France fines Apple over App Store ad targeting online privacy breach

A rare penalty for Apple’s privacy: the French data protection authority, the CNIL, announced that it had imposed an 8 million euros (~8.5 million dollars) penalty on the manufacturer of iPhone for failing to obtain consent from local mobile users before placing (and/or reading) advertising identifiers on their devices in violation of local data protection law.

The sanction decision was issued on December 29 but only made public yesterday (the text of the decision is available here).

The CNIL operates within the framework of the European Union’s ePrivacy Directive – which allows data protection authorities at member state level to take action on local complaints about breaches, rather than requiring them to be referred to a primary data controller in the country where the business in question has its principal EU establishment (as is the case with the EU’s new General Data Protection Regulation, or GDPR).

While the size of this ePrivacy fine won’t cause sleepless nights in Cupertino, Apple is leveraging unparalleled user privacy claims to polish its premium brand — and differentiate iPhones from cheaper hardware running the Android platform. from Google – so any dent in its reputation for protecting user data should sting.

The CNIL says it is following up on a complaint against Apple for having broadcast personalized advertisements on its App Store. The action concerns an older version (14.6) of the iPhone operating system, under which – after the watchdog’s investigation in 2021 and 2022 – it discovered that the tech giant had not obtained the prior consent of users to process their data for the purpose of targeted advertising. when a user visited the Apple App Store.

The CNIL found that iOS v14.6 automatically read identifiers on the user’s iPhone – which served several purposes, including the personalization of advertisements on the App Store – and that the processing took place without that Apple would not obtain the appropriate consent, in the opinion of the regulator, because the consent was collected via a pre-checked default setting. (NB: The CNIL 2019 guidelines relating to the ePrivacy directive stipulate that consent is necessary for the tracking of advertisements.)

Extract from the CNIL press release [translated from French with machine translation] :

Due to their advertising purpose, these identifiers are not strictly necessary for the provision of the service (the App Store). Consequently, they must not be able to be read and/or deposited without the user having expressed his prior agreement. However, in practice, the ad targeting settings available from the iPhone “Settings” icon were pre-checked by default.

Moreover, the user had to perform a large number of actions to successfully disable this setting since this possibility was not integrated into the initialization process of the phone. The user had to click on the ‘Settings’ icon on the iPhone, then go to the ‘Privacy’ menu and finally to the section called ‘Apple Advertising’. These elements did not make it possible to collect the prior consent of users.

The CNIL said the level of the fine reflects the extent of the processing (which it said was limited to the App Store); the number of French users concerned; and the profits Apple derives from advertising revenue generated indirectly from the data collected by the IDs – as well as the regulator taking into account that Apple has since come into compliance.

Apple has been contacted to comment on the CNIL sanction. A company spokesperson confirmed their intention to appeal by sending us this statement:

We are disappointed with this decision given that the CNIL has previously acknowledged that the way we serve search ads in the App Store prioritizes user privacy, and we will appeal. Apple Search Ads goes further than any other digital advertising platform we know of by giving users a clear choice as to whether or not they want personalized ads. In addition, Apple Search Ads never tracks users across third-party apps and websites, and only uses first-party data to personalize ads. We believe that privacy is a fundamental human right and that a user must always decide what to share their data with and with whom.

This isn’t the first time that Apple has come under scrutiny for the double standard when it comes to privacy. In 2020, European privacy rights campaign group noyb filed a series of complaints with EU data protection watchdogs over a default identifier for advertisers (aka IDFA) built into the iPhone by Apple, arguing that the existence of the IDFA was a similar violation of the prior consent to tracking principle.

The company has also been accused of privacy hypocrisy in recent years due to its different treatment of tracking iPhone users’ app activity to serve its own “personalized ads” versus to a recently introduced requirement that third-party apps obtain user consent. – after introducing the App Tracking Transparency (aka ATT) feature to iOS in 2021.

Apple continued to dispute these arguments, saying it abides by local privacy laws and provides a higher level of privacy and data protection for iOS users than competing platforms.

France, meanwhile, has been very active in enforcing electronic privacy breaches against tech giants in recent years, with another example last month when it fined Microsoft $60 million. Euros for designing dark patterns in relation to cookie tracking – after finding the company hadn’t offered users a cookie opt-out mechanism as simple as the button it presented to them to accept cookies .

Amazon, Google and Meta (Facebook) have also all faced CNIL sanctions for cookie-related violations since 2020. And last year Google updated its EU-wide cookie consent pop-up to (finally) provide a simple ‘accept all’ or ‘decline all’ option offered at the top level.

tl;dr: Privacy enforcement works.

The steady stream of applications and fixes that CNIL interventions have achieved for users in France via ePrivacy – a European directive much older than GDPR – has shed critical new light on how the latter works. landmark privacy regulations where control and enforcement on tech giants continues to be bogged down by forum shopping, related procedural bottlenecks and resource issues, and disputes between regulators on how to deal with these cross-border cases.

But while a GDPR complaint against a tech giant can take years, plural, to enforce — like the ~4.8 years it took to finalize “forced consent” complaints against two Meta properties, Facebook and Instagram, and still with likely years of appeals of this decision to come (and with other even older complaints still plodding along towards a final decision) – the difference between an EU directive and a settlement means that the app is pan-European by default, rather than being located in the jurisdiction of the APD app. This means that with ePrivacy, any broader compliance deployment is at the discretion of a sanctioned entity, so the impact for users may be more localized.

Furthermore, any (potential) GDPR penalties may also outweigh the stings of ePrivacy – GDPR allowing fines of up to 4% of global annual turnover, while ePrivacy is stuck with a bigger regime which leaves it to the Member States to define “effective, proportionate and dissuasive” sanctions. (Ergo, user rights here are tied to local policy.)

While remedial orders may have far more bite for big tech than financial penalties given the revenue these giants generate, even fines of hundreds of millions or more can be waived as a simple cost of doing business. . While orders to change practices to comply with privacy laws can force significant reforms.

It should be noted that the EU has been trying – for years – to replace the more than two-decade-old ePrivacy Directive with an updated ePrivacy Regulation. However, big tech lobbying and disputes among lawmakers over a 2017 Commission proposal conspired to stall the dossier for most of that time.

Member States finally agreed on a common negotiating position in February 2021, finally allowing the start of trilogue negotiations. But debates between EU co-legislators over small and big details continue – and it’s unclear when (or even if) a consensus can be reached.

And that means the veteran ePrivacy Directive may still have years of extra working life — and millions more in big tech fines — ahead of it.