The Safety Argument and the Cost of Trust
When a transaction leaves Apple’s integrated App Store payment system, money is not the only thing that moves. Responsibility for payment handling, fraud prevention, privacy, refunds, subscriptions, and support may move toward the developer and the payment provider they choose. This chapter examines Apple’s safety argument and the CMA’s provisional response, so readers can identify which protections are specific to IAP, which risks may be mitigated elsewhere, and which uncertainties remain. The practical judgment is not whether external transactions are risk-free; it is whether targeted safeguards can protect users without making competition impossible.
Trust matters economically as well as ethically. If an end-user does not understand who is handling a purchase, they may avoid the external route. If a developer believes the route will create unmanageable fraud or support problems, they may not adopt it. But trust can also be used as a reason to preserve a familiar incumbent route. The evidence has to distinguish a genuine change in responsibility from a general warning that anything outside Apple is unsafe.
What leaves Apple’s integrated system
Apple’s argument begins with the user’s expectation of the App Store. A person who buys digital content inside an app may assume that the transaction is covered by the same security, privacy, refund, and subscription arrangements associated with Apple’s IAP system. Apple says steering weakens that assumption because the user is sent to a different transaction environment and may share payment information with another party.
The first concern is payment data. Apple argues that IAP allows users to provide sensitive payment information to Apple rather than to several merchants or payment services. A steered transaction can involve the developer and a chosen payment provider, each with responsibilities for handling that information. The number of parties, the policies they apply, and the safeguards they use can affect exposure. The concern is concrete: a user may not know who receives the information or what protections govern it simply from seeing an external page.
The second concern is fraud. Apple says it can review apps and use transaction signals to identify suspicious activity within its own environment, but cannot continuously review every external website to which a user might be directed. A website can change after an app or link has been reviewed. Dynamic links can resolve differently according to a user’s context, making it difficult to test every possible outcome. Apple therefore argues that steering may reduce its ability to identify malicious destinations or patterns of fraudulent behavior.
The third concern is privacy beyond the payment credential itself. Apple says it checks what information an app collects, supports the publication of privacy information, and can limit what is shared with merchants or other third parties when a user pays through IAP. Once the transaction is external, the developer or payment provider sets the policies for data handling. Those policies may be less strict than Apple’s, and the user may have less visibility into what information is collected, linked, or passed on.
The fourth concern is the loss of centralized post-purchase protections. Apple says a steered user may not benefit from its refund protections or subscription-management services. If a customer wants to cancel, recover a payment, or resolve a dispute, the process may now depend on the developer or the payment provider. The change can affect user effort and confidence even when the external payment itself is processed securely.
Children create a further concern. Apple says its parental-control features cannot necessarily extend to transactions completed outside IAP.