In the first beta of iOS 17.4, Progressive Web Apps (PWAs) did not work properly, and in the second one, a message warned that they would open directly in Safari. Now, Apple has officially announced its stance on PWAs in the European Union: they will no longer work. The reason behind this measure lies in the need to comply with the Digital Markets Act (DMA) of the EU.
The law does not allow Safari to offer features if they are not available in other browsers
The company has explained that the changes imposed by the DMA involve having to support alternative browsing engines, which entails very significant security risks and a more considerable engineering effort to try —as much as possible— to implement a new solution and minimize the risks. PWAs, which run directly from the iPhone’s home screen and are built on WebKit and its security architecture, are designed to align with the privacy and security model of native applications on iOS. Running on Apple’s browsing engine allows for storage isolation and the implementation of system prompts to access privacy features individually.
It is very important to note that, without this isolation, web applications could read data from other web applications and gain access to the camera, microphone, and location without our consent. Controlling third-party code, in this case from a browsing engine —an engine that runs, in turn, third-party code from the web— is really difficult. So much so, that Apple has chosen not to support PWAs in third-party browsers.
But what about Safari? The DMA forces Apple to prevent Safari from offering better features than other competing browsers. Thus, due to the technical difficulty of enabling the long list of third-party browsers to offer PWAs, Apple has been forced to remove it from Safari.
The company argues that this decision will only affect a “small number of users” and regrets the impact it will have on PWA developers and iPhone users in the EU. However, it claims that it is a necessary measure to comply with DMA regulations and protect the security and privacy of users.
While the EU is backtracking and the DMA will not affect iMessage and while some users on social media are already joking that Europe should “Not allow” the DMA to be applied to us and be able to recover PWAs, just like we can reject cookies, it is clear that regulating certain aspects within companies has unexpected consequences.
