Ready for the EU Digital Services Act? How Decisions by Apple and by Google Impede App Privacy

Ample past research highlighted that privacy problems are widespread in mobile apps and can have disproportionate impacts on individuals. However, doing such research remains hard and an arms race with those who engage in invasive data practices. This is why this paper analyses how decisions by Apple and Google, the makers of the two primary app ecosystems (iOS and Android), currently hold back app privacy research. We base our analysis on a thorough review of the academic literature and on many years of experience in working in the space. Such an analysis is timely and pertinent, given that Article 31 of the upcoming EU Digital Services Act (DSA) will oblige Very Large Online Platforms to enable researchers study ‘systemic risks’.