Developers Reach a Port in the DMA Storm

The European Commission’s (the Commission’s) ongoing implementation of the Digital Markets Act (DMA) has brought a deluge of proposals to weaken digital marketplace and operating system safeguards. Among the most consequential for Association for Competitive Technology (ACT) members are a set of proposed measures to squash the access management functions the major operating systems use to protect privacy, security, and intellectual property. The bad news is that opportunities to weigh in on these proposed measures have been limited, complicating efforts to highlight the problems they create.

But a bright spot has emerged. On May 6, Europe’s Seventh Chamber of the General Court (the Court) officially granted ACT leave to intervene in Apple’s challenge to the EC’s proposed iOS interoperability measures for devices. While this may sound like a minor procedural milestone, it represents a critical recognition by the Court of the proposed measures’ potential impact on small business developers.

The Court appropriately acknowledged not only ACT’s role in protecting the interests of its members, but also the potential for DMA implementation to affect SMEs’ interests in iOS practices protecting intellectual property (IP), privacy, and security. Accordingly, the decision contravenes the various assertions that because ACT opposes DMA implementation in these cases, it cannot possibly be representing the interests of small business developers.

As the Court noted, “the objects of ACT include the protection of the interests of its members.” Here, there is an acknowledgment that these interests are not necessarily fully aligned with the Commission’s as it implements DMA. Likewise, the Court pointed out that “owing to the fact that intellectual property rights are essential for the pursuit of the activity of the members of ACT, the questions of principle raised in the main proceedings may significantly affect the functioning of the sector concerned and the interests of ACT . ..”

The Court also referenced ACT’s arguments that the proposed measures would harm privacy and security protections in a manner that affects ACT member interests. This sets the stage for ACT to make its case and seek annulment of the proposed measures on behalf of its members.

The Court’s decision comes as the Commission ramps up implementation of the same DMA provision—Article 6(7), Interoperability—on Android with respect to third-party artificial intelligence (AI) services. Both sets of proposed measures share a host of unbalanced ideas that would prioritize unrestricted access over privacy, security, and IP.

In the Android proceeding, for example, the Commission apparently seeks to require Android to support AppSearch for any third party. The proposed measure in this instance appears to demand that Android allow third-party apps to access data stored on a consumer’s device as part of their use of a separate app. This level of open access not only exposes sensitive user information to unwanted access by third parties, it also hands over proprietary information held by developers to opportunistic IP thieves. It is unclear if the Commission contemplates some sort of safeguards around this that are not immediately discernible in the proposed measures. But with only two weeks to learn about and respond to them, we are left with a strict reading of the document.

Similarly, the iOS proposed measures include a requirement for iOS to actively support and enable any third-party device to receive the same media casting features as Apple devices. This includes the “screen mirroring” function, whereby any activity on a given iOS device may be seen and mirrored on another device. Here again, the mandate offends core privacy and security principles that otherwise pervade Europe’s policy landscape. Likewise, it also opens new opportunities for IP and trade secret misappropriation by third parties.

ACT’s members often create and distribute apps for both Android and iOS. They choose these platforms because their owners actively manage access to the storefronts and operating systems. Users trust that they can download the apps ACT members make on these platforms without fear of third parties gaining access to the information they choose to share or their activities within the apps themselves. The Commission’s proposed measures would turn this paradigm upside down, shifting security and privacy vetting onto users and IP policing and trust-building onto developers. The Court’s approval of ACT’s application for leave to intervene in the iOS implementation matter gives developers a real opportunity to have these considerations voiced, understood, and matched against DMA proponents’ quest to reshape the mobile ecosystem to fit their needs.