Hello everyone,
John here, after a busy month in Brussels, where I once again had the opportunity to represent Open Web Advocacy and Cryptee at the European Commission's DMA Compliance Workshop along with two of the best side-kicks I could imagine to have, Roderick Gadellaa and James Heppell standing in for Open Web Advocacy. Our goal was simple: to hold Apple accountable and question them directly about their so-called "compliance" with the Digital Markets Act.
After 15 months of the DMA being in force, it’s clearer than ever that Apple’s strategy is to comply only on paper. They've erected byzantine contractual and technical barriers that make it nearly impossible for true browser competition to flourish on iOS.
Our good friend, Vivaldi's Technical Communications Officer Bruce Lawson wrote an excellent blog post covering this DMA workshop, with tons of great quotes. There really isn't much we can add to Bruce's incredible blog post, but we thought we'd publish our version featuring a few video snippets relevant to Cryptee, and our answers to Apple, for you, the reader to enjoy.
For Cryptee, and for the future of the open web, this isn't just a legal debate—it has become an existential fight for the web itself. Furthermore, as we saw in Brussels, during the 7,5 stressful hours, when you ask Apple direct questions, you get anything but direct answers, and this pattern of evasion continued throughout the day.
So grab yourself a cup of tea or wine dear reader, and let's begin.
The Age Restriction Dark Pattern
One of the most cynical tactics we've uncovered is how Apple uses parental controls to stifle browser competition. On iOS, all major web browsers, including Apple's own Safari, are rated 17+. However, if a parent enables age restrictions on a child's device to block 17+ apps, something strange happens: all third-party browsers become un-installable and unusable, but Safari —which has the exact same 17+ rating— remains perfectly functional.
This isn't about protecting children; it's about locking them into Safari. An estimated 15% of all European users are under 18. Thanks to this dark pattern, they are denied genuine browser choice and grow up knowing only Safari. I challenged Apple on this directly.
Given that all browsers on iOS, including Safari, use the exact same web content restriction setting, what is it about other browsers that means that they’re not allowed to be installed or used when Safari is? [...] What specific steps will Apple take to ensure that third-party browsers [...] are treated equally in age-restricted environments?
— John
Apple's response was a masterclass in deflection, vaguely acknowledging it's an area they are "looking at" without committing to any specific action or timeline.
This issue is a major focus for Apple currently. [...] We're doing a lot of focused work there. And that is an area that we will be looking at and are looking at.
— Apple
This isn't a complex technical problem; it's a deliberate design choice to hobble competitors and undermine the DMA.
The Web App 'Problem': Harder to Install, Impossible to Improve
As you know, Cryptee is a Progressive Web App (PWA), which is a type of web app that can be installed on a device as a standalone application and can even be used while offline. We chose the web because it’s an open, private, and secure platform that respects user freedom. Apple, however, sees the web as a threat to its App Store monopoly, which generates trillions in sales, and makes Apple billions in revenue every year. At the workshop, I asked Apple why they make it so difficult for users to install Progressive Web Appss like Cryptee.
To install a web app on iOS, a user must go through a four-step process navigating the Safari menu, finding the Share icon, scrolling down and clicking the confusingly named "Add to Home Screen" button instead of 'Install'. [...] With the iOS 26 beta, Apple has made it even more difficult [...] So why is Apple trying to make it even harder than it already is to install web apps?
— John
Apple’s response was predictable. They claimed the App Store's "thorough app review process" justifies the difference. A particularly disingenuous take, given the daily reality of the App Store, so I had to bring up some stats.
Kyle, you spoke at length about the App Store as if every app is carefully reviewed, safe, and secure, but that doesn't simply match the reality. [...] Apple's own internal communications acknowledge that human app review is ineffective... one of my favorite quotes is: "App review is bringing a plastic butter knife to a gun fight."
— John
Even more critical is the engine that powers web apps. True competition requires browsers to use their own engines, but Apple is blocking this. I asked when we could expect PWAs to run on third-party engines. Their answer?
We have nothing to announce in terms of what we will do if and when a third-party browser engine comes to iOS.
— Kyle Andeer, Apple
"Nothing to announce." This means Apple intends to keep web apps shackled to their own engine WebKit, unilaterally capping their performance and features to ensure they never pose a real threat to native apps.
A Poison Pill for Competing Browsers
The foundation of a healthy web ecosystem is browser competition. The DMA explicitly bans Apple from forcing its WebKit engine on other browsers. Yet, Apple’s "solution" is a masterclass in malicious compliance. As my OWA colleague Roderick Gadellaa —who by the way has an amazing blog listing out Safari's show-stoppers— pointed out, Apple has created a trap.
One of the key issues slowing progress is that Apple is not allowing browser vendors to update their existing browser app to use their own engine in the EU [...] This means that browser vendors have to ship a whole new app just for the EU and tell their existing EU customers to download their new app and start building their user base from scratch. [...] Why is Apple still insisting that browser vendors lose all their existing EU customers?
— Roderick Gadellaa, OWA
Apple's Kyle Andeer dodged the question, claiming browser vendors like Google and Mozilla have simply "chosen not to" bring their engines to iOS "for whatever reason". The reason is obvious: Apple has designed a system which allows them to pretend to comply while offering a commercially unrealistic and non-viable solution. No company would willingly abandon its entire user base of millions.
Building a Web You Can't Test
Even if a competing browser vendor overcame Apple's contractual hurdles, they would face another impossible barrier: testing. The web is global. Developers in the US, Asia, Africa and elsewhere build websites and web apps for customers in the EU. For the web to work, these developers must be able to test their products on the browsers their customers use.
My colleague from OWA, James Heppell —who recently published his fantastic summary of our experiences in Brussels—, pointed out that Apple's EU-only restrictions would make it impossible for the vast majority of web developers to test their sites on new browser engines like Firefox's Gecko or Google's Chromium on iOS.
Most web developers [...] are all around the world. [...] and they still serve EU users, but they're going to be unable to install or test these new browsers with their third-party engines on their devices. This means that these developers will be able to test Safari, but not Firefox's Gecko or Chromium, putting these competing browsers, web developers, businesses, and users at a significant disadvantage. [...] What solution does Apple propose?
— James Heppell, OWA
Apple has already solved this for native apps, allowing developers outside the EU to test EU-only features. Yet, for the web, they offered another vague promise with no details.
I think that's a subject of active discussion. I think we've been discussing it with Mozilla and Google also and the Commission. I would expect to see some updates there.
— Apple
Without a concrete solution, Apple is ensuring that any competing browser engine would launch into a hostile environment where websites are broken by default, dooming it to fail.
Interoperability Tracking with a PDF
To ensure transparency, the European Commission required Apple to implement a public, searchable tracker for interoperability requests. This would allow developers like us to see the status of requests for new features and APIs. Apple’s solution? A static PDF, updated once a week, hidden behind a developer login. It is the technological equivalent of a "Beware of the Leopard" sign.
I questioned how this could possibly meet the Commission's clear requirements.
Does Apple believe that a static PDF meets the very clear requirements laid out by the commission?
— John
In a truly bizarre moment, Apple, a three-trillion-dollar technology giant, claimed they simply didn't have time to build anything better in months.
We are amazing at what we do. We can do amazing things. But achieving a fantastic solution against those deadlines [...] causes some practical realities. We did something that was the absolute best we could achieve in that short timeline.
— Apple
This is, of course, absurd. Apple runs complex bug and feature trackers for its other projects and uses platforms like GitHub. The PDF is a deliberate choice to create a bureaucratic black hole, discouraging requests and slowing progress to a crawl. It’s malicious compliance in its purest form.
It’s clear Apple is playing for time, using its vast resources to delay, obfuscate, and litigate, all while protecting its most profitable revenue streams. If you'd like to read an even more comprehensive summary: Open Web Advocacy has published its review here, and it's well worth a read.
THE B-ROLL.
This year, we as OWA showed up to the DMA workshop hearing so much more prepared. We had tons of questions —more than we could fit into the short 7,5 hours—, and took the mic many times to ask copious amounts of hard questions. Consequently, we've become the subject of many quirky conversations and jokes at the event. Here's a fun B-Roll video from the hearing in no particular order to highlight those special "Not you, not again John" and "Oh ... it's OWA again" moments:
Why This Fight Matters for Cryptee
We are a small, bootstrapped company from Estonia. We don't have venture capital or corporate investors. Our only source of income is your subscriptions. Everything we do —from developing new features to traveling to Brussels to defend your right to an open web— is funded by you.
Standing against a multi-trillion-dollar company with a $1B+ annual legal budget is a monumental task. But we believe it's a fight worth fighting. The web is the world's only truly open and interoperable platform, and it is the greatest check against the power of gatekeepers like Apple.
If you believe in our mission and want to help us continue this work, please consider subscribing to a paid plan. Your support helps us keep the lights on and allows us to keep fighting for a web that is private, secure, and free for everyone.
For our new customers, here is a special lifetime discount code for 10% off all our paid plans:
WALLEDGARDEN
Thank you for reading and for your continued support. We have a long road ahead, but together, we can keep the web open and free.
Before closing this long blog post, I want to offer Roderick Gadellaa and James Heppell a heartfelt thank you. You guys are absolutely the best for making it to Brussels despite this summer's heatwave. Here's a photo of us after the DMA hearing in Brussels, about to grab drinks to cool down. Photo taken by our good friend, —and Cryptee's very first user— Char Stiles of the MIT Media Lab, who came to Brussels all the way from the US to support us.
In addition, I'd like to thank Alex & James Moore of the Open Web Advocacy for making this happen in the first place, for their perseverance and putting together this band of rebels. And finally I'd like to thank Bruce Lawson of Vivaldi. Thanks for being the most amazing human, helping out in any way you can, your incredible coverage of the DMA event, and your delightful humor.
All the very best from Tallinn, Estonia.
— John Ozbay