Apple’s ad tracking is the target of two complaints to Spanish and German authorities by a privacy advocate whose earlier legal battles are forcing Facebook to change the way it transfers data.

Noyb, a group founded by privacy activist Max Schrems, is accusing Apple of unlawfully installing so-called identification for advertisers on its devices. The service helps Apple and apps track users’ behaviour and their consumption preferences without their consent, the group said.

“With our complaints, we want to enforce a simple principle: Trackers are illegal, unless a user freely consents,” Noyb lawyer Stefano Rossetti said in a statement on Monday. “Smartphones are the most intimate device for most people and they must be tracker-free by default.”

Schrems made a name for himself as a law student by taking on Facebook over the safety of people’s data when it was shipped to the US. He won a landmark European Union court ruling in 2015 and his complaints led to a second key judgment in July that has forced regulators on both sides of Atlantic to rethink data transfer rules. The EU’s revamped data protection rules in 2018 opened the door to mass lawsuits, which led to the creation of Noyb and a promise by Schrems to “look for the bigger cases” with the biggest impact.

Rossetti said the complaints aren’t based on the EU’s General Data Protection Regulation, or GDPR, which gives regulators the power to impose hefty fines. The issues raised won’t need the involvement of the data protection authority in Ireland, where Apple has its main EU base.

“The action refers to only German and Spanish users” who complained about Apple, Rossetti said in an e-mail. Still, he said the effects of any decision could extend beyond Germany and Spain and “it would be difficult for the company to continue doing with millions” of people “what was declared illegal for two” countries.

Apple and the two data protection authorities didn’t immediately respond to requests for comment.

App developers have historically used IDFA to help target users with ads and track the performance of ads across different devices. The iPhone maker will require app developers from early next year to show a warning label to users before collecting IDFA info on iOS 14, and will also require that users opt in to sharing it. Those changes have triggered an antitrust complaint from French advertisers who say it could make their revenue plummet.

Google, too

Noyb in May also took aim at Google in a complaint, accusing the US tech giant of tracking users of Android phones through a unique ID that allowed the firm and third parties to monitor people’s behaviour. The Irish Data Protection Commission, which is also the lead EU regulator for Google on privacy matters, in February opened a probe into Google’s processing of location data.

The latest complaints by Noyb are based on an old EU law regulating firms’ use of cookies and other tracking devices. They are not based on GDPR, which forces EU regulators to cooperate on probes where the alleged violations had a bloc-wide effect.