Apple Fined €8 Million over Ads Served Without User Consent

France’s data protection watchdog has fined Apple €8 million for violating local laws on the collection and use of customer data for serving personalized ads.

Following a complaint over ad personalization in the App Store, France’s Commission Nationale de l'Informatique et des Libertes (CNIL) started looking into the matter to see if Apple was complying with applicable regulations at the time.

“The CNIL services found that under the old version 14.6 of the operating system of the iPhone, when a user visited the App Store, identifiers used for several purposes, including personalization of ads on the App Store, were by default automatically read on the terminal without obtaining consent,” according to the authority.

Because the feature was not strictly necessary to use the App Store, and because users had to explore the iPhone’s privacy settings on purpose to find the on/off toggle to ”Apple advertising,“ the iPhone maker was found in breach of Article 82 of the French Data Protection Act, which stipulates that "any action through which an electronic communication service accesses or enter information in a user's terminal equipment … requires the user's consent."

The EU’s General Data Protection Regulation (GDPR) has similar provisions.

Consequently, the CNIL imposed a fine of 8 million euros, or about 8.4 million, on the Cupertino tech giant.

The CNIL calculated the penalty based on the scope of the processing limited to the Apple Store, the number of French users concerned, the estimated profits from ad revenue at the time and the fact that Apple has since achieved compliance with the DPA.

In a statement to the media, a spokesperson for Apple France said the company was “disappointed” with the decision and will appeal.

“Apple Search Ads goes further than any other digital advertising platform we are aware of by providing users with a clear choice as to whether or not they would like personalized ads,” the spokesperson said. “Additionally, Apple Search Ads never tracks users across 3rd party apps and websites, and only uses first-party data to personalize ads.”

Similarly, Facebook parent company Meta recently found itself in hot water with European regulators, having been fined hundreds of millions of euros for using its terms of service in such a way as to cover for opaque data processing practices.