The DMA Compliance Story: Europe and Progressive Web Apps

Apple’s success in restricting progressive web apps highlights the challenges in enforcing Europe’s DMA. It’s a fascinating three-act drama about the side effects of regulation.

Progressive web apps run in the browser without being downloaded to the user’s device. It still feels like a native app. Once installed, it will appear as an app icon on your device’s home screen alongside native apps. When opened, it launches in a standalone window rather than a browser tab. They offer the best of both worlds, balancing the convenience of web applications with the performance of native applications.

Act 1: Apple deprecates progressive web apps

The Silicon Valley giant has announced that it will no longer support Progressive Web Apps on iOS devices in the European Union.

The company blamed the DMA. New antitrust laws in Europe prohibit Apple from requiring developers of the iOS operating system to use its own Web browser engine, WebKit. Until now, WebKit was the only browser engine that could run on iOS devices. Under DMA, Apple must allow third-party browser engines. The DMA also prohibits iPhone makers from denying third-party hardware or services access to features available on Apple’s own hardware or services, in an effort to thwart Apple’s self-preference. If WebKit supports progressive web applications, Apple must similarly allow other web browser engines to support progressive web applications on iOS.

This self-serving ban left Apple with two courses of action. One is to provide the integration architecture needed by third-party browser engines to support progressive web apps. The second is to disable Progressive Web Apps. Apple chose the latter. It justified its choice citing “complicated security and privacy concerns.”

Unlike native apps, progressive web applications don’t go through an app store. These bypass App Store review. This sideloading puts progressive web apps at risk of being installed without the user’s knowledge or consent.

Previously, the security architecture of Apple’s WebKit limited the risk. If the DMA requests to allow third-party browser engines to support progressive web apps, “it would require building an entirely new integration architecture,” the company said.

Act 2: Malicious DMA compliance?

Apple’s decision to deprecate Progressive Web Apps on iOS sparked outrage. Critics pointed to the fact that Apple was never enthusiastic about these products. Unlike other mobile ecosystems, iOS has been slow to support Progressive Web App features. For example, compared to Android, iOS users must follow additional steps to install it on their home screen.

Apple’s dislike of progressive web applications is understandable. They avoid the App Store and its parent company’s fees. DMA gave Apple the perfect opportunity to stop supporting Progressive Web Apps.

Act 3: Apple brings back progressive web apps

After Apple removed support for Progressive Web Apps, the European Commission announced it would investigate the issue. Apple withdrew. Announcing continued support for progressive web applications.

At first glance, Apple’s turnaround appears to be a victory for its critics. But a closer look reveals a different story. Apple says it only supports progressive web apps “built directly on WebKit and its security architecture.” The commission appears unconvinced by allegations of malicious compliance. Instead of a slap on the wrist, Apple secured an exception to the self-preemption ban to protect privacy and security.

The story of malign compliance was never clear-cut. Apple recently started supporting progressive web application features in iOS. For example, in 2023 it became possible to send push notifications. This feature was already available on Android. Why would Apple introduce additional features to demonstrate a stronger commitment to Progressive Web Apps, but then roll it back?

Stories of side effects from DMA regulations

Rather than viewing this story as malicious compliance, a logical way to understand Apple’s initial decision to disable Progressive Web Applications is to view it as an unintended consequence.

DMA means Apple must allow third-party browser engines. This is a big departure from the way the company has been running iOS. Given this background, it seems natural that not all browser features work out of the box. Apple has decided to remove Progressive Web Apps because non-compliance risks fines and there is no secure solution that works across all browser engines.

The European Commission recently launched an investigation into Alphabet, Meta, and Apple’s DMA compliance. But Progressive’s web app story highlights that enforcement of Europe’s shiny new technological regulatory arsenal comes with difficult trade-offs, and that regulators remain actively engaged in regulatory dialogue with “gatekeepers.” It shows that

Natalia Moreno Belloso is a competition law researcher at the European University Institute.

Bandwidth is CEPA’s online journal dedicated to promoting transatlantic cooperation on technology policy. All opinions are those of the authors and do not necessarily represent the positions or views of the institutions they represent or the Center for European Policy Analysis.