Apple App Store: Difference between revisions

Apple uses several technical measures to protect their App Store ecosystem and prevent consumer choice. They are good at obscuring their intentions with technical roadblocks, while typically citing security reasons for them - assuming the public even recognizes what is going on. This actively hurts the ability for lawmakers to have an accurate understanding, so they can consider applying legislative pressure.

Because this is a clear problem, several governments, including South Korea,<ref>https://www.reuters.com/technology/skorea-approves-rules-app-store-law-targeting-apple-google-2022-03-08/</ref> Japan,<ref>https://www.theregister.com/2024/06/13/japan_smartphone_software_law/</ref> the European Union,<ref>[[wikipedia:Digital Markets Act|Digital Markets Act]]</ref> the United Kingdom,<ref>https://www.gov.uk/cma-cases/investigation-into-apple-appstore</ref> Australia,<ref>https://www.accc.gov.au/media-release/dominance-of-apple-and-googles-app-stores-impacting-competition-and-consumers</ref> as well as the US and a handful of states,<ref>[[wikipedia:Open App Markets Act|Open App Markets Act]]</ref><ref>https://www.congress.gov/bill/118th-congress/senate-bill/5364/text/is</ref><ref name="doj">https://apnews.com/article/apple-antitrust-monopoly-app-store-justice-department-822d7e8f5cf53a2636795fcc33ee1fc3</ref><ref>https://azcapitoltimes.com/news/2021/02/19/its-time-to-free-ourselves-from-big-tech-monopoly/</ref> have opened investigations into anti-competitive practices, or considered or already passed legislation to force "gatekeeper platforms" such as Apple to be more reasonable with third-party developers.

This being a major threat to Apple's revenue stream (interestingly, one they claim to be unsure is profitable<ref>https://9to5mac.com/2024/04/17/app-store-is-profitable-apple-notes/</ref><ref>https://9to5mac.com/2025/01/17/apple-denies-app-store-profit-margin-is-75-claims-to-have-no-clue/</ref>), they have responded with practices such as geoblocking certain operating system functionality based on physical location,<ref>https://theapplewiki.com/wiki/Eligibility</ref> misrepresenting/overstating risks, and using existing, trusted terms to describe unreasonably difficult to use systems.

Important terms you'll run into in this article:

Apple has been collecting users' credit card numbers since opening the iTunes Store in 2004. The opening of the App Store in 2008, followed by the introduction of in-app purchases (IAPs) in 2009, gave iPhone app developers the opportunity to sell app features to users. The IAP system is provided as a developer framework named [https://developer.apple.com/storekit/ StoreKit]. Apps and their in-app purchases are managed through a dashboard named [https://developer.apple.com/app-store-connect/ App Store Connect]. App sales have eclipsed iTunes Store sales, and are now a primary focus of Apple's Media Services division.

Additionally, the 15% small businesses fee discount is judged based on the app's overall turnover, and is not based on individual creators in the app's marketplace. An app that turns over $1 million per year by providing services to creators that individually make less than $1 million per year does not have the opportunity to use the discount.

Given Apple's strong incentives, and a ticking clock as legal pressure builds, it is not hard to find stories from app developers regarding poor experiences with Apple's app review process.

:''This list is extremely incomplete. Please add examples if you know of any.''

In August 2020, in response to the COVID-19 pandemic, Facebook introduced the ability for small businesses to accept an entrance fee for events. Previously, Facebook would only act as a way to RSVP for the event - the organizer must use a third-party event ticketing system to collect fees. The company pledged to not collect any fee on event sales "until 2023".<ref>https://about.fb.com/news/2020/08/paid-online-events/</ref>

HEY.com is a paid webmail provider launched in June 2020 by long-time software company [[wikipedia:37signals|37signals]], specializing in providing tools that help organize the inbox.

After successfully launching the initial version of their app on the App Store, the company announced that an update was rejected. The app did not intend to support in-app purchases. Instead, the user is expected to already have an account with the service. Apple did not like this arrangement, and demanded the company build an in-app subscription option. The company argued that they are being held to a different set of rules than apps such as [[Netflix]], whose app does not provide any way to purchase.<ref>https://www.theverge.com/2020/6/16/21293419/hey-apple-rejection-ios-app-store-dhh-gangsters-antitrust</ref> After a suggestion from Apple executive Phil Schiller in the media, HEY introduced a 14 day free trial mode, which was approved.<ref>https://www.hey.com/apple/path/</ref><ref>https://techcrunch.com/2020/06/18/interview-apples-schiller-says-position-on-hey-app-is-unchanged-and-no-rules-changes-are-imminent/</ref>

In August 2024, [[Patreon]] announced a change in arrangement with Apple for its App Store app. From November 2024, subscriptions started from the iOS app would be required to use the in-app purchase system, bypassing Patreon's own long-standing payments practices.<ref>https://news.patreon.com/articles/understanding-apple-requirements-for-patreon</ref><ref name="patreon" /> This change does not affect the Android app.

A similar case occurred with the app Fanhouse in 2021.<ref>https://twitter.com/jasminericegirl/status/1402691047940100100</ref>

In August 2021, [[Twitter]] introduced a feature named Super Follows (now Subscriptions), in which a user can pay a subscription fee to access more of a creator's content. For each user who enables Subscriptions, Twitter must submit a new in-app purchase SKU to the App Store, which will become available with the next update to the app.<ref>https://twitter.com/wongmjane/status/1433372120080261120</ref> This, of course, is subject to the 30% fee. At the time of writing in January 2025, viewing the App Store listing reveals Elon Musk's $4.00 subscription as the fourth most popular IAP item.

Since 2015, Apple expects all Mac apps to be "notarized". This is a preliminary, automated malware check, which upon passing, provides a notary certificate that gets "stapled" to the app. Apple's explanation:

Apple is retaining complete control over what's allowed to run on iOS. On macOS, you can choose to run apps that have not been notarized (even though the process to bypass the warning is intentionally difficult). On iOS, you never get even that option. What Apple created is the App Store but with more steps. It still goes on the App Store, just hidden so it can only be installed by the third-party store it's tied to.

Safari is allowed to [[wikipedia:Just-in-time compilation|just-in-time]] compile code worldwide. The super short version of what that means: it can run JavaScript code ''really fast''. All browsers, and other runtimes like Microsoft .NET, Java, Lua use this. Ok, fine, it's the system web browser, it's very carefully written to be secure, and it's important to the platform to be doing well in performance benchmarks and all that.

While UTM SE releasing at all might seem like a pathway to getting Firefox and Chrome "slow editions" on the App Store, browser engines other than the built-in Apple WebKit/JavaScriptCore are [https://developer.apple.com/app-store/review/guidelines/#2.5.6 still outlawed]. In the EU, Apple has blessed web browser JavaScript engines with the option to use JIT. The app must be approved for an entitlement, and then must work within APIs provided by Apple for it. As of January 2025, no browsers have been released using this. We were all anticipating proper competition around web browsers on iOS, but almost a year later, we have nothing. Mozilla has [https://www.theverge.com/2024/1/26/24052067/mozilla-apple-ios-browser-rules-firefox discussed] why.

You might not like app sandboxing, but it's a powerful security feature used on all modern platforms. The reality is very few apps need more than a few basic permissions. [[wikipedia:Flatpak|Flatpak]] on Linux also sandboxes apps, and it seems to work great! Still, it's completely fair that there should be processes for doing things beyond what the sandbox allows. You see some of this with permission prompts - does a flashlight app ''really'' need access to your contacts? (Apple has been burned by [https://www.theverge.com/2012/2/14/2798008/ios-apps-and-the-address-book-what-you-need-to-know apps abusing user data] before the current permission system was built out.)

It can go further than this. As we established in previous sections, an app can be given more access to features of the system using entitlements. These come in a few flavors:

There have been [https://gizmodo.com/researchers-uber-s-ios-app-had-secret-permissions-that-1819177235 exceptions] where Apple quietly gave a company access to private entitlements anyway, raising eyebrows.

The only known workaround is to execute the code via JavaScript, as Apple's JavaScriptCore engine runs in a heavily sandboxed process. This requires you to port the code to JS, which may be a lot of work, or just not viable. You wouldn't want to run the Python interpreter inside JavaScript - the performance would be terrible!

Safari's in-app browser, that is the minimal version you get when tapping a link from social media, uses an entirely separate data store for each app. The in-app browser isn't aware of cookies in the "full" Safari app, or any other app, and doesn't support Safari extensions. Any websites you're logged into. Apple [https://github.com/openid/AppAuth-iOS/issues/120 claimed] this was to protect malicious apps from stealing or setting cookies in Safari without your knowledge, which is a fair argument, but it's hard to not notice that it makes web browsing inconvenient, encouraging users to install native apps, where they can make transactions through Apple.

This also means your browsing in the in-app browser is just forgotten - there's no history menu, and it doesn't get logged to the history in the full Safari app either. Good luck recalling that article you read a few weeks ago.

<references />

[[Category:Apple]]