EFF says DMA interoperability mandates can work with strong security

The Electronic Frontier Foundation published guidance on Oct. 21, 2026, arguing that interoperability mandates under the EU’s Digital Markets Act can coexist with strong security and privacy, directly countering technology firms’ claims that openness creates risk.

The guidance urges the European Commission to require platform interoperability without compromising user security, and EFF says well-designed interoperability rules can promote open ecosystems and protect user data simultaneously. The group characterizes the DMA’s interoperability requirement as unambiguous and not optional. EFF asks the European Commission to collaborate with firms and outside specialists on implementation guidance and compliance clarity, and it proposes a tiered approach with leniency at the start and stricter ongoing enforcement of fair competition later.

EFF says security concerns must not serve as a lever to indefinitely delay interoperability compliance. Closed systems should be impartially evaluated, and regulators can allow more time and guidance if concerns are valid.

Under Article 6(7) of the DMA, gatekeepers must allow service and hardware providers free and effective interoperability with designated Core Platform Services. The EU DMA became enforceable in 2023 and applies to gatekeepers typically with annual revenues exceeding €7.5 billion and over 45 million monthly users.

Apple claimed that enforcing DMA interoperability obligations in mobile app stores would put customers at risk and do irreparable harm to trust in its brand. Apple said: “[b]y requiring that all apps on iPhone be distributed through a single trusted source”.

Google alleged that opening Android to other app stores it could not vet would allow harmful apps to be installed. Google argued before the U.S. Supreme Court on Sept. 24, 2025, that mandated interoperation would require it to endorse stores full of harmful content. The company said this would “effectively requir[es] Google to endorse stores that might be full of harmful content”.

Large tech platforms have every incentive to resist moves to open their systems to interoperation because it lowers practical barriers and reduces consumer switching costs. Companies describe their systems’ security as a key business proposition and a reason their business models attract consumers, and tech giants argue that user data is safer when they have exclusive control.

EFF says corporations have taken control of an increasing share of online work, giving them greater ability to stifle challengers and limit choices. As the group put it, “corporations have taken control of an increasing share of this work, giving them a greater ability to stifle challengers and limit our choices”.

The U.S. Court of Appeals for the Ninth Circuit rejected Google’s argument in Epic Games’ lawsuit this year, and the ruling allowed third-party app stores to appear as apps via Google Play. Epic Games sued Google in the same year that Apple argued against the DMA over restrictive terms of service and extractive app revenue policies.

In Epic v. Apple, companies’ experts asserted systems might suffer serious security risks if forced to meet interoperability obligations. Opposing experts argued that systems would not suffer serious security risks from those obligations.

Courts, lawyers, and policymakers are often ill-equipped to interrogate the nuances of security arguments and trade-offs. Strategic use of security arguments can slow judicial and regulatory processes and lead to bad decisions harming competition and consumers, and poorly evaluated security arguments can lead to bad policies that undermine competition, openness, and innovation.

Components such as browser engines built on assumptions of privileged access by trusted parties face serious security risks when opened to unaccountable third parties, according to EFF. Independent experts rarely have the access and information needed to test companies’ security claims about interoperability.

Apple’s adoption of common standards allowed RCS, a messaging standard, and Message Layer Security, an encryption protocol, to offer encrypted messaging across Android and iOS devices. Google campaigned Apple to adopt RCS to fix the diminished green bubble experience when iPhone users text people on other phones.

EFF explained six years ago that mandating interoperability helps prevent misuse of people’s data and enables more privacy-respecting alternatives. Researchers Landis, Bietti, and Park propose a taxonomy dividing security versus interoperability concerns into engineering, vetting, and hybrid categories in a paper published Jan. 13, 2026.

Thailand proposed its Digital Platform Economy Act in May 2025 with gatekeeper thresholds of 500 million baht annual local revenue and at least 2 million users, and Thailand expects to complete the act by late 2026. The U.S. Federal Trade Commission stated in December 2023 that interoperability can coexist with privacy and security to enhance competition, and the Centers for Medicare & Medicaid Services finalized 2024 rules requiring healthcare payers to adopt standardized APIs (application programming interfaces) for secure data interoperability. For in-house teams and law firms handling technology contracts and policies, digital platform rules touch legal compliance, user privacy, and competition strategy.