Your ATT Prompt Just Forked in the EU

App Tracking Transparency has been one prompt, worldwide, since iOS 14.5. Starting with iOS 27.2 it becomes three different experiences driven from a single call site, and in five EU countries the change happens whether you ship code for it or not.

What Apple announced, and the clock behind it

Apple Developer News published “Updates to App Tracking Transparency in the European Union” on Wednesday, September 16, 2026. The text is short enough to quote in full effect: beginning with iOS 27.2 and iPadOS 27.2, developers “will have the option to use an alternative version of the App Tracking Transparency system prompt in the EU,” and “due to legal requirements, only the alternative version of the system prompt is available for apps distributed in Germany, France, Italy, Poland, and Romania.”

The driver is not a single regulator. The Bundeskartellamt announced on August 17, 2026 that it had declared Apple’s commitments binding under Section 19a GWB and Article 102 TFEU. Apple agreed to align consent prompts for its own offerings and third-party apps “much more closely,” remove “possibly discouraging symbols and wording,” make the design “neutral in terms of content, wording and layout,” and give publishers more freedom to combine Apple’s required consent request with consent requests required under data protection law. An independent monitoring trustee supervises compliance for seven years, and the decision carries a four-month implementation deadline.

The other four countries each have their own proceeding, which is why the list looks arbitrary until you check. Italy’s AGCM fined Apple €98.6M in December 2025 over abuse of a dominant position, in an investigation opened in May 2023. France’s Autorité de la concurrence has also fined Apple over ATT consent practices; the Bundeskartellamt release puts the combined France and Italy total at €248.6M, and I’m not going to publish the French figure alone by subtracting. Poland’s UOKiK opened a further ATT investigation on November 25, 2025. Romania’s involvement is reported secondhand rather than confirmed against a Consiliul Concurenței primary source.

Four months from August 17 lands in mid-December 2026. That is the real deadline. Apple has announced no public release date for iOS 27.2; as of October 1, 2026 it is at beta 2 (build 24B5089g, September 21). Plan against the commitments clock, not against a guess about Apple’s calendar.

Two new symbols, and two things the docs contradict

There is a genuine API change, not just a server-side flip. Apple documents a new Info.plist key and a new method, both marked iOS/iPadOS 27.2+ (beta).

NSUserTrackingMarkdownUsageDescription is an optional string displayed in what Apple’s docs call a “full-page authorization sheet.” The supported markdown subset is documented precisely — bold and italic, bullet lists, paragraph breaks, and explicitly not underline. No links, no headings. If you omit the key, the system falls back to NSUserTrackingUsageDescription. In France, Germany, Italy, Poland and Romania the system “uses this key if available”; elsewhere in the EU it is used only when you ask for the expanded interface; outside the EU the old key is used.

The new method adds two parameters:

class func requestTrackingAuthorization(
    preferExpandedInterface: Bool,
    additionalInformationAction: (() -> Void)?,
    completionHandler completion: @escaping @Sendable (ATTrackingManager.AuthorizationStatus) -> Void
)

An async variant is documented too, and it is the one to prefer — the completion handler is @escaping @Sendable, so under Swift 6 strict concurrency (Swift 6.4 ships with Xcode 27, released September 14, 2026) migrating an old call site whose handler touches a @MainActor view model is where new isolation diagnostics show up. Passing nil for additionalInformationAction omits the button.

Two discrepancies worth knowing before you paste code. Apple’s documentation names the parameter preferExpandedInterface:, while PPC Land’s writeup gives usingExpandedInterface: — one is wrong, or the label changed between betas. And the AppTrackingTransparency framework index page lists the new method’s availability as iOS 14.0+, while the method’s own page says 27.2+; the detail page is almost certainly right and the index is inheriting framework-level availability. Both are beta-API problems with the same fix: type the call in Xcode 27.2 beta and let the compiler settle it. Press coverage also describes the sheet’s button labels as “Allow” and “Reject” with the word “track” removed; Apple’s docs confirm the full-page sheet and the Additional Information button but not the exact copy, so treat the labels as reported, not documented.

The seam: region-driven format, client-side copy

The question worth answering before anyone opens Xcode is whether this is a release decision or a configuration decision. It is both, split along a seam that determines your risk.

In the five mandated countries, the format flips without you shipping anything. The alternative sheet is the only one available there, and the system reaches for the markdown key “if available.”

But the copy inside that sheet is a client-side artifact. If you never ship NSUserTrackingMarkdownUsageDescription, the system renders your existing NSUserTrackingUsageDescription — a single line written for a small modal alert — across a full page. Nothing breaks. A string designed for one surface simply gets promoted to a much larger one, in five countries, at whatever moment your app currently asks. That is the actual exposure here, and it is a copywriting problem before it is an engineering one.

The Additional Information button, by contrast, is unambiguously a release decision: it requires passing a non-nil closure to a new API, which requires the new SDK. There is no remote-config path to it. Voluntary adoption elsewhere in the EU is also a release decision, via preferExpandedInterface: true.

The good news for a small team is that there is no region branching. Outside the EU, Apple’s docs say both new parameters are ignored and the call is equivalent to requestTrackingAuthorization(completionHandler:). One call site, guarded by @available(iOS 27.2, *) with a fallback to the iOS 14 method, covers all three behaviors.

One thing I could not confirm: whether an app built against an older SDK gets the new sheet in a mandated country. The Info.plist wording implies system-side behavior independent of the link-time SDK, but neither Apple’s documentation nor the trade press states it. Test an App Store build on a 27.2 beta device with the region set to Germany before assuming either answer.

Two traps in the status codes

The second change is quieter and will cause more bugs. Apple’s User Privacy and Data Use page now states that for users in the European Union you “can reprompt a user via the App Tracking Transparency system prompt one year after the user’s previous choice,” regardless of whether that choice was accept or reject. The system records the answer date and blocks re-prompting for a year, so the interval is enforced for you.

Trap one: .denied is no longer terminal in the EU. Any code shaped like if status == .denied { neverAskAgain() }, and any cached “user said no” boolean in your own storage, now encodes a stale assumption. Go grep for persisted ATT decisions. You may still want your own record for scheduling, but it must not be the thing that decides whether asking is possible.

Trap two, and the most likely new bug class: .notDetermined means the person dismissed the sheet without deciding or tapped Additional Information. The docs’ instruction in both cases is to call the method again. So a handler that reads .notDetermined as “prompt failed, give up” silently drops every user who wanted to read more before answering — the most engaged segment you have. Tapping Additional Information records no answer, so the follow-up request does not consume the annual allowance.

let status = await ATTrackingManager.requestTrackingAuthorization(
    preferExpandedInterface: true,
    additionalInformationAction: { presentTrackingExplainer() }
)

switch status {
case .authorized:    enableConsentedMeasurement()
case .denied:        enableConsentlessMeasurement()  // not permanent in the EU
case .restricted:    enableConsentlessMeasurement()  // no prompt will ever show
case .notDetermined: break  // dismissed, or read more — re-request later
@unknown default:    enableConsentlessMeasurement()
}

Also worth re-reading the list of conditions under which the system skips the prompt entirely: tracking restricted, the Settings toggle off, a request already pending, invocation from an app extension, or an app state that is not UIApplicationStateActive. That last one is the classic “called it too early in launch and got nothing” failure. And note that the Settings toggle itself is renamed in the EU, from “Allow Apps to Request to Track” to “Allow Apps to Request to Link Your Activity Across Companies.” If that toggle is off, no re-prompt is possible.

A work plan that fits before mid-December

Inventory where ATT consent actually gates revenue. For many apps the honest answer is less than assumed, because AdAttributionKit (iOS 17.4+) does not require it. Apple’s documentation is explicit: “Apps don’t need to use App Tracking Transparency before calling ad attribution APIs, and can call these APIs regardless of their tracking authorization status.” Separating “needs the IDFA” from “needs attribution” is the step that keeps the rest of this from being busywork.

Write the markdown copy on purpose. In the five countries you don’t get to choose whether the full-page sheet appears — only whether its text was authored for a full page. The Bundeskartellamt commitment explicitly opens the door to combining Apple’s consent request with consent required under data protection law, so whoever owns the CMP and TCF setup belongs in that conversation alongside legal review.

Decide country-by-country for the rest of the EU. There is a real case for voluntary adoption: regulators found the old design discouraging, and a neutral full page with a Read More affordance should lift consent. There is also a case for waiting: a full-page interstitial is a heavier interruption than a small alert and may increase dismissals, and Additional Information deliberately adds a step that returns a non-answer. Nobody has post-launch data, because 27.2 has not shipped. Any opt-in lift number quoted today is an extrapolation.

Instrument opt-in rate by region now. The pre-change baseline only exists before the change. Bucket the five mandated countries, the rest of the EU, and non-EU as three separate cohorts, and log the resolved status, the storefront, and which variant was shown. Do not log a device identifier before authorization.

Define your denominator and write it down. This is genuinely disputed. AppsFlyer’s methodology post (updated November 27, 2025) puts the same population at 40% opt-in counting only users who actually see the prompt, and 30% once restricted users and system-level deniers are included. Its own April 24, 2025 press release reported roughly 50% global consent, with France just under 51% and Germany 47%. Those figures are not reconcilable without knowing each denominator, and averaging them is meaningless. Your internal number is not comparable to any vendor benchmark unless you replicate that vendor’s definition.

Design the annual re-ask for a moment of earned trust. The one number here with a named, dated source behind it: in the same AppsFlyer analysis, apps showing the prompt before SDK initialization saw 36% opt-in, versus 45% when shown after user engagement. If a cold prompt costs roughly nine points against an engaged one, spending a once-a-year EU re-ask on app launch is measurably expensive.

What didn’t change

It is tempting to read a regulatory outcome as a loosening. It isn’t one. Apple’s September 16 note says plainly: “The requirements for when you must seek permission to track users will remain the same.” The User Privacy and Data Use page still states that you “cannot access the device’s advertising identifier, or otherwise collect and use device or user data from your app as described in the App Tracking Transparency system prompt, until the user has granted your app permission in that prompt.” The definition of tracking — linking your app’s user or device data with data collected from other companies’ properties for targeted advertising or measurement, plus sharing data with data brokers — is unchanged, as it has been since iOS 14.5.

App Review Guideline 5.1.2(i) still reads “You must receive explicit permission from users via the App Tracking Transparency APIs to track their activity.” As of October 1, 2026 I found no guideline text amended for the EU alternative prompt, and could not confirm a last-updated date on the page. Treat that as a thing to watch rather than a thing that happened.

The sentence to take into legal review is this one, from the same Apple page, about the Additional Information button: “Any additional information related to your request or more granular consent controls provided via the text button are entirely your responsibility.” Apple cut a hole in its own sheet and handed it to you — including, notably, the option to put more granular consent controls behind it. That is where the Bundeskartellamt’s “combine with data-protection consent” freedom becomes a concrete design surface, and where the liability sits.

All version claims here were verified on October 1, 2026. iOS 27 shipped September 14, 2026, with 27.0.1 on September 28. The new API and Info.plist key are beta symbols: the names and signatures can still change, so compile before you commit.