Big Tech's Summer of Reckoning: Apple's ATT, Google's AI Overviews and Child Safety on Meta's Apps

Every month, the Privacy Gazette unpacks the developments stirring the global data protection community. Built on the expertise of Pascal Vautrin, our Privacy Standards Expert at Axeptio, it revisits the sector's most technical news to examine its regulatory implications, along with the social, economic and geopolitical ones. And it is fair to say this summer has been a turbulent one on the international front, with several decisions that could set a precedent for Big Tech.

In the space of six weeks, the Bundeskartellamt finally ruled, after four years of proceedings, on the way Apple frames consent inside mobile apps; Google switched on its AI summaries in France, only to find itself before the competition authority; and Meta agreed to pay up to $18 billion to settle a federal case over the risk its apps pose to minors.

Is Apple's ATT on Its Way Out in Germany? Early Signs of a Major Win for Publishers

As our more dedicated readers will have seen in the op-ed we published a few days ago, on August 17 the Bundeskartellamt, Germany's federal competition authority, closed the case it opened in 2022 against Apple's App Tracking Transparency framework, attaching a few conditions to the commitments Apple had put forward.

The complaint is one of unequal treatment, and to grasp it you need to look separately at the screens a user is shown the first time an app is opened.

An app publisher is free to design its own consent interface, the one that collects the preferences the GDPR requires. The trouble starts on the next screen: to read the device's advertising identifier, Apple adds a system prompt that the publisher has no say over. Apple sets the title, and Apple sets the wording of both available answers.

Apple asks the same question on its own behalf, since it sells advertising too. For itself, though, it does not use that prompt: it displays its own screen, with wording of its own choosing. That wording encourages users to allow tracking, where the prompt imposed on third-party apps discourages them. Two interfaces for one and the same question, both designed by the gatekeeper, and only one of them steering the user toward yes. That asymmetry is what the German regulator objects to.

Apple now has four months to:

• remove from the prompt imposed on third-party apps any wording likely to discourage consent;
• give publishers a voice, so that they can explain to users what personalized advertising actually pays for on their app. The authority points specifically to news publishers;
• simplify the sequence of requests third-party apps have to run, by allowing Apple's request to be combined with the ones the CMP calls for.

Three configurations are therefore possible:

1. a single screen, merging the ATT request and the CMP's;
2. two separate steps, ATT then CMP or CMP then ATT, with a dedicated flow for cases where the two answers do not match (the user refuses tracking on the ATT screen but accepts targeted advertising in the CMP);
3. two separate steps with no warning message, in other words today's flow stripped of its discouraging elements.

Who Comes Out Ahead

The rebalancing works, by construction, in favor of ad-funded publishers, who take back control of a journey that until now was imposed on them.

On consent management itself, publishers can lean on CMPs: the only players who handle the fine detail of compliance, paid the same whether the user says yes or no, and able to keep out the dark patterns that might have bought a few opt-in points in exchange for very serious exposure to enforcement and fines.

For ad networks, the deck is reshuffled. As a reminder, behind the ATT screen sits the IDFA, the advertising identifier every iPhone assigns to its owner and the thing that lets an ad network recognize the same user from one app to the next. Without permission, an advertiser buys inventory without knowing who is on the other side of it, and pays a great deal less for it.

The consultants at gameBiz measured that gap across fifteen apps in their portfolio, gaming and non-gaming, between January and July 2026. Roughly 80% of ads there are served with no identifier, and those that do carry one earn the publisher 40 to 80% more per thousand impressions depending on the format.

Five years of mass refusals have therefore cost publishers dearly, and shifted the balance between ad networks: Google and Meta, whose targeting leans most heavily on that identifier, saw their performance slide from 2021 onward, while AppLovin, which delivers solid results without it, has taken the lead on iOS.

Where the European CMP Association Stands

The ECMPA, chaired by Axeptio since June, has publicly set out its position on the decision. The association reads it as a restatement of the principles it has argued for since it was founded: interoperability, fairness and neutrality in the way consent is designed.

The decision applies only in Germany for now, but Apple had already been fined over ATT in 2025 by the French competition authority, for €150 million, and by its Italian counterpart, for €98 million.

The association points out that comparable proceedings remain open elsewhere in Europe, and that the question now is whether the German decision becomes the European norm, and with it a useful precedent while the debate on consent continues within the Digital Omnibus.

ATT Is Not the Only Interface That Constrains Publishers

The German case raises the question of how neutral, and how fair, an interface can be when it is designed by players whose members depend on the user answering yes.

It is hard not to think of the Transparency & Consent Framework, and the way it prescribes for publishers and their CMP the list of purposes, the vocabulary, the granularity and the format of the signal to be passed on, the TC String. It was built by the advertising industry's own trade body, the IAB, to meet a technical need on the buy side: a consistent, readable signal from one site to the next. What that standard does, though, is prevent publishers from adjusting the message, leaving users to face the same static format from one content site to another.

So IAB Europe writes its rules without answering for what they produce at the user's end. Prescribing the interface without owning its consequences: that, more or less, is what the Bundeskartellamt has just held against Apple.

AI Overviews Make their Debut in France, and the Press Goes Back to the Competition Authority

On July 22, Google switched on AI Overviews in France, placing a summary generated by its Gemini model at the top of the results page. The feature had been running in more than a hundred countries since May 2024 before finally arriving in France.

That late arrival comes down to the question of related rights for press publishers, on which Google has already been fined by the Autorité de la concurrence.

For publishers, this is another blow to the model. Answering every search with a summary reduces organic traffic to news sites, one of the main levers of their business.

How much traffic is being lost has not yet been measured in France. Elsewhere, early analyses put the fall at between 30 and 50% in the worst cases. Online retail is faring better: organic traffic losses there are estimated at 15 to 20%, but the visitors who remain arrive better qualified, which should push conversion rates up.

Three trade bodies, led by APIG, the alliance of French general news publishers, have announced a joint observatory to track how this develops, and have filed a fresh complaint with the Autorité de la concurrence. A certain sense of déjà vu.

Scroll Responsibly: Meta Held Liable Over the Addictive Design of Its Products

On August 7, a New Mexico court ordered Meta to pay $942 million for failing to warn the public about the dangers its platforms present for children.

The products were found to be addictive on account of infinite scroll, likes and notifications, all of which push younger users to stay on the platform.

All told, 29 states fully intend to take Meta to court, California first among them. But that case never reached a verdict. On August 26, Meta settled for $18 billion, along with a series of commitments meant to limit the effect on the next generation: a default two-hour daily usage cap on teen accounts across Facebook and Instagram, a nighttime lockout from midnight to 6 a.m., notifications switched off during school hours, like counters hidden by default including on users' own posts, and age verification.