Today, we\u2019d like to share a story that sits at the intersection of privacy, regulation, and business impact \u2014 and it\u2019s a good example of how even well-intentioned security and privacy controls can raise complex questions.<\/p>\n
Recently, Apple was fined \u20ac98.6 million by Italy\u2019s competition authority, which ruled that one of Apple\u2019s privacy features unfairly restricted competition in the App Store. Apple has said it strongly disagrees with the decision and plans to appeal.<\/p>\n
The case centres on Apple\u2019s App Tracking Transparency (ATT) feature, which Apple introduced in April 2021 as part of an update to the operating system used on iPhones and iPads.<\/p>\n
ATT requires apps to ask users for permission before tracking their activity across other apps and websites for advertising purposes. In simple terms, it gives users a clear choice:
\n\u201cDo you want this app to track you?\u201d<\/p>\n
From a privacy perspective, this was widely seen as a positive move. Many users welcomed the additional transparency and control over how their data is used.<\/p>\n
Italy\u2019s antitrust authority did not say that ATT itself was wrong or unnecessary. Instead, the concern was how the system was implemented.<\/p>\n
According to the authority, third-party app developers are required to ask users for consent twice in order to comply with Europe\u2019s strict privacy rules, while Apple\u2019s own apps do not face the same level of friction. The regulator argued that this \u201cdouble consent\u201d requirement makes it harder for other developers \u2014 particularly those that rely on advertising revenue \u2014 to compete fairly in the App Store.<\/p>\n
In the authority\u2019s view, this extra hurdle was disproportionate to the stated goal of protecting user data and had a negative impact on developers, advertisers, and advertising platforms.<\/p>\n
Apple has pushed back strongly against the ruling.<\/p>\n
The company said the decision overlooks the privacy protections ATT provides and instead favours advertising technology companies and data brokers that want broader access to user data. Apple maintains that privacy is a fundamental human right and that ATT was designed to give users a simple and consistent way to control tracking.<\/p>\n
Apple also noted that the same rules apply to all developers, including Apple itself, and said the feature has been widely embraced by customers and praised by privacy advocates globally.<\/p>\n
Italy\u2019s decision is not happening in isolation. Earlier this year, France\u2019s antitrust authority fined Apple \u20ac150 million over similar concerns relating to ATT and user consent. Together, these cases highlight an ongoing tension in Europe between privacy protection and competition law \u2014 particularly when large platform providers introduce system-level controls.<\/p>\n
For most businesses, this story isn\u2019t really about Apple at all. It\u2019s about the growing complexity of balancing:<\/p>\n
As privacy expectations rise, organisations are increasingly expected to give users more control over their data. At the same time, regulators are watching closely to ensure those controls don\u2019t unintentionally disadvantage certain groups or business models.<\/p>\n
At CSB, we often remind clients that privacy and security decisions don\u2019t exist in a vacuum. Controls that are good for users can still have operational, commercial, or regulatory implications if they\u2019re not designed carefully.<\/p>\n
The key takeaway for businesses is not to avoid strong privacy measures, but to:<\/p>\n
Privacy is becoming a baseline expectation \u2014 but how it\u2019s implemented matters just as much as the intention behind it.<\/p>\n","protected":false},"excerpt":{"rendered":"
Today, we\u2019d like to share a story that sits at the intersection of privacy, regulation, and business impact \u2014 and it\u2019s a good example of how even well-intentioned security and […]<\/p>\n","protected":false},"author":1,"featured_media":545,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[],"tags":[],"class_list":["post-546","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/posts\/546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/comments?post=546"}],"version-history":[{"count":0,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/posts\/546\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/media\/545"}],"wp:attachment":[{"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/media?parent=546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/categories?post=546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/tags?post=546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}