Max Schrems' campaign group noyb files complaints with German and Spanish regulators, claiming Apple breaks EU law by letting advertisers track users via IDFA
Austrian activist files complaints with German and Spanish data protection authorities — Apple is breaking EU law …
Context & Ripple Effects
Max Schrems' noyb is running a template campaign, and this filing extends it from access requests to ad tracking. In 2019 the group filed mass GDPR complaints against Amazon, Apple, Netflix, Spotify and YouTube over the data they collect on users, and in May it publicly attacked the Irish regulator for the slow pace of its Facebook, Instagram and WhatsApp probes — the frustration that explains why these IDFA complaints land in Germany and Spain rather than Dublin.
The target here is Apple's advertising identifier, and noyb quickly replicated the move against the rival identifier too: in April 2021 it filed a parallel complaint against Google's Android Advertising Identifier with the French watchdog. Device-level ad IDs across both mobile ecosystems are now under coordinated legal attack.
First-order effects
- Apple must now defend IDFA-based advertiser tracking before the German and Spanish data protection authorities, opening a second enforcement front alongside its existing Irish-led GDPR cases.
- Advertisers and app developers whose targeting depends on IDFA face fresh legal uncertainty in two major EU markets, since the complaints argue the identifier requires consent under EU law regardless of Apple's own privacy positioning.
Second-order effects
- noyb's identifier playbook spreads platform-wide — the French filing against Google's Android Advertising ID shows the same ePrivacy argument being applied to every major mobile ad ID, forcing both Apple and Google to defend the same tracking mechanism in parallel proceedings.
- Forum-shopping away from Ireland pressures the EU's one-stop-shop enforcement model: complainants route cases to German, Spanish and French regulators when Dublin's pace disappoints, multiplying proceedings Apple must answer.
Third-order effects
- If the German and Spanish cases establish that device identifiers require explicit consent, mobile ad targeting in Europe restructures around consent-first flows, and Apple's own plan to expand advertising in App Store search results sits awkwardly against a legal record in which its identifier is the named defendant.
- The pattern points toward privacy enforcement driven by activist litigants selecting favorable national regulators, eroding the Irish authority's role as gatekeeper for US platform cases and raising compliance costs for any ad-funded platform operating in the EU.
The trend: Device-level advertising identifiers are becoming the next front in activist-driven EU privacy enforcement, with noyb running the same complaint template against Apple's IDFA and Google's Android ad ID across multiple national regulators.