Apple ATT EU Prompt in iOS 27.2: How to Order CMP and ATT Before December

If your iOS app has users in Germany, France, Italy, Poland or Romania, iOS 27.2 replaces the App Tracking Transparency (ATT) alert they see with a new full-page prompt, and the German deadline for Apple falls in mid-December 2026. Before then, check two things: your consent management platform (CMP) runs before the ATT prompt, and your ATT purpose text refers to the choice the user already made there.

Apple ATT EU prompt in iOS 27.2 shown after the CMP

Why Apple is changing the prompt

Competition authorities in several EU countries found that ATT held third-party apps to a stricter standard than Apple's own advertising. Germany's Bundeskartellamt made Apple's commitments binding in a decision dated 13 August 2026, after complaints from industry groups including BVDW, BDZV and ZAW. Apple has four months from formal service of that decision to put them in place, so the German deadline cannot fall before 13 December 2026. Poland's UOKiK issued a similar decision on 19 October 2026, with two months to implement. France and Italy fined Apple over ATT in 2025, and Romania has a case open.

On 16 September 2026 Apple announced the new prompt for iOS 27.2. Apple says that "due to legal requirements" only the new version is available for apps distributed in Germany, France, Italy, Poland and Romania. Apps can choose to use it in the rest of the EU. Outside the EU nothing changes.

The new prompt appears when the device is in one of these countries and the user's Apple Account region is in the EU. In the five countries iOS shows it even if your app still calls the old API, so the question is not whether your users see it, but whether your flow and text still make sense around it.

What changes in the prompt

The prompt is a full-page sheet. In the five countries it always appears that way. Elsewhere in the EU, apps opt in through the new requestTrackingAuthorization(usingExpandedInterface:additionalInformationAction:completionHandler:) method.

The buttons are now Allow and Reject, in place of Allow and Ask App Not to Track. Apple dropped the warning symbol and the word "track" from its own text, and the Settings switch is now called "Allow Apps to Request to Link Your Activity Across Companies".

The purpose text supports Markdown: bold, italics, bullet lists and paragraph breaks. It goes in the new NSUserTrackingMarkdownUsageDescription key in Info.plist. If you leave it out, iOS uses your existing NSUserTrackingUsageDescription text.

An optional Additional Information button opens a screen your app controls, such as your CMP's detailed settings. Tapping it closes the prompt without an answer: the completion handler returns notDetermined, and the app has to show the prompt again. Keep those cases apart when you measure opt-in rates.

Apps may ask again one year after the user's last answer, in any EU country and whether the user allowed or rejected. iOS records the date and enforces the gap. If the user has switched off tracking requests in Settings, the app cannot ask.

Three ways to combine your CMP and ATT

The Bundeskartellamt decision describes three setups.

1. One combined flow: the ATT prompt's Additional Information button opens your CMP settings. Apple's FAQ allows this for the consent controls GDPR and ePrivacy require, and lets the app return the user to the ATT prompt unless they rejected every relevant choice.
2. CMP first, then ATT: the CMP collects consent and the ATT purpose text refers to it. Your TCF setup stays as it is. This is the simplest setup to build and explain, and the one we recommend.
3. Two independent prompts: each asks on its own and neither mentions the other. This is still allowed, but users see two unrelated questions about the same data.

ATT on its own does not replace the CMP. An ATT Allow is not GDPR consent and does not produce a TCF consent string, so vendors that read the string get no signal.

The recommended flow

1. The user opens the app and sees your CMP.
2. The user makes a choice, and the CMP stores it and writes the TCF consent string.
3. If the user accepted at least one purpose that needs cross-app tracking, show the ATT prompt. If they rejected all of them, don't. Apple's FAQ says the ATT prompt must not be shown to users who declined every relevant choice in an earlier consent prompt.
4. The ATT purpose text refers to the choice the user already made.
5. Before starting any advertising, attribution or measurement SDK, check both the CMP consent and the ATT status.

If the user accepts in the CMP but rejects ATT, don't read the IDFA or link their activity with other companies' data. You can still run processing they consented to that doesn't need cross-app tracking, such as contextual ads.

Writing the purpose text

Apple asks that the purpose text carry the most important information about how you use the data. With Markdown and a full page, it can explain where ATT fits after the CMP:

You've already chosen your privacy settings for this app.

iOS also asks separately whether we may use your device's advertising identifier.

- **Allow**: we use it to show more relevant ads and measure how they perform.
- **Reject**: we keep your earlier choices and don't use the identifier.

Put the link to your privacy policy and detailed settings behind the Additional Information button, not in the purpose text.

Yearly re-prompts

The yearly re-prompt is allowed, not required. The German commitments describe it for users who already consented through the publisher's CMP, which fits the flow above: when your CMP asks again, for example after a change to your vendor list or data use, ask for ATT only if the user accepted a relevant purpose.

UniConsent Mobile SDK

The UniConsent Mobile SDK for iOS, Android, Flutter and React Native shows the CMP first, stores the GDPR consent record and coordinates the ATT request. It returns consent status and ATT status as separate values, so you can start each ad or measurement SDK based on what the user agreed to. The iOS with ATT guide shows the setup step by step.

Start a free trial to set up your mobile CMP. For background on app consent, see mobile app consent management.

FAQ

When is the Apple ATT EU deadline?

Apple's German deadline is four months from formal service of the 13 August 2026 decision, so no earlier than 13 December 2026. Poland's decision gives two months from when it becomes final. The new prompt ships in iOS 27.2, so test your flow on iOS 27.2 before December.

Does this affect apps outside the five countries?

Partly. In the rest of the EU the new prompt is optional, but the yearly re-prompt rule applies across the EU. Outside the EU the ATT prompt works as before.

Do I need to change my TCF setup?

No. Your TCF purposes, vendor list and consent string stay the same. The changes are in the app: when it calls ATT and what the prompt says.

What if the user rejects ATT after accepting the CMP?

Don't read the IDFA or link their activity with other companies' data. Keep honouring the CMP consent for processing that doesn't need cross-app tracking, and use contextual signals where you would have used the IDFA.

Can I show the ATT prompt before the CMP?

Apple allows separate prompts, but showing ATT first causes two problems. An ATT Allow is not GDPR consent and doesn't produce a TCF consent string. And Apple says the ATT prompt must not be shown to users who rejected every relevant choice in your consent prompt, which you only know after the CMP has run.

How does the yearly re-prompt work?

In the EU, an app may show the ATT prompt again one year after the user's last answer, whether they allowed or rejected. iOS enforces the one-year gap. Users who switched off tracking requests in Settings are not asked again.

About UniConsent

UniConsent is Transfon's consent management platform, helping publishers and businesses meet GDPR, UK GDPR, and global privacy requirements across tens of millions of user sessions per day. For questions about mobile consent or ATT, contact hello@uniconsent.com.