Is Apple Using Your Data for App Store Ads? Poland’s Antitrust Watchdog Wants Answers

Is that harmless-looking “personalized” banner in the App Store actually fueled by data you never agreed to share? Polish regulators think that might be the case, and they have now turned Apple’s flagship privacy feature into the center of a new antitrust fight in Europe.

For years Apple has marketed itself as the tech giant that stands on the side of privacy, loudly contrasting its approach with the surveillance-heavy ad models of many rivals. A key pillar of that image is App Tracking Transparency (ATT), the system on iPhones and iPads that forces apps to ask whether they can track you across other apps and websites. Since its rollout, ATT has reshaped the mobile advertising industry, cutting off many data brokers and squeezing the business models of countless developers and ad networks.

Under the ATT framework, every device gets an anonymized identifier that is not supposed to reveal your name, email address, or other obvious personal information. Third-party apps that want to use that identifier for tracking must first show a clear prompt and obtain the user’s explicit permission. If you tap the option not to allow tracking, those apps are meant to lose access to that granular cross-app data. Apple has presented this system as a simple deal: your iPhone, your choice.

Poland’s competition authority, the Office of Competition and Consumer Protection (UOKiK), now alleges that the story might be different when it comes to Apple’s own business interests. The regulator has opened a formal antitrust investigation into whether Apple sidesteps its own ATT rules to serve personalized ads on its own platforms, such as the App Store, without asking for the same level of consent that it demands from other companies. In other words, ATT may be much stricter for third-party developers than for Apple itself.

The core suspicion is straightforward. If Apple’s own apps and services are not treated as “trackers” under ATT, the company could still use that anonymized identifier and other behavioral signals to tailor ads you see in the App Store and other Apple properties – without showing you the familiar tracking prompt. That creates a powerful built-in advantage: independent publishers have to interrupt users, risk a refusal, and potentially lose valuable data, while Apple can keep quietly optimizing its ad business in the background. UOKiK’s president, Tomasz Chróstny, has suggested that this asymmetry may boost Apple’s competitive position at the expense of developers who depend on advertising revenue.

Apple, for its part, rejects the idea that it is cheating its own system. The company argues that ATT is aimed primarily at the broader data tracking ecosystem, especially firms that build massive profiles by stitching together information from many unrelated apps and sites. Apple says it does not combine the anonymized device identifier with personally identifiable information in a way that would undermine user privacy, and that its own ad platform is designed with far stricter limits than the typical third-party network. According to Apple, ATT has given millions of European users meaningful control, and it portrays the backlash as driven by an industry that is angry about losing access to easy tracking.

The company has also hinted at a more drastic scenario if regulators push too hard: it could, in theory, withdraw ATT entirely from the European Union. That would be a dramatic move, and arguably a lose-lose outcome for users who care about privacy. It is also a tactical message to lawmakers – if every privacy protection can be reinterpreted as a potential antitrust breach, Apple suggests, fewer companies will be willing to introduce strong safeguards in the first place.

Poland is not alone in asking tough questions. Competition authorities in Germany, Italy, and Romania have launched their own proceedings examining whether Apple’s use of app-related data complies with both competition law and the spirit of ATT. All of this unfolds against the backdrop of the EU’s Digital Markets Act (DMA), under which Apple has been officially labeled a "gatekeeper" – a company so dominant in a key digital market that it can effectively decide which competitors get to reach users and on what terms.

That gatekeeper status comes with obligations. In response to the DMA, Apple has been forced to open the door, at least partially, to third-party app stores on its platforms in the EU. It has also reworked its commercial terms for developers in the region, introducing new programs that offer lower commissions or different fee structures for those who enroll, while still trying to preserve core control over the iOS ecosystem. Regulators are now asking whether ATT, as implemented, is another lever Apple uses to tilt the playing field toward its own services and ad business.

For ordinary users, the debate boils down to two big questions. First, when you tap through your privacy settings and your iPhone says apps need your permission to track you, are Apple’s own systems truly bound by the same rules? Second, even if the identifier Apple uses is anonymized, could it still be combined with other signals – like what you search for, what you download, and how you interact with apps – to build a powerful profile over time? Polish authorities suspect that this gray zone is exactly where Apple has found room to grow its advertising revenue.

The outcome of these investigations could reshape not just how Apple runs its ad business, but also how future privacy tools are designed. Regulators might force Apple to expand ATT-style consent prompts to its own apps, redesign the way App Store ads work, or accept fines and ongoing monitoring of its practices. Apple, meanwhile, will continue to argue that strong privacy and competitive markets are not mutually exclusive – and that it is being punished precisely for doing what users say they want. Until a final decision lands, anyone scrolling past “personalized” cards in the App Store will be left wondering whether those ads are there with their fully informed consent, or whether they are the product of a loophole in the very system that promised to put them back in control.