Apple Faces New European Privacy Scrutiny

Apple is currently addressing another privacy concern raised in Europe. France Digitale, a startup advocacy organization, has requested that the nation's data protection authority investigate potential violations of EU regulations.

Similar Complaints Filed Across Europe

This complaint, initially reported by Politico, mirrors two previous submissions made in Germany and Spain last year by the EU privacy advocacy group, noyb. These actions all center around Apple’s IDFA – the Identifier for Advertisers – a unique identifier for mobile devices.

noyb contends that Apple should be obtaining explicit consent from EU users before assigning this device identifier, which facilitates ad tracking.

Competition Concerns and Default Settings

France Digitale’s complaint also highlights competition issues. It points to Apple’s impending requirement for users to actively opt-in to allow third-party apps to track their activity.

This is contrasted with the “personalized advertising” setting within iOS, which allows Apple to track users and is enabled by default.

The organization argues that this default setting is inconsistent with the consent standards outlined in the European Union’s General Data Protection Regulation (GDPR).

Data Access Transparency

The complaint further questions the extent of data access Apple provides to iOS users regarding its own ad targeting practices.

It asserts that users are only given limited, “generic data” – such as age range, gender, and location – rather than comprehensive details about the targeting criteria used.

Apple’s Response and CNIL Investigation

In response to the complaint, an Apple spokesperson provided a statement.

The CNIL, France’s data protection authority, has also been contacted for comment. Update: A CNIL spokesperson confirmed that the complaint has been registered and an inquiry will be initiated.

A Startup Lobby’s Perspective

This particular complaint is noteworthy as it originates from a startup lobby group, rather than a traditional privacy organization.

Apple’s decision to shift to an opt-in model for third-party tracking has evidently caused friction within the industry. A French publisher lobby previously filed a competition complaint regarding this change.

The underlying implication is an accusation of privacy hypocrisy directed at Apple.

Level Playing Field for Startups

A spokesman for France Digitale explained to TechCrunch: “Startups operate within the established rules. We anticipate that the world’s largest technology company will do the same.”

He continued, “We are simply requesting the CNIL to enforce existing laws. Our startup members are routinely investigated by privacy watchdogs; let them apply their expertise to larger corporations.”

GDPR and Potential Regulatory Action

While the complaint has garnered initial attention, under GDPR’s “one-stop-shop” mechanism, the case may need to be referred to Ireland’s Data Protection Commission.

As Apple’s lead data supervisor within the EU, the Irish DPC would then determine whether to launch a formal investigation, potentially delaying any swift regulatory response.

However, if the CNIL determines the matter falls under the EU’s ePrivacy Directive, it could pursue independent and potentially faster action, as it has recently done with cases involving Amazon and Google concerning cookie consent.

A CNIL spokesperson stated that it is currently too early to determine whether the investigation will proceed under GDPR or ePrivacy, requiring a detailed analysis of the submitted complaint.

This report has been updated to clarify the potential application of GDPR or the ePrivacy Directive and to include additional commentary from the CNIL.