Apple deserves €6 million fine for privacy violations, French data protection adviser says

Apple should be fined €6 million ($6.3 million), the chief adviser to the French data protection regulator has recommended, for failing to properly notify users of apps tracking them. 

The recommendation was made on Monday by Francois Pellegrini, the rapporteur to the CNIL (Commission nationale de l'informatique et des libertés), following a complaint against Apple issued by France Digitale, an industry lobby group.

Apple prohibits advertisers from accessing what it calls the Identifier for Advertisers (IDFA) — a unique device identifier which can be used to target ads to each device — without explicit consent from users. However, it did not apply the same standards of prior consent to its own apps and services, according to France Digitale and Pellegrini.

The company’s App Tracking Transparency (ATT) feature rolled out as part of iOS 14.5 last year. It prompts iPhone users, when opening newly downloaded apps, to ask whether they would like to opt in to allow that app to track its activity across other apps and websites.

At the time the feature was announced it was harshly criticized by Facebook’s founder and chief executive Mark Zuckerberg who said Apple's commitment to privacy was covering business decisions that "clearly track their competitive interests."

Pellegrini argued that as recently as iOS 14.6, Apple was at the same time failing to ask users for their consent for its own apps and services, which he said was in breach of the European Union’s ePrivacy directive. It resulted in targeted advertisements on the App Store.

Pellegrini said that the more recently released iOS 15 has fixed the privacy breach. Although his recommendation is not decisive, the CNIL typically concurs with the findings of its rapporteur. 

Apple’s head of privacy, Gary Davis, contested Pellegrini’s argument and stressed that the company was committed to the privacy of its users. He called for the fine to be decreased because there was no “seriousness to the breach” and also requested for the ultimate fine amount to not be made public.

In a statement the company said that France Digitale’s complaint has no legal merit and is “misguided in its intent.”