Max Schrems' campaign group noyb files complaints with German and Spanish regulators, claiming Apple breaks EU law by letting advertisers track users via IDFA
Context & Ripple Effects
This complaint extends Max Schrems' established playbook from access-rights cases into device-level ad tracking. His 2019 GDPR mass filings against Amazon, Apple, Netflix, Spotify and YouTube targeted transparency obligations; the new German and Spanish complaints go after the IDFA itself under EU law, hitting Apple at the layer where its own advertising ecosystem operates.
The timing matters because Schrems has been openly frustrated with enforcement pace — he publicly attacked the Irish data protection authority's slow probes into Facebook, Instagram and WhatsApp — so routing these complaints through German and Spanish regulators reads as forum-shopping for faster movers. Noyb then replicated the same argument against Google months later.
First-order effects
- German and Spanish regulators are now obligated to assess whether Apple's letting advertisers track users via IDFA breaches EU law, putting Apple's privacy positioning under formal investigation in two markets at once.
- Apple, which markets itself on privacy against ad-funded rivals, must defend a first-party identifier that functions much like the tracking tools it criticizes.
Second-order effects
- Noyb filed the mirror-image claim that Google's Android Advertising Identifier violates the ePrivacy Directive before the French privacy watchdog, so both major mobile platforms' ad identifiers face the same legal attack simultaneously rather than one being singled out.
- Advertisers and ad networks that buy against mobile identifiers across iOS and Android face correlated regulatory risk, since a finding against either identifier undermines the cross-platform measurement they depend on.
Third-order effects
- If regulators accept the argument, consent for persistent device identifiers becomes an enforceable requirement EU-wide, shifting mobile ad targeting from default-enabled to opt-in by legal design rather than platform policy.
- The strategy also tests whether activist-filed complaints in responsive jurisdictions can force action where slower authorities have stalled — a structural shift in how EU privacy enforcement actually gets initiated.
The trend: Mobile advertising's identifier infrastructure is being converted from assumed default to consent-gated technology through coordinated, multi-jurisdiction complaints by privacy groups rather than legislation alone.