French antitrust watchdog fines Apple €150M for App Tracking Transparency implementation
12 points by Signez
12 points by Signez
While advertising tracking only needs to be refused once, the user must always confirm their consent a second time. The resulting asymmetry prevents the informed consent that ATT is supposed to facilitate.
I don’t know if I would agree with this - the only asymmetry that runs afoul of Recital 32 and 42, and Article 7, is if it’s easier to consent than not consent, as it runs counter to the idea that consent “should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication”. If it’s harder to consent than not consent, it would be even more unambiguous, no?
Of course, CNIL (who has given their input on this, as the press release mentions a “2022 opinion”) may have come to a different conclusion. GDPR is annoyingly fuzzy at times.
For several players, including Ad4Screen, the loss of business for smaller players should be contrasted with “players with their own data ‘ecosystem’ [that] can leverage their position to strengthen their offering without using IDFA or cookies”. This player cites, in particular, the example of Meta and Google, which can track users’ journeys after they have seen an advert.
It’s somewhat funny that they would mention a “player” that has a non-compliant CMS, where they ask you to accept cookies to remember your preferences and repeat visits, but if you click agree, it flags that you’ve given consent to marketing cookies, including the targeted advertising cookie that DoubleClick uses.
While advertising tracking only needs to be refused once, the user must always confirm their consent a second time. The resulting asymmetry prevents the informed consent that ATT is supposed to facilitate. I don’t know if I would agree with this - the only asymmetry that runs afoul of Recital 32 and 42, and Article 7, is if it’s easier to consent than not consent, as it runs counter to the idea that consent “should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication”. If it’s harder to consent than not consent, it would be even more unambiguous, no?
I’ve been a bit surprised by this too and found it an interesting take to answer all the people who complain about GDPR: both option have to be treated the same, not just refusing. There is little room to complain there.
I think you also need to read that in the context of the whole decision: apple makes consent collection more difficult for others than for themselves.
Also, Autorité de la Concurrence is more concerned about economics than privacy which is CNIL’s topic and this decision is first about whether other players have been disadvantaged.
What I find interesting however is that this “pro-business” decision is probably not really in conflict with “pro-privacy” takes. An outcome could have been “stop ATT” which I don’t think happened. Instead, they still need to collect consent properly and that gives room for people to not consent, maybe including to Apple’s requests.