Tuesday, June 24, 2025

Amazon’s Second DMA Compliance Workshop – The Power of No: Where the Balance Should Land

Alba, here.  

Recording of the workshop here.

ANDREA BARTZ ET AL. V: ANTHROPIC

 Here

Excessive Wealth Concentration and Power

 CEU, here

I've been dealing with this topic for 7 lustra and it looks increasingly bleak - not my fault😉

WhatsApp banned on House staffers' devices

 Axios, here

CMA takes first steps to improve competition in search services in the UK

 




Here

Proposed decision here.

Roadmap here

Exploring consumers’ search behaviours here.  

Read also Sarah's blog post here ("Based on how it is currently offered and used, we have provisionally decided that Gemini AI assistant should not be included as a product within this scope").



"We have identified a further set of possible actions (for example, restricting use of default agreements and providing access to underlying search data) which are currently the subject of live litigation between the US Department of Justice and Google. We will consider our approach in these areas in light of developments over the coming months. This is in line with the CMA’s prioritisation principles and the government’s recent strategic steer, which encourages the CMA to consider where we are best placed to act"





Thursday, June 19, 2025

G7 Data Protection and Privacy Authorities’ Communiqué

 Here.

The Progressive Regulator Winning Over the Populist Right

 Podcast, here.

DMA (Team) Sudans, when will Meta's compliance with Article 5(2) finally flow?


Don't look for it in Rome...

  Nearly two months on, the Commission’s DMA non-compliance decision against Meta  was finally published yesterday [18 June]. Coincidentally or not, a German court also published a ruling yesterday, offering its own reading of the same DMA obligation with which, according to the Commission, Meta is not (yet?) compliant. As Wavesblog Readers will appreciate, both are of considerable interest. What follows are a few preliminary observations. Let me begin, however, with a brief disclosure. During the eight months in which I had the pleasure of consulting for Article 19, I had occasion to focus on Meta twice: first, in writing about an intriguing German judgment applying Article 102 TFEU (not the one you're thinking of, another one entirely); and second, precisely in relation to the application of Article 5(2) of the DMA.  As for the latter, in the course of that work I had reached the conclusion, now confirmed by the Commission in its recently published decision, that there was simply no way Meta could be considered compliant, a conclusion I had the pleasure of presenting in the Commission’s presence in beautiful Fiesole.
 

Why, then, did it take an 80-page decision, and why is Meta, in all likelihood, still not compliant more than a year after it was first required to be? The most obvious answer, of course, is that the obligation in question strikes at the very heart of Meta’s business model, not only as it stands today, but also with implications for future developments, given the EU legislator's insistence on DMA compliance by design, a theme that has been a recurring one here on Wavesblog. Moreover, in this case, the Commission is not simply tasked with interpreting and enforcing a 'standard' DMA obligation in relative isolation; to do so, it must also apply the General Data Protection Regulation in conjunction with the DMA. That these two legislative instruments converge in more than one respect is also confirmed by the German ruling mentioned earlier and to which we shall return in due course. On that note, we are still awaiting the joint EDPB/Commission guidance on the interplay between the DMA and the GDPR, which, according to  Commission’s remarks this week in Gdańsk, is expected imminently. Interestingly, the Commission takes this into account as a mitigating factor in determining the fine for non-compliance ("the Commission acknowledges that the interplay between Regulation (EU) 2022/1925 and Regulation (EU) 2016/679 created a multifaceted regulatory environment and added complexity for Meta to design its advertising model in a manner compliant with both regulations"). That might be perfectly understandable, were it not for the fact that we are, after all, dealing with Meta, which has elevated non-compliance with the GDPR to something of an art form worthy of Bernini. This raises both a puzzle and a question: will Meta be left to do much the same under the DMA? And might other gatekeepers be allowed to match, or even surpass, it? Is there, perhaps, a structural flaw in the DMA’s enforcement apparatus, just as there are, quite plainly, in the GDPR, that gatekeepers can be expected to exploit at every opportunity? Or is it simply a matter of DMA enforcement resources falling well short of what would actually be required? What, then, can be inferred from this particular decision in response to that question? Serious reflection is clearly needed here. For now, I can offer you, Wavesblog Readers, only a few very first impressions, but I’d be all the more keen to hear yours. 

Even before Compliance Day (7 March 2024), it is clear from the decision that the Commission already had serious reservations about the "Consent or Pay" advertising model that Meta was in the process of grinding out, which had been presented to the Commission as early as 7 September 2023. The decision makes clear not only that the Commission was in close dialogue with Meta, but also that it engaged with several consumer associations and other interested third parties, on both the DMA and privacy sides of the matter. On that note, a further question, though perhaps it’s only me. Should there not be, if not a formal transparency requirement then at least a Kantian one, for the Commission to list, even in a footnote, all the interested parties with whom it bilaterally discussed the matter?  On this point, one almost hears the Commission suggesting that such a transparency obligation might discourage others from speaking up, for fear of retaliation by the gatekeeper. The point is well taken, but one wonders whether some form of protected channel might be devised, a kind of "privileged observer’s window with shielding" available where reasonably requested, providing clear assurances that the identities of those coming forward will be safeguarded (short of being a whistleblower). Moreover, as is well known, this point tangentially touches on a broader issue. The EU legislator, likely with a view to streamlining enforcement, left limited formal room for well-meaning third-party involvement. The Commission-initiated compliance workshops, the 2025 edition of which has just begun, are a welcome addition, but they are, of course, far from sufficient. In particular, without access to fresh data provided by the gatekeepers, available only to the Commission, how are third parties expected to contribute anything genuinely useful at this point of the "compliance journey"? As we shall see, this concrete data was also an important point in the very process that led to the adoption of the non-compliance decision in this case (Meta knew that its 'compliance model' was producing exactly the result they wanted). The lawyers, economists and technologists on the DMA team have clearly had their hands full in the matching ring with Meta (hence, of course, the Sudans in the title). Even a quick reading of the decision reveals, between the lines and squarely on them, the array of tactics deployed by Meta to throw a spanner in the works of effective DMA compliance, all carefully orchestrated and calculated with precision, and surprising no one. But one does wonder whether the DMA’s hat might not still conceal other tools, better suited to crowdsourcing and channelling constructive efforts, particularly from those third parties who stand to benefit from the DMA (as we also heard in Gdańsk), from conflict-free academics, and from what might be called real civil society, genuinely committed to effective and resolute DMA enforcement, rather than the usual crop of gatekeeper-supported associations. 

To loosely paraphrase Microsoft at the 2025 Enforcement Workshop, Meta’s “compliance model from day one” was a marble (code)-carved binary choice, one that could scarcely have been further from what the EU legislator had in mind. Unlike the strategies adopted by certain other gatekeepers, Meta didn’t even bother to kick the compliance can just far enough down the road to create an illusion of movement. The opening of non-compliance proceedings came swiftly and had, by all appearances, been fully anticipated. The decision that brings them to a close contains no epiphanic surprises, and is lengthy only because Meta's counsel deployed the full repertoire of legal ingenuity, focusing in particular on arguments forged in the intersection between the DMA and data protection law. Time, then, for a modest walkthrough, dear Wavesblog Readers.
 
As one assumes it must by now form part of general digital literacy (until one realises it doesn’t, even when speaking to students born to parents who were themselves, perhaps, already digital natives), Meta "generates almost the entirety of its revenues from its advertising service." On Facebook and Instagram, both designated under the DMA, end users "post and consume personalised content." Upon registering, each user receives "a dedicated, unique user identifier... and all data tied to that user identifier is part of a unified user account for that environment, i.e., the Facebook environment or the Instagram environment." Meta combines the personal data it collects from that user within the same social network environment and further merges it with data gathered through another designated core platform service, Meta Ads, to display personalised advertising. It is solely this latter data combination that is at the heart of the non-compliance decision.

[I pick it up again now, not without noting that while I'm still writing this post, the 60-day deadline to comply with the cease-and-desist order, according to my calculations -  which are apparently wrong but I don't understand why -  has lapsed, and that DMA enforcement may well have found its way into the cauldron of Trump-era trade negotiations].

Let us suppose that you, dear Wavesblog Reader, use Instagram in the EU. Meta, as designated gatekeeper, according to the DMA (and commencing for real no later than today - 24 June - or on the 26th at the latest) must present you with the specific choice of a less personalised but equivalent alternative to the advertising-based service Instagram that you would use if you had given your consent to the combination of your personal data from Instagram with data from the Meta Ads. The object of attention are therefore "data processing activities performed by Meta for the purpose of providing personalised advertising" to you as end-user of Instagram. These "include the data processing activities referred to in Article 5(2), first subparagraph, points (a), (b), and (c)". 

Point (a) of Art. 5(2) refers to a situation in which a third party uses a Meta service and the personal data of end users who use the third party's service is provided to Meta and Meta processes that data to provide online advertising services. Point (b) applies to the combination of personal data from the designated service with other services offered by the undertaking or third-party services. Therefore point (b) does not apply only in order to provide personalised advertising. 


............

(Tbc, whenever I can - sorry!) 

DMA Periodic penalty payments for non-compliance? Not automatically

 Euronews, here

Advocate General Kokott proposes that the Court of Justice dismiss Google’s Android appeal

 CJEU, here

The role of technology experts in competition litigation

 Keystone, here

Wednesday, June 18, 2025

Meta 5(2) DMA Non-Compliance Decision

 EC, here.

[The one downloaded yesterday was _527, today _528  - the number of versions of your research article until the magic word "FINAL"]

Working on initial comments, bringing in also the German "train as you like" decision.

Urteil des OLG Köln (15 UKl 2/25) bzgl. des Trainings von Meta für ihre KI mit Daten von Facebook und Instagram

 Volltext hier.

A Competition Policy for Cloud and AI

 CERRE, here.

Digital Summit 2025 Gdansk

 Here.

Eine Juristin unter Ökonomen: Heike Schweitzers Wirken im Kronberger Kreis

 Bald hier.

Digital Decade in 2025: progress and outlook

 EC, here.

Antitrust Review Episode 44: In Conversation With Olivier Guersent

 Podcast, here.

[What went wrong, not for him but for competition and the EU consumers ;-)]

The next big power grab in AI? Why Meta’s Scale AI deal must be stopped

 SOMO, here.

The European Way | A Blueprint for Reclaiming Our Digital Future

 Chez Oles, here.

Reorienting Competition Law

 Panel, here.

Technology neutrality in EU digital regulation

 M. Almada, here.

Monday, June 16, 2025

Enshittification on steroids

 So Meta is starting to charge you for WhatsApp, with your data. And alternatives  are limited because of lack  of interoperable choices  of messaging services until now, despite the DMA. In reality, you’re paying for  Meta's AI  efforts that will increasingly manipulate you and, quite likely, kill off  much work altogether. 


Friday, June 13, 2025

High-Level Debate on Competition, Innovation and Data Protection

 EDPS, Video here.

I’ve watched almost all of it, but in terms of substance it was rather thin. Von der Leyen  I's  data economy strategy is already crumbling underfoot, with  the German industry, closely aligned with her party (and the new German government), poised to give it the final push. The only one you’d buy a used car from is Professor Louisa, but what can she realistically achieve almost single-handedly?


Thursday, June 12, 2025

Reupping this because I loved (almost) every word of it: Robin Berjon at re:publica 25

 


Video here












Thank you for asking, Robin. This is my short answer but happy to discuss it further.

Concerning the very few words I loved just a bit less: the DMA is not enough, I quite agree, and it was never designed to work in splendid isolation. Competition law against Big Tech has been spectacularly ineffective, which rather invites the awkward question of whether it is even fundamentally capable of addressing the abusive exercise of economic power at all. Still, one could hope for reform, couldn’t one? That was the idea not so long ago. Now? Well, let’s say prospects are somewhat clouded: too much capture (and not just from the usual suspects: nostalgic lawyers clinging to familiar doctrines and IO economists with a keen eye for consulting fees aren’t exactly accelerating progress).
That said, change is seeping through, almost discreetly, from within the DMA’s own machinery: adjust your business model if necessary; unable to provide interoperability? We’ll happily spell it out for you; anti-steering? Surely you jest. And more will follow. Even judges seem to be taking notice, as the Auto Android ruling suggests.
Change is happening, slowly, admittedly, and perhaps depressingly so, given how history has picked up the pace of late. But still: this is democracy at work. And in the present political climate, it would be remiss not to say so.


We All Suffer from OpenAI’s Pursuit of Scale

 K. Hao, here

Bundeskartellamt hat Bußgelder gegen Sennheiser Sonova wegen vertikaler Preisbindung beim Vertrieb von „Premium-Kopfhörern“ verhängt (Entscheidung vom 16. April 2025).

 Fallbericht, hier

Highlighting Litigation Success in the Digital Rights Community

 Digital Freedom Fund, here.

So baut man ein nachhaltiges Open Source Unternehmen

 Re:publica 25, hier.

Souverän aus Deutschland: Ionos und Nextcloud entwickeln M365-Alternative

 Heise.de, hier.

Big Tech: litigar en México!

 Aquì

Now AI tools are being imposed on us, and we even get to pay for the privilege (either with our data or with our money), whether we want them or not. What can be done?

Obviously, I don’t have the answer. If you're waiting for antitrust to step in (is it exploitative behaviour? bundling? is there "choice"? what’s the relevant market?), see you in 10 years, perhaps. What about data protection authorities? What happened with Meta's legitimate interest push to swallow up our data is frustrating to say the least (fully agree with Louisa Specht-Riemenschneider ).

The example of Wikipedia editors pushing back against AI generated summaries is instead encouraging. As part of effective regulatory frameworks, we need to devise ways for AI-affected people/humans to express their voice, mechanisms we can’t even fully envisage yet, both at the public institutional level (learnings from the Dutch scandal?) and in private institutions (Mitrechtsomething) or market settings (UI, choices, data portability, etc.).


The Most Infallible Panelist for your next AI/Antitrust Conference

 

Politico.eu, here

What Abundance Gets Wrong

 The Capitol, Video here

 

The Storm Clouds Looming Past the State Moratorium: Weak Regulation is as Bad as None

AI Now, here.  

Anyone looking into the Meta/Scale AI Deal? Can you imagine if...

 CNBS, here.

Brazil's top court votes to hold social media platforms accountable for user posts

 Reuters, here

A Manel for Heike Schweitzer

 








From LinkedIn, here

"Die Stiftung Marktwirtschaft gedenkt heute an die vor einem Jahr verstorbene Wettbewerbsjuristin Heike Schweitzer. Nach einer Einführung von Michael Eilfort ins Thema „Wettbewerb als geniales Entmachtungsinstrument“ moderiert die Wirtschaftsjournalistin Ursula Weidenfeld die Veranstaltung und Diskussion im Fraktionssaal der CDU/CSU-Bundestagsfraktion im Deutscher Bundestag.

Vielen Dank für die vielen guten Impulse!

Andreas Mundt vom Bundeskartellamt ist überzeugt, dass man den hashtagWettbewerb mit mutigen Schritten verteidigen sollte. Die Klage gegen hashtagFacebook habe 19a GWB zur Folge gehabt, welcher seine Wirkung bereits segensreich entfaltet habe. Dieser dürfe nicht geändert werden. Seine aktuelle Erfahrung mit der Trump-Administration lässt ihn sicher sein, dass man auch dort auf fachlicher Ebene trotz allem gegen wettbewerbsschädliches Verhalten der hashtagBigTech-Unternehmen weiter vorgehen wolle.

Johannes Laitenberger vom Court of Justice of the European Union macht deutlich, dass das hashtagWettbewerbsrecht „als geniales Entmachtungsinstrument“ (Franz Böhm, Wegbereiter der sozialen Marktwirtschaft) häufig vorzuziehen sei vor neuer Regulierung (außer z.B. bei den sog. Torwächtern iSd hashtagDigitalMarketAct). Der deutsche hashtagOrdoliberalismus sei von der heute gewürdigten Heike Schweitzer erfolgreich auch nach hashtagEuropa getragen worden.

Lars Feld vom Walter Eucken Institut: Wettbewerb sei ein Entdeckungsverfahren für hashtagInnovationen. Die Privatrechtsordnung müsse im Umfeld digitaler Machtkonzentrationen angepasst werden. Wettbewerb benötige eine friedliche Weltordnung, die es aktuell nicht mehr so gäbe, dass positive Werte im Privatrecht geschaffen werden können, weil Regierungen zu protektionistisch und dirigistisch seien. Eine Umkehr dieser aktuellen hashtagWettbewerbspolitik sei dringend geboten.

Josef Drexl vom Max Planck Institute: Heike Schweitzer habe zu Recht darauf hingewiesen, dass solche Unternehmen, die Marktplätze betreiben, als Hüter dieser Infrastruktur im Sinne des Ordoliberalismus besser reguliert werden müssten, damit der Wettbewerb nicht eingeschränkt wird. In bestimmten Bereichen (wie der Klimapolitik) reiche es auch nicht mehr aus, Innovationen freien Lauf zu lassen. Vielmehr müssten bestimmte Vorgaben gemacht werden (z.B. Entkarbonisierung), die Innovationen sollten diesen Vorgaben folgend entwickelt werden.

Justus Haucap vom Düsseldorfer Institut für Wettbewerbsökonomie: Allein auf den Wettbewerb zu setzen, würde nicht alle Probleme lösen, gerade nicht in Branchen mit Monopolen etc., wie im digitalen Bereich.

Thorsten Käseberg vom Federal Ministry for Economic Affairs and Energy: Würde gerne mit Heike Schweitzer heute über die hashtagMachtkonzentration bei KI-Unternehmen sprechen. Horizontale hashtagIndustrieregulierung wie etwa hashtagEntbürokratisierung sei auch wichtig für einen ordentlichen Wettbewerb.

Auch der Verbraucherzentrale Bundesverband setzt sich für einen funktionierenden Wettbewerb und eine verbraucherfreundliche Regulierung ein" 

PS: I obviously agree that competition can be a brilliant instrument for Entmachtung. But in some contexts, brilliant monopolists have managed either to disable it or to steer it entirely in their own interest (“ecosystem”). For instance, keeping competition alive in the AI era may end up resembling the artificial life support of a terminal patient. 

Wednesday, June 11, 2025

New Apple Games App: Guaranteed Un-Installable in the EU


Apple has announced that its new Games app will be preinstalled on everyone’s home screen with iOS 26 and iPadOS 26. For those rightly concerned about the extent to which the DMA is future-proof, there is some reassurance: under the DMA, this app will need to be uninstallable in the EU. The Commission has only recently closed a non-compliance proceeding against Apple, after the company brought itself into compliance by making numerous previously non-removable apps uninstallable. It is therefore highly unlikely that Apple will attempt to test the DMA boundaries again with the Games app. Right? 

Fediverse explained in 4 minutes

 E. Rossini, here

Data Portability Revisited: Toward the Human-Centric, AI-Driven Data Ecosystems of Tomorrow

 M. Fenwick et al., here

“Localhost tracking” explained. It could cost Meta 32 billion.

 Zero Party Data, here

Friday, June 06, 2025

Biting into better interoperability? First thoughts on Apple 6(7) specification decision regarding "process" (with a coda on the other specification decision)


Disclosure
: for 7 months covering Maria Luisa (Isa) Stasi’s leave, I had the honour of working with Article 19 and contributed to a civil society’s joint submission for the public consultation on this very decision. Once Isa returned (January 2025) I resumed my full-time research activities. That said, mine will be a fresh look: no hard feelings towards the Commission for having paid rather selctive attention to the observations submitted.

There is much to unpack. Decision here

The first thing to note is that the decision is limited to specifying Apple’s implementation measures with respect to the process for requesting interoperability concerning existing iOS/iPadOS features. This is a form of guidance that Apple would, by all appearances, have gladly done without, but which the EU co-legislators expressly provided for in Article 8(2) of the DMA. The DMA sets a strict deadline: the implementing act specifying the measures must be adopted within six months of the opening of proceedings. This timing is absolutely essential to prevent the process from becoming a strategy for deferring compliance ad Kalendas Graecas. Much like those in civil society, though without taking into account the stark inequality of resources, Apple was required to respond promptly, and to sacrifice part of its Christmas holidays to the case.

Now imagine, dear Wavesblog Reader, that you’re an app developer (yes, the one from the painting) who relies on  iOS/iPadOS to access your users, reading and trying to make sense of the scope of Article 6(7) of the DMA, just as the Commission does, at some length, across 54 paragraphs (41 to 95). Each of the now numerous DMA commentaries will, in future, inevitably have to begin with this detailed analysis, on which judges, too, will soon be called to rule. 

The unquestionable starting point is that Article 6(7) refers to the “same hardware and software features” as are available or used by the gatekeeper’s services or hardware. Thus, same feature (the what) and  “equally effective interoperability” (the how) in terms of both the effectiveness of the interoperability solution and the conditions under which that solution is made available to you, "by comparison to how the gatekeeper implements interoperability and access to hardware and software features for its own services and hardware".  Among the properties of the feature itself that you might care particularly about, the Commission lists by way of example the end user journey, ease of use, device and software set-up, data transmission speed, and energy consumption. According to the Commission, the EU legislator recognised that while the feature must be the same for both you and Apple (e.g., data transmission speed), the implementation of interoperability, though not necessarily identical, must be equally effective to that enjoyed by Apple. Clearly, an implementation of this obligation that grants you only a degraded feature (for instance, slower data transmission than that enjoyed by Apple), cannot be considered compliant with Article 6(7), whose purpose is to allow you to offer your services and hardware, and to innovate, “on an equal footing with the gatekeeper.” Contestability and fairness, those Castor and Pollux of the DMA temple, must be duly honoured. 

Apple was required to comply with Article 6(7), as well as the others DMA obligations, as of 7 March 2024. This, evidently, has not occurred as envisaged, as you, dear app developer, may well have noticed. Nor has it escaped the Commission, which has been closely monitoring the situation, issuing a string of RFIs along the way. Perhaps you received one yourself, an RFI from the Commission asking, for instance, about your experience filing one of the interoperability requests with Apple after DMA compliance date , or about the difficulties you faced in trying to identify the features Apple uses for its own services and hardware.To deal with this situation, in addition to the possibility of finding a plain vanilla infringement, the EU legislator has introduced an entirely novel instrument: the specification proceeding. Article 8 of the DMA confers upon the Commission the power to unilaterally determine the specific measures required for compliance, distinguishing the specification process from a commitment procedure, which is centred on making the company’s own proposals binding.

This also means that, in empowering the Commission to specify the measures necessary to ensure effective compliance with the legislative provisions, the EU legislator made clear that the Commission is under no obligation to adhere to the gatekeeper’s own, inevitably self-serving, interpretation of its compliance duties. Apple’s first (2024) and the second (2025) compliance reports stated, in concrete terms, what it considered to be the most favourable interpretation of Article 6(7): an approach based on request-based interoperability. As regards solely the features existing on the date of adoption of its  decision, the Commission considers that such an interoperability request-based process may be deemed compliant with the DMAprovided the conditions laid down in its Decision are fully met. As for new features released after the adoption of the Decision, Apple is expected to adopt by default a proactive approach to compliance and interoperability by design, as envisaged in Recital 65 of the DMA. The decision, in what is referred to as an Annex, sets out the specific measures Apple is required to implement, along with the corresponding timelines. Within two years, the Commission will assess the effectiveness and impact of these measures. Moreover, with regard to new features, excluded from the scope of the current specification, the Commission will take into account the compliance actions taken by Apple in determining whether its approach aligns with the proactive, interoperability-by-design standard foreseen in the DMA (see Article 1). 

Much could be debated as to whether the request-based process specified and prescribed by the Commission might have been further improved, and here I note once again (see disclosure) that civil society, developers, and researchers had put forward constructive suggestions, only partially reflected in the final outcome. What now most draws my researcher's initial attention, and would warrant deeper reflection beyond this blog post, is the exchange, clearly emerging from the decision, between the Commission and Apple over the meaning and practical implications of the interoperability by design obligation. Compliance by design under the DMA had already caught my attention nearly two years ago, in what now feels like the prehistory of DMA enforcement. 

In paragraph 104 of the Decision, the Commission recalls that gatekeepers should ensure compliance with Article 6(7) of Regulation (EU) 2022/1925 "by design and free of charge." This formulation encapsulates two core aspects of the provision. First, interoperability must not be treated as an afterthought or a concession granted upon pressing request, but built into the architecture of the regulated operating systems at the outset. Second, a system that imposes high transaction costs on developers to obtain interoperability can hardly be described as free of charge. In fact, this is not confined to the absence of explicit fees; it extends to ensuring that access is not undermined by burdensome procedures, opaque criteria, built-in friction, unjustified delays, etc. But then, quite justifiably, you may ask yourself, dear developer: how can the principle of interoperability by design possibly be reconciled with Apple's request-based process endorsed and further disciplined by the Commission? After all, if interoperability must be embedded by design, shouldn’t it be somewhat automatic, largely transparent, and proactively enabled, rather than contingent on your ability to navigate a request system, identify shadowy features, and patiently wait for the gatekeeper’s response?

 You may find some reassurance in reading paragraph 105, which suggests that the Commission may, in fact, share many of your views and concerns. It is worth quoting in full:

"Unlike proactive approaches such as interoperability by design, a request-based system presents important limitations and difficulties for third parties. In particular, it causes delays due to the need to process requests and implement solutions, and it leads to associated transaction costs. It requires third parties to (attempt to) recognise the hardware and software features that may be available to or used by the gatekeeper. It may also necessitate the disclosure of third parties’ confidential information to the gatekeeper. Moreover, it risks enabling the gatekeeper to maintain control over the request-based process and its outcome (i.e. whether, when and how interoperability will be provided), in a context where the gatekeeper may have incentives to refuse, delay, or restrict the provision of interoperability to competitors or potential competitors. Overall, in a context characterised by information asymmetry and imbalance in bargaining power, a request-based process may allow the gatekeeper to undermine the effectiveness of Article 6(7) of Regulation (EU) 2022/1925, and the ability of third parties to innovate." 

Nonetheless, the request-based approach adopted by Apple is endorsed by the Commission, albeit subject to the (substantial) adjustments set out in Annex I. Why? Apple, the Commission notes in paragraph 107, had not envisaged third party interoperability in the original design of the operating system and/or of the features prior to the entry into force of Article 6(7). Faced with this legacy design, the Commission appears to have accepted that a request-based mechanism could serve as a somewhat transitional form of complianceprovided it fully complies with all the conditions set out in Annex I. Subject to the conditions it lays down, the Commission considers that it has addressed the risks previously identified in the rather long paragraph quoted above, and thereby ensured the “respect of third parties’ right to interoperability” (para. 107). 

While the Commission confirms that, with regard to existing features, there is no obligation of interoperability by design, it nevertheless notes that the measures specified in the Decision make compliance with Article 6(7) “more automatic” and, in this sense, provide a “pathway” towards interoperability by design. Instead, when it comes to new features, the Commission makes clear that interoperability by design should be persued by Apple (para. 110). 

If, however, we turn to interoperability concerning specific features related to connected physical devices, the situation looks entirely different. For any feature covered by "the other" Article 6(7) specification decision, the request-based process is bypassed altogether: Apple is required to implement the prescribed substantive measures within the timeframes set out by the Commission. Some of these features, the Commission notes, could already be included in the forthcoming iOS 19, currently being unveiled by Apple as I write. Connected physical devices range from payment cards to cars, insofar as they either transmit or receive data. Interoperability with regard to connected physical devices is of substantial economic importance. As Apple itself acknowledges, "most iOS devices do—at some point—connect to a physical device within the EU." What the Commission does in this second Decision is provide Apple with detailed guidance, spelling out the exact interoperability solutions required for specific features, aspects of their technical implementation, and the modalities of access that must be made available to third parties.  

At this point, the relationship between the two Decisions, and indeed the overall picture, becomes more intelligible: under the DMA, effective interoperability is understood as something that develops over time, evolving alongside, indeed, accompanying, technological change. To take this obligation seriously dans la longue durée, Apple must first establish a meaningful channel of communication and cooperation with developers requesting interoperability. The Commission considers that, if properly implemented with the safeguards it has specified, even a request-based system can serve this function. In such a framework, developers may articulate specific interoperability needs which Apple is then required to meet. Should Apple fail to do so in accordance with the DMA, the Commission may subsequently intervene, either through a further specification decision or, where appropriate, by initiating an infringement procedure. In this sense, the request-based system outlines a pathway toward interoperability by design, one in which, over time, it should make little sense for Apple to maintain separate interoperability solutions: one for its own products and services, and another for third parties.

In the case of the connectivity features covered by the second Decision, however, concerns about the lack of effective interoperability have already materialised. These are “borne out in requests made by third parties via Apple’s Interoperability Request Portal and submissions during the administrative proceedings and the public consultation,” as well as “by Apple’s submissions outlining possible interoperability solutions and its proposed implementation deadlines” (para. 18). The purpose of the second specification decision is therefore “to swiftly provide effective interoperability solutions to the market” (para. 19), and in the event of any conflict, it prevails over the process decision (para.20) (on this last point, a legal mind cannot help but glimpse vast and fertile fields for further musings). 

These are merely initial reflections, but one must concede that the future of interoperability in the EU, as it is now taking shape, is both stimulating and encouraging. You, dear Developer, in the EU and beyond, so long as you serve EU users, should be a little more hopeful than before. This is at any rate true for someone who has long followed the subject from a competition policy perspective, and who can only welcome the emergence of promising developments not only under the DMA, but even on the more traditional front governed by the stricter contours of Article 102.There will be ample opportunity to write more on this, and I very much look forward to discussing it further during an upcoming webinar, one that will also bring in perspectives and experiences from other jurisdictions.