The DMA should not undercut security & privacy for Europeans

Today’s decisions risk undermining vital privacy and security guardrails for millions of Europeans. We have repeatedly offered solutions to safeguard users while satisfying the DMA’s goals, but these rulings discount extensive evidence of user harm.

The reality is that AI assistants already safely access Android’s capabilities, with phone makers playing a key role in vetting them. This Android ruling threatens device security by granting external apps sensitive and powerful device permissions without these safeguards. This is occurring as the EU’s own cybersecurity agency warns that “security fundamentals matter more than ever in the age of AI”.

Of particular concern, Europeans’ private searches would be exposed to unfamiliar companies, without adequate anonymisation of the data and without user knowledge or consent. This would weaken citizens’ privacy, risk business trade secrets, and endanger national security.

As the Commission’s decision recognises, a flexible, evidence-based process will be critical to account for these significant harms and adjust measures accordingly. We will continue advocating for a balanced approach that protects privacy and security while supporting market goals.

The DMA should not undercut security & privacy for Europeans

The Digital Markets Act (DMA) is an ambitious regulation designed to increase competition in Europe’s digital economy, but its implementation must not come at the expense of user security and privacy. Striking a balance between breaking up Big Tech monopolies and maintaining strict security standards remains a central challenge for European policymakers. [1, 2, 3, 4, 5]

The Privacy and Security Challenge

While the DMA aims to open closed ecosystems, security experts and tech companies have raised several critical concerns: [6, 7, 8, 9]

Sideloading Vulnerabilities: Forcing platforms to allow third-party app stores (sideloading) can bypass central security screening. This increases the risk of malware, scams, and data theft for everyday consumers. [10, 11, 12, 13, 14]
Interoperability Risks: Requiring encrypted messaging apps (like WhatsApp or iMessage) to work with smaller platforms can weaken end-to-end encryption protocols. It potentially creates backdoors or data leaks during cross-platform transfers. [15, 16, 17, 18]
Data Sharing Exploits: Gatekeepers are mandated to share certain data with business users. Without strict guardrails, this could lead to unauthorized tracking or the misuse of personal consumer information. [19, 20, 21]

Built-In Safeguards Within the DMA

The European Union anticipated these risks and included specific provisions to ensure security is not entirely compromised: [22, 23]

Proportional Security Measures: The text of the DMA explicitly allows gatekeepers to implement “strictly necessary and proportionate” measures to ensure third-party apps or services do not compromise device security or integrity. [24, 25]
Compliance with GDPR: The DMA does not override the General Data Protection Regulation (GDPR). Any data sharing or interoperability requirements must still fully comply with Europe’s strict data privacy laws. [26, 27, 28]
Regulated Access: Gatekeepers can still require third-party developers to meet verified identity and basic security standards before gaining access to core system APIs. [29, 30]

The Path Forward

Regulatory bodies like the European Commission must continuously monitor implementation. The goal is to enforce fair competition while ensuring that tech companies do not use “security” as a fake excuse to block competitors, nor allow malicious actors to exploit the newly opened digital doors. [31, 32, 33, 34, 35]

Would you like to explore how specific companies like Apple or Google are adapting their security models to comply with the DMA, or should we look into recent European court rulings regarding these privacy concerns?