Summary

Apple has effectively discontinued support for PWAs (Progressive Web Apps) on iOS in the EU, citing security and privacy concerns and low user adoption, following the implementation of the DMA (Digital Markets Act) regulations.

Abstract

In response to the EU's DMA regulations, Apple has announced the end of PWA support on iOS, a decision that has been met with criticism and skepticism. The company justifies its move by claiming that integrating PWAs through non-Webkit browsers poses significant security and privacy risks, given the low adoption rates of these apps. This comes after a period of speculation, with many hoping the removal of PWA installation in iOS 17.4 beta was temporary. Apple's response indicates that the current architecture does not support the necessary security measures for PWAs installed via third-party browsers, a situation they deem impractical to rectify. This decision echoes past antitrust issues faced by Microsoft, and it raises concerns about the future capabilities of non-Webkit browsers on iOS, potentially leaving them without essential OS functionality.

Opinions

The author suggests that Apple's technical reasons for discontinuing PWAs may be a "smoke screen" to disguise their true intentions.
There is a belief that Apple has deliberately provided poor support for PWAs, leading to low user adoption and justifying their discontinuation.
The author draws parallels between Apple's current stance and Microsoft's arguments during their 90s antitrust case, implying that Apple's reasoning is similarly flawed.
The author is critical of Apple's decision, predicting that it will not be accepted by the EU Commission, given the DMA's aim to ensure fair competition and user choice.
The author anticipates a protracted legal battle similar to Microsoft's, with the potential for Apple to drag out the process for years.
The author laments the death of PWAs on iOS in the EU as a loss for users and developers alike.

PWAs Are Now Officially Dead On iOS In The EU

Apple gives developers, customers and regulators the finger.

After a week of deafening silence, Apple finally responded to their decision to disable the installing of PWAs (Progressive Web Apps) in the beta versions of iOS 17.4.

I, and many others, hoped this would be a temporary situation as Apple is facing the March 6, 2024 deadline to comply with DMA regulations and probably hadn’t figured out a way to let third-party browsers install PWAs on iOS.

Since the DMA requires browsers to be equal on iOS, we hoped, against better judgment, Apple just disabled it so the situation would at least be the same for all browsers. In the meantime, Apple remained silent and fuelled speculation that this might just be a permanent situation.

They finally responded and as we already feared, it’s not good news.

The future (or lack thereof) of PWAs on iOS

Bottom line: Apple says it’s “not practical” to build integration for PWAs installed through other browsers because of “the other demands of the DMA and the very low user adoption of Home Screen web apps”

“The iOS system has traditionally provided support for Home Screen web apps by building directly on WebKit and its security architecture. That integration means Home Screen web apps are managed to align with the security and privacy model for native apps on iOS, including isolation of storage and enforcement of system prompts to access privacy impacting capabilities on a per-site basis.”

What Apple says here is that for PWAs installed through a Webkit browser like Safari (what they call Home Screen web apps) iOS provides isolated storage and enforces that permission prompts are shown when a web app tries to access privacy impacting capabilities, like accessing your camera for example.

Apparently, this is currently not in place for PWAs installed through non-Webkit browsers that you should be able to install when sideloading is enabled:

“Addressing the complex security and privacy concerns associated with web apps using alternative browser engines would require building an entirely new integration architecture that does not currently exist in iOS and was not practical to undertake given the other demands of the DMA and the very low user adoption of Home Screen web apps.”

So it would be “not practical” to provide an API to third-party browsers to let them install PWAs on iOS also because Apple has “other demands of the DMA” and the “very low user adoption” of PWAs.

By the way, this “very low user adoption” is a situation Apple helped create by deliberately providing poor support for PWAs for years. It’s also the reason Apple thinks this change will only “affect a small number of users”.

I can’t really judge if the technical reasons they give here make any sense, but it seems like a smoke screen to me and it sounds awfully similar to Microsoft claiming they couldn’t provide browser choice in the 90s.

What does this mean for other browsers?

To summarize: Apple won’t build an API for other browsers to install PWAs for the reasons mentioned above. Many developers have already argued that the disabling of PWAs on iOS would be a temporary situation until Apple figured out how it could let other browsers install PWAs, but apparently, there are much bigger issues than that.

It seems that PWAs installed through third-party browsers are a security risk because iOS can’t provide isolated storage for them and can’t enforce the displaying of permission prompts when a web app wants to access the camera for example.

But if that is the case, how will this work for regular web apps accessed through non-Webkit browsers on iOS?

This signals to me that when a non-Webkit browser can finally be installed on iOS, it still won’t have any access to the OS APIs that Safari does have.

If they can’t enforce the displaying of system prompts to access privacy impacting capabilities for PWAs installed through third-party browsers, I would expect they can’t do this for regular web apps accessed through these browsers either.

Are they going to claim they can only do this for regular web apps? I’m sure the EU Commission won’t accept this and I think Apple knows it.

What will happen now?

If this all sounds eerily familiar, it is.

In the late 90s, Microsoft faced an antitrust case in which they were accused of abusing monopoly power by bundling Internet Explorer with Windows, which restricted the market for competing web browsers like Netscape at that time.

At that time, Microsoft claimed that removing Internet Explorer from Windows would slow down the system and cause malfunctions. They even went so far to show a falsified video in court that would prove this.

When the judge suggested they offer a version of Windows without Internet Explorer bundled, Microsoft responded they could offer one version of Windows that was obsolete, or another that did not work properly.

It’s precisely this argumentation that Apple now uses to frustrate PWAs: only Webkit browsers can offer a safe installation of PWAs and since we won’t allow other browsers to do it, we’ll just remove it.

I don’t believe Apple will get away with this since I don’t think the EU Commission will accept a claim that they can only offer isolated storage and enforcement of system prompts when providing access to privacy impacting capabilities for regular web apps accessed through non-Webkit browsers.

On the other hand, if they claim they can’t do this for regular web apps either, that would still leave non-Webkit browsers without any access to OS functionality (camera access for example) and that is exactly what the DMA is about.

Either way, I think (and hope) they won’t get away with this, but they will sure put up a fight that can drag on for years, inspired by what Microsoft did in the 90s.

Until that time, PWAs are sadly dead on iOS in the EU.

Join my email list Modern Web Weekly for a weekly update on Progressive Web Apps (PWA), Web Components and new features of the modern web platform, tested and explained in plain English.