Apple has just been fined 8 million euros by the CNIL for using ad trackers without the explicit consent of iPhone users, which contradicts its privacy policy. Apple will appeal.
In the war in which the manufacturers are waging to dominate the smartphone and tablet market, Apple has made the confidentiality it guarantees to its users one of its main marketing arguments – especially since the sector relies heavily on the use of personal data. To differentiate itself from its competitors, the firm at the apple has even erected itself as a real bulwark against this practice, as evidenced by its motto: “Privacy. That’s iPhone“. A promise reinforced by the App Tracking Transparency, a device which obliges developers to ask the user’s authorization before any data tracking on the applications and websites of other companies – and which in passing does not damage to small publishers as well as large ones, including Meta and Snapchat.
Alas, it would seem that the reality is slightly more complex and that Apple does not keep all of its privacy promises. The company was inflicted on December 29 a fine of 8 million euros by the National Commission for Computing and Liberties (CNIL) because of its management of advertising cookies on the App Store, the official store through which you must go to download applications.
Apple: implied consent is not consent
Following several complaints, including that of the association France Digital for violation of the rules of the European Union vis-à-vis confidentiality and the rules governing competition, the digital policeman carried out several checks between 2021 and 2022. He was then able to note the absence of clear consent before the deposit of advertising cookies on the App Store in version 14.6 of iOS, Apple’s operating system. “When a user went to the App Store, identifiers serving several purposes, including the purposes of personalizing the advertisements broadcast on the App Store, were by default automatically read on the terminal without obtaining consent.“, explains the CNIL. In addition, the identifiers were not strictly necessary for the provision of the service.
The problem is that the deposit without consent of “non-vital” cookies for the use of the application is illegal in France according to the Data Protection Act (article 82). However, the CNIL considered that the user’s consent was not explicit. “Ad targeting settings available from iPhone’s ‘Settings’ icon were pre-checked by default“, she specified. In addition, not to help Apple’s situation, the process for accessing this choice – and therefore unchecking the targeting of advertising – was far too complicated: the user had to go in “Settings“, then in “Privacy” and finally in “Apple Advertising.” However, with its App Tracking Transparency, Apple imposed – and still imposes – third-party applications to request explicit consent from the user for their own little spies. From there to say that there are double standards , there is only one step !
Apple fine: a decision and amount discussed
It is regrettable that the fine imposed by the CNIL is ultimately not so high in view of the immense fortune of Apple. The Commission explains that it has “justified this amount by the scope of the processing limited to the App Store, by the number of people concerned in France and the profits that the company derives from the advertising revenues indirectly generated from the data collected by these identifiers and by the fact that the company has since come into compliance.” Indeed, the Apple has, even before the judgment of the French gendarme, solved the problem with iOS 15 by ensuring that the box “Personal advertisements” is unchecked by default. In addition, these advertising identifiers only allowed Apple to target Internet users when they were browsing the mobile application store, and therefore had a limited scope of action – which is debatable, given the financial windfall that ad tracking represents. Finally, the authority was only able to penalize breaches in France.
Apple expressed its disappointment with the CNIL’s decision because “She previously acknowledged that the way we serve search ads in the App Store puts user privacy first.“, as reported by the journalist Patrick McGee on Twitter. The Cupertino company will also appeal. “Apple Search Ads goes further than any other digital advertising platform we know of by giving users a clear choice about whether they want to receive personalized ads. Additionally, Apple Search Ads never tracks users across third-party apps and websites, and only uses first-party data to personalize ads.“, she adds.
CNIL fine: Apple’s reputation begins to tarnish
This statement leaves some doubts when we know that, at the end of November, the company was the target of a collective complaint before the federal court of California, because it would violate the California Invasion of Privacy Act, which aims to protect users’ right to block tracking, including when it is used to perform analytics. And that was before the discovery by two researchers that the Californian company was collecting data in the App Store on the slightest actions of its users, including when tracking functions – such as sharing data from use or personalized advertisements – are deactivated, and without guaranteeing their anonymity!
A finding that contradicts the famous privacy policy of the apple firm and sticks with its new policy – users have indeed seen a sharp increase in advertisements in the App Store. Also, if the fine imposed by the CNIL is not that high, the announcement is still important in the sense that it calls Apple into default on its credo of respect and protection of the privacy of its users. users. And, who knows, maybe it will fuel other legal actions against the company, which is lining its pockets during this time.