The EU Tracking Prompt in iOS 27.2: What to Ship

Beginning with iOS 27.2 and iPadOS 27.2, an app in the European Union can show an alternative App Tracking Transparency prompt, and an app distributed in France, Germany, Italy, Poland, or Romania gets only that version, from the new call and from the old one. The 27.2 beta SDK adds one method, requestTrackingAuthorization(usingExpandedInterface:additionalInformationAction:completionHandler:), available in iOS 27.2 and unavailable on macOS, tvOS, watchOS, and visionOS, and one optional Info.plist key, NSUserTrackingMarkdownUsageDescription. Outside the EU the new call behaves like the old one, the rule for when you must ask does not change, and EU users can be asked again one year after their last answer. The steps to ship are below. On the 27.2 beta simulator, with its region set to the United States, Germany, the Netherlands, or France, every call I could repeat on a fresh boot showed the standard alert, which is the fallback Apple documents for a device that is not in the EU; on this evidence the sheet is a device test.¹²³⁴⁵

TL;DR

• Apple’s notice, September 16. “Beginning with iOS 27.2 and iPadOS 27.2, developers will have the option to use an alternative version of the App Tracking Transparency system prompt in the EU. The requirements for when you must seek permission to track users will remain the same. Due to legal requirements, only the alternative version of the system prompt is available for apps distributed in Germany, France, Italy, Poland, and Romania.”¹
• One new method. The 27.2 beta SDK’s ATTrackingManager.h declares requestTrackingAuthorizationUsingExpandedInterface:additionalInformationAction:completionHandler: with API_AVAILABLE(ios(27.2)) API_UNAVAILABLE(macos, tvos, watchos, visionos). Its header comment: “This method behaves identically to requestTrackingAuthorizationWithCompletionHandler: in non-EU countries.”³
• The old call gets the sheet in the five countries too. Apple’s reference page for requestTrackingAuthorization(completionHandler:): “In France, Germany, Italy, Poland, and Romania, the system presents a full-page sheet; otherwise, the system prompts the person with an alert.” and the sheet “displays the NSUserTrackingMarkdownUsageDescription string with support for rich-text elements if you include it in your app’s target configuration in Xcode.” What the new call adds is the sheet in the rest of the EU, the “Additional Information” button, and the flag that asks for it.⁴
• One new key, and the old one stays required. NSUserTrackingMarkdownUsageDescription is optional Markdown, “bold or italic style,” bullet lists, and paragraph breaks, “but it doesn’t support underline”; the header says the original NSUserTrackingUsageDescription “must be in” the Info.plist for the new call too.³⁴
• The “Additional Information” button is not a yes or a no. Apple’s header: “If the user taps the ‘Additional Information’ button, the prompt dismisses without recording an authorization decision, your additionalInformationAction runs so you can surface your own privacy information, and the completion handler receives notDetermined.” Your code has to ask again afterward.³
• Re-prompting, EU only. “you can reprompt a user via the App Tracking Transparency system prompt one year after the user’s previous choice in your app’s App Tracking Transparency system prompt, regardless of whether that choice was to accept or reject,” unless the person turned off “Allow Apps to Request to Track,” which the EU renames “Allow Apps to Request to Link Your Activity Across Companies.”²
• What the simulator shows. On an iPhone 18 Pro simulator on the iOS 27.2 beta runtime, with the region set to the United States, Germany, the Netherlands, or France, the new call with preferExpandedInterface: true presented the standard alert with the original usage description and no “Additional Information” button; so did false, a nil action, and the old call, and the completion waited for a tap with the status at notDetermined. One way to get an immediate notDetermined instead reproduces on demand and is documented below, a prompt still pending from an earlier launch; two France launches on September 20 also returned at once, with no cause I could record, and the same configurations prompted on later fresh boots.⁵

What changed, in Apple’s words

Apple has published the change in prose three times, starting with the September 16 notice, which also gives the reason: “As part of agreements with select European competition authorities, Apple is introducing changes to its App Tracking Transparency framework in the European Union.” The rest of the notice gives the rule and the five countries.¹ The App Store policy page adds the shape of the prompt: “The alternative version of the App Tracking Transparency system prompt has modified formatting and language and provides you the option to use a text button labeled “Additional Information.” This allows you to surface additional information about your request to link user or device data collected from your app with user or device data collected from other companies’ apps, websites, or offline properties for targeted advertising or advertising measurement purposes, or to share user or device data with a data broker.”² And the iOS and iPadOS 27.2 beta release notes, under App Tracking Transparency, New Features, put it in one line: AppTrackingTransparency “now supports an alternative expanded prompt and re-prompting on a yearly basis for EU users. The alternative prompt is required for users in France, Germany, Italy, Poland, and Romania.”⁶

The policy page also says what stays put: the requirement to ask before you track, and your responsibility for anything behind the button. “Any additional information related to your request or more granular consent controls provided via the text button are entirely your responsibility. However, you cannot access the device’s advertising identifier, or otherwise collect and use device or user data from your app as described in the App Tracking Transparency system prompt, until the user has granted your app permission in that prompt.”²

The API in the 27.2 SDK

Xcode 27.2 beta (27B5019j) carries the iOS 27.2 SDK as build 24B5084k, and its AppTrackingTransparency.framework header adds one class method next to the one you already call:³

+ (void)requestTrackingAuthorizationUsingExpandedInterface:(BOOL)preferExpandedInterface
                               additionalInformationAction:(nullable void(^)(void))additionalInformationAction
                                         completionHandler:(void(^)(ATTrackingManagerAuthorizationStatus status))completion API_AVAILABLE(ios(27.2)) API_UNAVAILABLE(macos, tvos, watchos, visionos);

In Swift that is ATTrackingManager.requestTrackingAuthorization(usingExpandedInterface:additionalInformationAction:completionHandler:), and Apple’s reference page marks it iOS 27.2, iPadOS 27.2, and Mac Catalyst 27.2, all beta. The header comment is the fullest description of the two parameters Apple has published, and four of its sentences decide how you write the call.³⁴

• “Pass YES to preferExpandedInterface to request the alternative prompt where permitted; pass NO to request the original prompt.” And on the parameter: “Note that in France, Germany, Italy, Poland, and Romania, due to legal requirements, only the expanded interface version of the ATT prompt will be available regardless of what is passed in to preferExpandedInterface.”
• “If you pass nil to additionalInformationAction, this button will not be shown.”
• “If the user taps the ‘Additional Information’ button, the prompt dismisses without recording an authorization decision, your additionalInformationAction runs so you can surface your own privacy information, and the completion handler receives notDetermined.”
• “iOS users may be re-prompted in eligible regions on a periodic basis even after a previous authorization decision. If the user is not eligible to be re-prompted and a previous authorization decision exists, the completion handler is called with that prior decision without showing the prompt.”

The reference page draws the regional table the header only implies. In France, Germany, Italy, Poland, and Romania: “The system displays markdown text you supply via NSUserTrackingMarkdownUsageDescription in a full-page sheet regardless of what you set for preferExpandedInterface, and includes an Additional Information button if you supply an action.” In the rest of the European Union: “The system displays markdown text in the NSUserTrackingMarkdownUsageDescription, if you supply it. The system displays the full-page sheet if you set preferExpandedInterface to true, and includes an Additional Information button if you supply an action.” Everywhere else: “Outside of the European Union, the system doesn’t use either parameter, and presents a system alert displaying the original NSUserTrackingUsageDescription, which is equivalent to calling requestTrackingAuthorization(completionHandler:).” The page adds the condition for the regional behavior: the device must be “located in a specific European Union country and signed in with an Apple Account with a specific EU country or region.”⁴

The page for the older call, requestTrackingAuthorization(completionHandler:), now says the five countries get the sheet from it as well: “In France, Germany, Italy, Poland, and Romania, the system presents a full-page sheet; otherwise, the system prompts the person with an alert.” and, under the target properties, “In France, Germany, Italy, Poland, and Romania, the full-page sheet displays the NSUserTrackingMarkdownUsageDescription string with support for rich-text elements if you include it in your app’s target configuration in Xcode.” That page gives no version for the sheet and lists the method at iOS 14 with no beta mark, so the 27.2 floor for it comes from the release note rather than the page. Read together, the new call buys you the sheet in the rest of the EU, the button, and a say over the flag; in the five countries the sheet arrives either way.⁴⁶

The two Info.plist keys

NSUserTrackingUsageDescription does not go away. The header’s “Important” note on the new method repeats the old requirement word for word: the key “must be in” the Information Property List, and the reference page for the new key says the system falls back to it “if your app’s target properties omit this key.”³⁴

NSUserTrackingMarkdownUsageDescription is the addition, marked iOS 27.2 and iPadOS 27.2 beta. Apple’s page: “The format of the string is Markdown text; you can apply bold or italic style, but it doesn’t support underline. You can include bullet lists and paragraph breaks.” It is regional in the same way as the prompt: used in the five countries whenever present, by the old call as well as the new one, used in the rest of the EU when you pass preferExpandedInterface: true, and ignored outside the EU. Apple’s two pages word the middle case differently, the method’s page saying the system displays the Markdown “if you supply it” and the key’s page adding the condition that you pass true; the key’s page is the stricter reading and the one the diagram above follows. Apple’s tip on the page is the one it gives on the original tracking key’s page: “Keep the text of your description short and specific. The system displays your app name in the prompt so you don’t need to include it in the string.”⁴

The yearly re-prompt

The policy page states the rule for the EU: “you can reprompt a user via the App Tracking Transparency system prompt one year after the user’s previous choice in your app’s App Tracking Transparency system prompt, regardless of whether that choice was to accept or reject. A user cannot be re-prompted if they have disabled “Allow Apps to Request to Track” (renamed to “Allow Apps to Request to Link Your Activity Across Companies” in the EU) in their device’s Settings.”² The header describes the mechanism from the app’s side, twice. On the older method: “In eligible regions, iOS users may be re-prompted after a year has passed since their last decision; otherwise the system remembers the user’s choice and doesn’t prompt again unless the user uninstalls and then reinstalls the app on the device.” On the new one: an ineligible user with a prior decision gets that decision back from the completion handler “without showing the prompt,” so a second call is safe to make and the system, not your code, decides whether a prompt appears.³ What neither document gives is a way to ask whether a user is eligible before calling; the call is the query.

What the 27.2 beta simulator does

I built a single-file SwiftUI probe against the iPhoneSimulator 27.2 SDK with both keys in its Info.plist, NSUserTrackingUsageDescription set to “Probe: the standard usage description.” and NSUserTrackingMarkdownUsageDescription set to a bold word, an italic phrase, and a two-item bullet list, and ran it on an iPhone 18 Pro simulator on the iOS 27.2 beta runtime (24B5084k), rebooting the simulator before each run and setting the region through the global AppleLocale preference. Six runs on September 19: the United States, Germany, and the Netherlands with preferExpandedInterface: true and an action; Germany with false; France with true and no action; Germany with the older call.⁵

On September 19 every run produced the same thing: the standard alert, titled “Allow “ATTProbe” to track your activity across other companies’ apps and websites?”, showing the original usage description, with “Ask App Not to Track” and “Allow” and no third button. The Markdown text never appeared, no completion handler fired within the sixteen-second capture, and in the five expanded runs trackingAuthorizationStatus read notDetermined at every three-second check for twelve seconds; the older call’s run logged its mode=legacy line and nothing after it, and waited the same way.⁵ That is what Apple’s reference page predicts for a device that is not located in the EU, and the simulator’s region setting is a locale, not a location; the sheet, the Markdown text, and the button are a device test with an EU-region Apple Account.

Re-run on September 20 after a reboot of the Mac, the same six runs prompted for the United States, Germany, and the Netherlands as before, but the France run returned notDetermined to the completion handler in the same second as its request and showed no alert. Two more France launches that morning did the same and a third prompted; of the three immediate returns, only the 7:23 one coincided with anything the files record, a second script reinstalling the probe under it, and the 7:21 and 7:26 ones have no recorded cause. With nothing else touching the simulator, three more fresh-boot launches, France with an action, France without, and the United States, all prompted and waited. So the same France configurations prompted on later fresh boots, and I have no France rule to report, only a caution: an immediate notDetermined with no alert on a beta simulator is a result to repeat on a fresh boot before it is believed.⁵

The iOS 27.2 beta simulator, region set to Germany, after the expanded-interface call on September 19: the standard alert, the original description, two buttons. This image is the one export made before the reboot that took the rest of that day’s files.

The wrong turn that does reproduce on demand is a pending prompt. Launch the probe, leave the alert unanswered, uninstall and reinstall the app, and launch again: the second launch’s expanded call returned notDetermined to the completion handler in the same second as its request while the alert stayed on screen, and a third launch using the older call did the same, legacy-request status=0 (notDetermined) within a second. That is the case the header describes: “The authorization prompt doesn’t display if another permission request is pending user confirmation. Concurrent requests aren’t preserved by iOS,” followed by the instruction to check trackingAuthorizationStatus for notDetermined “to determine if you need to make an additional call,” and the older call’s page lists it among the times the system runs your completion handler without a prompt: “An existing permission request is pending.”³⁴⁵ A fresh boot clears it. If your app asks from more than one place, or asks again on a schedule, that immediate notDetermined is what the second caller gets.

What to ship, step by step

1. Keep NSUserTrackingUsageDescription. It stays required, and it is the text every non-EU user and every EU user without the Markdown key will see.³⁴
2. Add NSUserTrackingMarkdownUsageDescription with the same request in short Markdown: bold or italic, bullets, paragraph breaks, no underline, no app name.⁴
3. Gate the new call on availability and keep the old call as the fallback: on iOS 27.2 and later call requestTrackingAuthorization(usingExpandedInterface:additionalInformationAction:completionHandler:); earlier, requestTrackingAuthorization(completionHandler:). Pass true to get the sheet in the rest of the EU; the five countries ignore the flag. The shape that type-checks against the 27.2 SDK for an iOS 26 floor:³⁴⁵

#if os(iOS)
if #available(iOS 27.2, *) {
    ATTrackingManager.requestTrackingAuthorization(usingExpandedInterface: true,
                                                   additionalInformationAction: showPrivacyDetails) { status in
        handle(status)
    }
} else {
    ATTrackingManager.requestTrackingAuthorization { status in handle(status) }
}
#endif

1. Decide about the button. Pass an action only if you have a page or screen to show. When the action runs, treat the status as notDetermined, show your information, and, in the policy page’s words, “you can redirect the user back to the App Tracking Transparency system prompt for your app to ensure their choice is recorded,” but “you should not redirect users to your ATT prompt if they have opted out of all relevant legal consent choices in the screen or page surfaced.”²³
2. Plan the re-prompt as a call, not a timer. Calling again in the EU is how you find out whether a year has passed; the completion handler returns the prior decision when the person is not eligible.²³
3. Test on a device with an EU-region account. Whenever the simulator showed a prompt, in every region and on fresh boots, it was the standard alert and never the sheet, and Apple’s condition is device location plus Apple Account region, so the full-page sheet is a device test.⁴⁵
4. Check the Mac target. The header marks the method unavailable on macOS, tvOS, watchOS, and visionOS, so a shared call site needs #if os(iOS) around the call with if #available(iOS 27.2, *) inside it; an availability check alone still fails to compile, with 'requestTrackingAuthorization(usingExpandedInterface:additionalInformationAction:completionHandler:)' is unavailable in macOS, as footnote 5 records. The reference page’s Mac Catalyst 27.2 entry and the header’s API_UNAVAILABLE(macos) describe the same line from two sides: Catalyst counts as iOS to #if os(iOS).³⁴⁵

FAQ

Do I have to adopt the alternative prompt?

In France, Germany, Italy, Poland, and Romania the alternative prompt is the only version available for apps distributed there, per Apple’s notice, and on 27.2 you get it from either call: the new call shows the full-page sheet there “regardless of what you set for preferExpandedInterface,” and Apple’s page for the older call says “In France, Germany, Italy, Poland, and Romania, the system presents a full-page sheet; otherwise, the system prompts the person with an alert,” with the Markdown key shown “if you include it in your app’s target configuration in Xcode.” Adopting the new call is what gets you the sheet in the rest of the EU, the “Additional Information” button, and a say over the flag.¹³⁴⁶

Does it change when I have to ask permission?

No. Apple: “The requirements for when you must seek permission to track users will remain the same.”¹

Does the Markdown key replace NSUserTrackingUsageDescription?

No. The original key is still required for both calls, and the system uses it whenever the Markdown key is absent or the device is outside the EU.³⁴

Can I ask again after a user said no?

In the EU, one year after the previous choice, “regardless of whether that choice was to accept or reject,” unless the person disabled the setting Apple renames in the EU to “Allow Apps to Request to Link Your Activity Across Companies.”²

Does the new API exist on macOS or visionOS?

No. The 27.2 SDK header marks it API_UNAVAILABLE(macos, tvos, watchos, visionos); the reference page lists iOS, iPadOS, and Mac Catalyst 27.2.³⁴

Sources