France Fines Apple €8 Million for Targeted App Store Ads

French regulators today fined Apple €8 million for breaching France's data protection rules with targeted App Store ads. France's National Commission for Informatics and Liberty (CNIL) says that Apple did not get the consent of French iPhone users before using identifiers to present targeted ads in the iOS 14.6 update.

Apple was collecting information and using that data for ads by default, and CNIL says that users had to undertake a "large number of actions" to turn advertising off in the Privacy section of the Settings app. As a result, CNIL ruled that Apple breached Article 82 of the Data Protection Act, leading to a sanction of 8 million euros.

The CNIL services have found that under the old version 14.6 of the iPhone operating system, when a user went to the App Store, identifiers for several purposes, including purposes of customizing advertising ads displayed on the App Store, were by default automatically read on the terminal without collecting consent.

In a statement to Fortune's Patrick McGee, Apple said that it is "disappointed" with the decision and plans to appeal, noting that it only uses its own data for personalized ads.

We are disappointed with this decision given the CNIL has previously recognized that how we serve search ads in the App Store prioritizes user privacy, and we will appeal.

Apple Search Ads goes further than any other digital advertising platform we are aware of by providing users with a clear choice as to whether or not they would like personalized ads. Additionally, Apple Search Ads never tracks users across 3rd party apps and websites, and only uses first-party data to personalize ads. We believe privacy is a fundamental human right and a user should always get to decide whether to share their data and with whom.

Today's fine dates back to a 2021 investigation that CNIL launched after a complaint from the France Digitale association. France Digitale, a lobbying group that represents startups and venture capital firms, said that the iOS 14 update did not comply with European protections for personal data. Apple has since changed how targeted advertising works, and the opt-in and opt-out procedures.