Cross-App Tracking Consent Ecosystem Dominance

1. Introduction

Cross-app tracking consent ecosystem dominance arises where a large digital ecosystem controls the technical and contractual mechanisms through which users permit or refuse the linking of information collected across different applications, websites, devices, or services.

The competition-law concern is not simply that a company collects data. The more important question is whether a firm possessing substantial ecosystem power can control the consent architecture itself in a way that:

• advantages its own advertising or analytics services;
• disadvantages competing apps or advertising intermediaries;
• restricts rivals' access to comparable data;
• raises switching or multi-homing costs;
• uses consent requirements asymmetrically;
• combines data across apps to reinforce market power;
• or converts privacy controls into an ecosystem gatekeeping mechanism.

This issue is particularly important in mobile operating systems, app stores, social-media ecosystems, digital advertising, browsers, connected devices and identity systems.

The leading European developments demonstrate that privacy and competition law can interact, particularly where a dominant undertaking's data practices affect competitive conditions.

2. Meaning of Cross-App Tracking

Cross-app tracking generally involves linking information obtained from one application or service with information obtained from:

• another application;
• another website;
• an advertising network;
• an operating system;
• a device identifier;
• offline transactions;
• data brokers;
• affiliated services; or
• other companies.

For example:

App A → collects user activity → platform links it with App B data → creates behavioural profile → uses profile for advertising → competing advertising providers receive less equivalent information.

The competitive significance becomes greater when the platform controls the operating system, app distribution, advertising infrastructure and consent interface simultaneously.

3. Consent as a Competitive Parameter

Traditionally, consent is principally a privacy-law concept.

In digital-platform competition, however, consent can become an economic parameter.

A platform may determine:

1. who asks for consent;
2. when the consent dialogue appears;
3. what information is disclosed;
4. whether refusal affects functionality;
5. whether alternatives exist;
6. whether affiliated services receive different treatment;
7. whether the platform itself can continue similar data processing; and
8. whether rival applications can obtain equivalent information.

Thus, the competition question may become:

Does the ecosystem operator use control over consent architecture to advantage itself or restrict rivals?

4. Ecosystem Dominance

Ecosystem dominance differs from ordinary dominance in a single relevant market.

A large digital ecosystem may simultaneously control:

Operating system → App store → Identity → Payments → Advertising → Analytics → User data → Consent interface

This creates the possibility of vertical and cross-market leverage.

For example, an operating-system provider may possess market power in mobile operating systems while also competing in:

• advertising;
• app distribution;
• analytics;
• browsers;
• messaging;
• video;
• search; or
• other applications.

A consent rule imposed at the operating-system level can therefore have consequences in downstream markets.

5. Principal Competition Concerns

A. Self-preferencing

A platform may require third-party applications to obtain explicit permission for certain tracking while applying less restrictive rules to its own services.

The concern is not merely that the platform has privacy rules. It is the possibility that the rules are competitively asymmetric.

If competitors lose access to behavioural information while the platform continues to obtain equivalent information through its own ecosystem, the platform could potentially strengthen its position in advertising or adjacent markets.

The German Bundeskartellamt expressly examined this issue in its Apple App Tracking Transparency investigation. It identified preliminary concerns regarding possible self-preferencing and impairment of third-party businesses.

B. Data advantage

Cross-app tracking can generate large-scale behavioural datasets.

A platform controlling several services may potentially combine:

• browsing data;
• app usage;
• search behaviour;
• purchases;
• location-related information;
• social interactions;
• device information; and
• advertising interactions.

The resulting dataset may improve:

• targeting;
• attribution;
• recommendation systems;
• advertising measurement;
• fraud detection;
• algorithmic optimisation.

This can produce data-driven economies of scope.

6. Consent Asymmetry

A particularly important issue is asymmetric consent architecture.

Suppose:

Such a structure may produce competitive effects even though every individual rule appears to concern privacy.

The key question becomes whether the platform's privacy architecture is competitively neutral.

7. Six Major Case Laws / Decisions

Case 1 — Bundeskartellamt Facebook Data-Combination Decision (2019)

The German Federal Cartel Office found that Facebook's practice of combining data from different sources raised abuse-of-dominance concerns.

The authority objected particularly to combining data from:

• Facebook;
• affiliated services such as Instagram and WhatsApp; and
• third-party websites and applications,

without giving users a genuinely voluntary choice.

The authority treated Facebook's ability to condition use of its social network on extensive data combination as relevant to its abuse-of-dominance analysis.

Significance

This decision established an important conceptual bridge:

dominance + extensive data collection + compulsory data combination + lack of meaningful choice = potential competition-law problem.

It is foundational for understanding cross-app tracking consent.

8. Case 2 — Facebook v Bundeskartellamt, German Federal Court of Justice (2020)

The German Federal Court of Justice upheld the fundamental direction of the Bundeskartellamt's intervention against Facebook's data-combination practices.

The importance of the decision lies in recognising that the exploitation of a dominant position can potentially involve conditions imposed on users concerning their personal data.

The case therefore moved competition analysis beyond traditional price-based theories of harm.

Principle

In data-driven markets, the competitive assessment may need to examine:

• contractual conditions;
• user autonomy;
• data accumulation;
• network effects;
• switching barriers; and
• exploitation of ecosystem power.

This becomes highly relevant where cross-app tracking is effectively imposed through a dominant ecosystem.

9. Case 3 — Meta Platforms v Bundeskartellamt, CJEU, Case C-252/21 (2023)

This is one of the most important authorities in the field.

The Court of Justice of the European Union considered whether a competition authority could take GDPR requirements into account when assessing abuse of dominance.

The CJEU confirmed that competition authorities may, subject to the required institutional safeguards and cooperation, consider whether data processing is compatible with the GDPR when assessing conduct under competition law.

Importance for cross-app tracking

The decision demonstrates that privacy law and competition law are not necessarily isolated regulatory compartments.

Where a dominant platform's data-processing practices form part of its competitive conduct, the legality and voluntariness of data processing can become relevant to the competition analysis.

Broader principle

A dominant digital undertaking cannot necessarily argue:

"This is purely a privacy issue, therefore competition authorities cannot consider it."

That proposition has become considerably weaker after C-252/21.

10. Case 4 — Bundeskartellamt Apple App Tracking Transparency Proceedings

The Bundeskartellamt opened proceedings concerning Apple's App Tracking Transparency (ATT) framework.

The authority examined whether Apple's rules potentially involved:

• self-preferencing;
• discriminatory treatment;
• impairment of third-party applications;
• effects on advertising-supported apps; and
• Apple's ability to impose ecosystem-wide tracking conditions while competing in adjacent markets. 

This is particularly important because ATT is directly concerned with cross-app tracking consent.

The authority noted that Apple's ecosystem position could give it the ability to establish rules affecting competitors while potentially treating Apple's own services differently.

Competition-law lesson

The relevant question is not:

"Is asking for tracking consent anti-competitive?"

Rather:

"Does the ecosystem operator apply consent and tracking rules in a competitively asymmetric manner?"

That distinction is critical.

11. Case 5 — EDPB Binding Decision 3/2022 — Meta Behavioural Advertising

The European Data Protection Board's Binding Decision 3/2022 concerned the lawfulness and transparency of Meta's processing of personal data for behavioural advertising.

The decision examined, among other issues, whether contractual necessity could constitute an appropriate legal basis for behavioural advertising.

Although primarily a GDPR decision rather than a competition judgment, it is highly relevant to the cross-app tracking ecosystem.

Significance

The decision demonstrates that:

behavioural advertising → data processing → legal basis → consent/choice → economic advertising model

are interconnected questions.

Where behavioural advertising depends upon extensive cross-service data, the legality and structure of that processing may influence competitive conditions in digital advertising.

12. Case 6 — European Commission Meta "Consent or Pay" Decision (2025)

The European Commission found that Meta's "consent or pay" model did not comply with the Digital Markets Act.

Under the model introduced in 2023, users were presented with a choice between:

• consenting to personal-data combination for personalised advertising; or
• paying for an ad-free service.

The Commission concluded that the model did not provide the required alternative involving a service using less personal data while otherwise remaining equivalent.

Importance

This is directly relevant to ecosystem dominance because the DMA specifically regulates how gatekeepers obtain consent for combining personal data between services.

The competitive significance is substantial:

Consent cannot necessarily be treated as a simple binary contractual mechanism where the platform possesses gatekeeper power.

The structure of the choice itself may matter.

13. Case 7 — Meta Platforms Ireland v European Data Protection Board, T-319/24 (2025)

In Meta Platforms Ireland Ltd v EDPB, the General Court considered Meta's challenge concerning the EDPB's position on valid consent in "consent or pay" models.

The General Court dismissed the action as inadmissible because the EDPB opinion at issue did not constitute an act producing binding legal effects capable of being challenged in that way.

Although procedural rather than a final determination that a particular consent model is unlawful, the case is useful for understanding the developing legal architecture around consent-or-pay models operated by large platforms.

14. Case 8 — Meta Facebook Proceedings Concluded by Bundeskartellamt (2024)

The Bundeskartellamt ultimately concluded its Facebook proceeding in October 2024 after Meta implemented a package of measures designed to give users improved choices concerning the combination of their data.

The authority stated that the German Federal Court of Justice and CJEU had confirmed important principles arising from the proceeding.

The resulting approach allowed users greater ability to use services separately or choose additional cross-account functionality involving additional data sharing.

Importance

The case demonstrates that a competition remedy may focus not only on prohibition but also on:

• separation of data;
• meaningful user choice;
• account controls;
• transparency;
• consent architecture; and
• restrictions on compulsory data combination.

15. Common Legal Tests

Cross-app tracking ecosystem dominance can be analysed through several competition-law theories.

A. Abuse of dominance

The authority may ask:

1. Is the undertaking dominant?
2. What is the relevant market?
3. Does the undertaking control an important ecosystem gateway?
4. Is the conduct exploitative or exclusionary?
5. Does the conduct disadvantage competitors?
6. Is there a causal relationship between the conduct and competitive harm?
7. Are there objective justifications?

B. Self-preferencing

The analysis becomes:

Platform controls consent mechanism

↓

Platform competes downstream

↓

Third-party apps face tracking restrictions

↓

Platform's own services retain comparatively greater data access

↓

Potential competitive advantage

This theory is particularly relevant to vertically integrated digital ecosystems.

C. Tying and leveraging

Cross-app consent architecture may also raise tying or leveraging questions where access to one service is conditioned upon acceptance of data practices benefiting another service.

For example:

Dominant OS

→ controls app distribution

→ establishes tracking conditions

→ affects advertising market

→ strengthens vertically integrated advertising business.

16. Relevant Market Definition

Traditional market definition may become difficult.

Potential markets include:

1. Mobile operating systems

Android versus iOS-type ecosystems.

2. App distribution

App stores may constitute a separate competitive environment.

3. Mobile advertising

Advertisers purchase targeted advertising inventory.

4. Advertising technology

Ad exchanges, demand-side platforms, supply-side platforms and measurement services.

5. User identity and attribution

Services that identify users or measure conversions across digital environments.

6. Social networks

Where cross-service data contributes to advertising monetisation.

17. Data as a Competitive Input

Cross-app tracking produces an important economic resource:

behavioural data.

Its competitive value may depend upon:

• volume;
• variety;
• frequency;
• historical depth;
• accuracy;
• interoperability;
• real-time availability;
• ability to link datasets; and
• algorithmic processing capabilities.

The problem is therefore not simply "how much data?"

It is also:

Who can combine the data, at what scale, and under what conditions?

18. Network Effects

Cross-app tracking can reinforce network effects.

For example:

More users

→ more behavioural data

→ better targeting

→ more attractive advertising inventory

→ greater advertising revenue

→ ability to subsidise services

→ more users

This creates a feedback loop.

Where a dominant ecosystem controls the consent mechanism, restrictions imposed on competitors can potentially reinforce this loop.

19. Switching Costs

Consent architecture can also contribute to ecosystem lock-in.

Users may accumulate:

• accounts;
• preferences;
• purchase histories;
• identities;
• contacts;
• application histories;
• device configurations;
• personalised recommendations.

A competitor may technically be available but unable to reproduce the accumulated ecosystem experience.

This creates a distinction between:

technical switching and economically meaningful switching.

20. Privacy and Competition: A Two-Sided Problem

There are two potential competitive dangers.

Danger 1 — Excessive tracking

A dominant platform may exploit its market power to obtain extensive data.

Danger 2 — Privacy asymmetry

A platform may impose strict tracking restrictions on competitors while retaining superior first-party data capabilities.

Therefore, competition law should not automatically assume:

"More privacy restrictions = better competition."

Nor should it assume:

"Less tracking = anti-competitive."

The relevant inquiry is the competitive design and application of the rules.

21. Objective Justification

An ecosystem operator may argue that tracking restrictions are necessary for:

• user privacy;
• cybersecurity;
• fraud prevention;
• data minimisation;
• regulatory compliance;
• preventing covert tracking;
• improving transparency.

These can constitute legitimate objectives.

The competition inquiry must then examine whether:

1. the objective is genuine;
2. the measure is suitable;
3. the measure is necessary;
4. less restrictive alternatives exist;
5. the rules apply consistently;
6. the platform benefits commercially from the restriction; and
7. the competitive effects are proportionate.

22. Self-Preferential Privacy Architecture

A particularly important hypothetical is:

Platform A requires competing apps to obtain tracking consent but permits its own apps to access equivalent information through first-party mechanisms.

This creates three possible theories:

First

Discriminatory access to data.

Second

Self-preferencing.

Third

Leveraging of ecosystem dominance into advertising.

The Apple ATT investigation illustrates why competition authorities are examining precisely this type of ecosystem-level asymmetry.

23. Consent Dark Patterns

Consent architecture may itself become an important competition issue.

Potentially problematic design features include:

• confusing consent language;
• unequal buttons;
• repeated prompts;
• default opt-in;
• complicated refusal procedures;
• degraded functionality after refusal;
• unclear data-sharing purposes;
• forced bundled consent;
• consent-or-payment structures.

Competition authorities may become interested where these mechanisms interact with substantial market power.

24. Cross-App Tracking and Advertising Markets

Advertising is particularly sensitive because data restrictions can affect:

• targeting accuracy;
• conversion measurement;
• attribution;
• audience segmentation;
• advertising prices;
• advertiser ROI;
• publisher revenue.

If independent advertising providers lose access to comparable cross-app signals while the ecosystem owner retains extensive first-party information, competitive conditions can shift.

The result could potentially be:

Reduced rival data access → weaker rival targeting → lower advertiser demand → reduced rival revenue → greater platform advertising share.

This is a potential theory of harm, not an automatic conclusion.

25. Remedies

Competition authorities may consider remedies such as:

Structural remedies

• separation of advertising operations;
• separation of data pools;
• restrictions on combining datasets.

Behavioural remedies

• equal application of consent rules;
• prohibition of discriminatory tracking requirements;
• transparent consent mechanisms;
• independent compliance monitoring.

Data remedies

• interoperability;
• data portability;
• access to measurement information;
• restrictions on exclusive first-party data advantages.

Choice remedies

• genuine refusal options;
• non-personalised alternatives;
• separate-service options;
• equivalent functionality without unnecessary data combination.

The Bundeskartellamt's Facebook proceeding illustrates how remedies can be directed toward meaningful user control over data combination rather than merely monetary penalties.

26. Relationship with the Digital Markets Act

The DMA has made this area more explicit.

For designated gatekeepers, data-combination practices can be subject to specific obligations.

The Meta decision demonstrates that the Commission treats the availability of a meaningful less-data alternative as an important element of the consent framework.

This represents a movement from:

ex-post abuse analysis

toward:

ex-ante regulation of ecosystem architecture.

27. Relationship with GDPR

GDPR and competition law address different questions.

The Meta v Bundeskartellamt judgment shows that the two frameworks can nevertheless interact in a competition investigation.

28. Important Legal Principles Emerging from the Cases

The authorities discussed above collectively support several important propositions:

Principle 1

Data practices can have competition-law relevance.

Principle 2

Consent can become a competition parameter when exercised through substantial market power.

Principle 3

Privacy rules imposed by a dominant ecosystem may require examination for competitive neutrality.

Principle 4

Competition authorities can, within the relevant legal framework, take data-protection considerations into account.

Principle 5

Cross-service data combination can reinforce ecosystem power.

Principle 6

A consent mechanism may itself require competitive scrutiny.

Principle 7

First-party/third-party asymmetry is particularly important in vertically integrated ecosystems.

Principle 8

Meaningful choice can be relevant both as a privacy safeguard and as a competition remedy.

29. Analytical Framework for Exam or Research Use

A useful framework is:

Ecosystem Power
↓
Control of OS/App Store/Identity Layer
↓
Control of Consent Interface
↓
Cross-App Data Restrictions
↓
Different Treatment of Own Services and Rivals?
↓
Data-Access Asymmetry
↓
Advertising / Analytics Advantage
↓
Network Effects + Data Feedback Loop
↓
Exclusionary or Exploitative Effects
↓
Objective Justification / Proportionality
↓
Competition Remedy

30. Conclusion

Cross-App Tracking Consent Ecosystem Dominance represents a developing intersection of competition law, privacy law, digital-platform regulation and data governance.

The central legal issue is not whether cross-app tracking is inherently unlawful or whether consent requirements are inherently anti-competitive. The more precise question is whether an ecosystem operator with substantial market power uses control over consent, data combination and tracking architecture to obtain or preserve a competitive advantage.

The most significant authorities include the Bundeskartellamt's Facebook data-combination decision, German Federal Court of Justice proceedings, CJEU Case C-252/21, the Apple ATT investigation, EDPB's Meta behavioural-advertising decision, the European Commission's Meta DMA decision, and the subsequent Meta consent-or-pay litigation. Together, these developments show a substantial shift toward examining data control and user-choice architecture as potential components of digital market power.

Key takeaway

In a dominant digital ecosystem, control over who may track, combine, access and monetise cross-app behavioural data can itself become an important source of market power.