App Tracking Transparency EU: iOS 27.2's alternative prompt

The App Tracking Transparency EU change lands with iOS 27.2: Apple will let EU apps show an alternative version of the ATT system prompt, and in Germany, France, Italy, Poland and Romania it is the only version available. When you must ask for permission does not change. What changes is the copy, the API call, the reprompt window and how you test.

If your iOS app relies on the advertising identifier, an attribution SDK or ad measurement in Europe, this is a release you plan for rather than read about. Below: what Apple has actually published, where its own pages disagree in wording, and the four things product and growth teams need to update before users start installing 27.2.

What is changing with App Tracking Transparency in the EU

Apple announced the change on 16 September 2026, saying it comes from agreements with select European competition authorities. The key facts, as of September 2026:

Item	What Apple says
OS versions	iOS 27.2 and iPadOS 27.2
Where it applies	The European Union; optional for developers
Alternative prompt only	Germany, France, Italy, Poland, Romania
When you must ask	Unchanged
New API	requestTrackingAuthorization(usingExpandedInterface:additionalInformationAction:completionHandler:)
New Info.plist key	NSUserTrackingMarkdownUsageDescription
Reprompt	Allowed one year after the user's previous choice, EU only

Five of the 27 EU member states lose the standard prompt entirely. The other 22 get a choice.

What the alternative ATT prompt looks like, per Apple

Apple's User Privacy and Data Use page says the alternative version "has modified formatting and language" and lets you add a text button labelled "Additional Information". The API documentation adds that you can request a full-page sheet instead of a system alert, with Markdown-formatted text. Your Markdown string supports bold, italic, bullet lists and paragraph breaks, but not underline, and the system shows your app name for you.

Does ATT still require permission in the EU?

Yes. Apple is explicit that the requirements for when you must seek permission to track users will remain the same. Tracking still means linking data from your app with other companies' apps, websites or offline properties for targeted advertising or ad measurement, or sharing it with a data broker. Until the user grants permission, the advertising identifier is all zeros.

The App Store rules do not move either. Guideline 5.1.2(i) still says you must receive explicit permission through the ATT APIs to track, and you may not require tracking to access functionality or reward users for enabling it. The new button is for more information and more granular consent, not for incentives.

Where Apple's own pages differ: distribution country or device country

The developer news post says the alternative prompt is the only option "for apps distributed in" the five countries. The API reference describes the trigger differently: the behaviour requires the device to be located in a specific EU country and signed in with an Apple Account whose country or region is set to that country. Those may not be the same test: a German account on a device in Spain is one case the news post does not settle.

The two reference pages also word the rest-of-EU case slightly differently. The method page says the system shows your Markdown text if you supply it and shows the full-page sheet if you pass true for the expanded interface. The Info.plist key page says outside the five countries the Markdown key is used when you pass true. We would not build logic on either reading until you have seen it on a device.

Outside the EU, Apple says the new method ignores both parameters and behaves exactly like the original requestTrackingAuthorization call, showing your existing usage description. That makes a single code path safe to ship globally.

Do I need to update my ATT prompt?

If you track users in the EU, plan for it. In the five countries the standard prompt goes away whatever you do, so the copy your users see will change. Four areas need work.

1. Consent copy

Write a NSUserTrackingMarkdownUsageDescription string alongside the existing one. If you omit it, the system falls back to NSUserTrackingUsageDescription. Apple's guidance is that the purpose string should carry the most important information about your data use, and can tell users what they will find behind "Additional Information". Treat it as legal copy: run it past whoever owns your GDPR and ePrivacy position.

2. The Additional Information flow

Tapping the button dismisses the sheet without recording an answer. Your closure runs, the completion handler receives notDetermined, and you present your own screen, then call the method again. Apple adds one constraint: do not redirect a user back to the ATT prompt if they have opted out of all relevant legal consent choices on that screen. If you use a consent management platform, its state and the ATT state have to agree.

3. Analytics and attribution SDKs

You are responsible for all code included in your app, including third-party SDKs. Check which SDKs call ATT themselves, which read the authorisation status, and whether any assume a single alert. A notDetermined status after an Additional Information tap is new behaviour for code that expects either authorised or denied. For privacy-preserving install attribution, Apple points advertisers to AdAttributionKit.

4. The one-year reprompt

In the EU you can reprompt a user one year after their previous choice, whether they accepted or declined. That is a product decision, not just a technical one: when you ask again, and with what copy, affects both opt-in rates and how users feel about your app. Users who switch off tracking requests in Settings (renamed "Allow Apps to Request to Link Your Activity Across Companies" in the EU) cannot be reprompted.

How to test App Tracking Transparency EU behaviour country by country

Because the behaviour depends on device location and Apple Account region, one test device in one country will not cover it. The minimum matrix we would run in the iOS apps we build:

• Account and device in one of the five countries, with and without the Markdown key.
• Account and device in another EU state, with usingExpandedInterface set to true and to false.
• A non-EU account and device, to confirm the original alert is unchanged.
• An Additional Information tap followed by a second request, checking your analytics records notDetermined correctly.

Add a check that no tracking SDK starts sending identifiers before the final answer. Apple is clear that you cannot collect and use the data described in the prompt until the user grants permission in that prompt.

When this change does not apply to you

If your app does not track, nothing here requires action. Apple's rules still exempt data linked only on the user's device and use of the identifier for vendor for analytics across your own apps. The counter-argument for waiting is reasonable: iOS 27.2 is not the installed base on day one, and Apple's pages may be refined. But in five countries the prompt your users see is going to change regardless, and consent copy tends to need several review rounds.

This sits alongside the other EU-specific terms Apple has introduced, such as the Core Technology Commission rates, and the wider iOS 27 App Store requirements. If you want the ATT change scoped against your SDK list and consent platform, our iOS app development team does this as part of release planning, including for React Native apps that wrap the native call.

The next decision is simple: write the Markdown usage description now, get it approved, and have it in the build that ships when iOS 27.2 does.