user answers, the app can’t show the prompt again for 12 months. This timing is separate from your CMP’s consent expiration settings.
Do I need to update my app for the new prompt?
In the five countries where it’s required, the new prompt appears automatically. You only need to update your app if you want to add your own explanation text and the “Additional information” link, which requires Apple’s new API.
