Apple's long-standing requirement that all iOS browsers use its WebKit engine has come to an end in Japan, marking a watershed moment in mobile platform regulation.
As of December 18, 2025, developers can now build browser applications on iPhone and iPad using alternative engines such as Mozilla's Gecko, Google's Blink, and others—a development that fundamentally alters the competitive landscape of web browsing on iOS devices.
This shift emerges from Japan's Mobile Software Competition Act (MSCA), legislation enacted by the Japan Fair Trade Commission that took effect this month.
Unlike the European Union's Digital Markets Act and the United Kingdom's comparable framework, Japan's regulatory approach goes further by explicitly prohibiting not only the outright bans on alternative engines but also any technical or financial measures that would render their adoption impractical.
The Regulatory Landscape
Japan's approach to mobile software competition differs strategically from other jurisdictions. The MSCA was passed in June 2024 and published final guidelines in July 2025, with the JFTC designating Apple's operating system, app store, browser, and search services as subject to the act's requirements.
The law takes direct aim at what advocates and regulators view as anti-competitive gatekeeping by requiring that designated providers eliminate barriers to competition across four critical software categories: the operating system, app stores, browsers, and search engines.
What distinguishes Japan's framework from the EU's Digital Markets Act is its explicit language preventing "hindering" of alternative browser engines through mechanisms beyond direct prohibition.
The Guidelines published by the JFTC specifically state that designated providers must refrain from imposing unreasonable technical restrictions or contractual conditions that effectively make alternative browser adoption commercially unviable. This targets practices that technically permit alternatives while making them practically infeasible—a problem regulators observed with Apple's initial EU compliance approach.
The law represents Asia's first comprehensive ex ante regulation of digital market power, preceding similar efforts in other regional jurisdictions that stalled due to domestic pressures or external resistance.
With the United States Department of Justice pursuing antitrust litigation against Apple that similarly cites browser engine restrictions as anticompetitive conduct, Japan's framework may foreshadow broader global changes to mobile platform openness.
Implementation Through iOS 26.2
Apple announced compliance with the MSCA through iOS 26.2, released in December 2025.
The implementation takes two distinct forms: full dedicated browser applications that provide comprehensive web browsing experiences using alternative engines, and in-app browsing experiences embedded within applications from browser engine stewards.
The policy applies exclusively to iOS in Japan—a geographic limitation that reflects Apple's strategy of minimal compliance, modifying only what jurisdictions explicitly require rather than implementing global changes.
Developers must obtain specific entitlements from Apple to use alternative engines, and global applications must maintain WebKit for distribution outside Japan while offering alternative engines within the country.
Alongside browser engine changes, iOS 26.2 introduces mandatory choice screens presented to users during initial device setup. Users now select their preferred browser from a randomized list of options, rather than defaulting to Safari, and separately choose a search engine from a randomized list rather than defaulting to Google Search.
These choice screens mirror requirements under the DMA but represent a more comprehensive user selection mechanism in the Japanese context.
Technical and Security Requirements
The framework for alternative browser engines reflects Apple's emphasis on security as a justification for restrictions, now filtered through regulatory oversight.
Qualifying developers must meet exacting technical benchmarks and ongoing compliance obligations.
Developers seeking authorization to implement alternative browser engines must pass 90% of Web Platform Tests and 80% of Test262 tests, ensuring their engines support baseline web functionality equivalent to existing browsers.
These test requirements remain in effect even when devices operate in Lockdown Mode, a high-security configuration that disables just-in-time compilation.
Security requirements mandate use of memory-safe programming languages for all code processing web content, adoption of the latest security mitigations including Pointer Authentication Codes and Memory Integrity Enforcement, and secure development practices including threat modeling of new features.
Developers must monitor third-party software dependencies and their broader supply chain, eliminating use of frameworks that no longer receive security updates.
Perhaps most operationally significant, developers must establish published vulnerability disclosure policies with defined response timelines. Apple requires mitigation of vulnerabilities actively being exploited within 30 days for simpler vulnerability classes, with longer timelines for more complex exploits.
Developers must publicly document which reported vulnerabilities have been resolved in specific app versions, enabling security researchers and users to track remediation progress.
Privacy requirements prohibit cross-site cookies by default unless users provide explicit informed consent, mandate per-website storage partitioning to prevent cross-site tracking, and restrict sharing device identifiers with websites without informed consent.
These requirements align with modern privacy standards across major browsers but are now enforceable through the regulatory framework rather than relying on vendor discretion.
Browser Engine Stewards and Eligibility
For in-app browsing functionality using alternative engines, Apple defines browser engine stewards as entities with "primary responsibility" for operating a distinct web browser engine—meaning they maintain operational control and ultimate responsibility for coordinating security responses.
The steward must demonstrate that the engine is materially distinct from other engines in both architecture and Web API support, and is maintained by a different entity than any other engine.
This definition encompasses Mozilla Corporation for the Gecko engine, Google for Blink, Opera Software for its engine, and other independent browser developers.
It explicitly excludes forks and derivatives that do not represent independent development initiatives.
Applications providing in-app browsing with alternative engines must display the domain or URL whose content the engine renders, provide a button allowing users to open their system's default browser to view the same content, and ensure the browser interface occupies the majority of the display apart from necessary controls.
These requirements prevent applications from obscuring which engine renders content or trapping users within proprietary implementations.
Comparative Analysis: Japan, EU, and UK Approaches
The three jurisdictions that now mandate alternative browser engines differ in their regulatory mechanisms and substantive requirements.
The EU's Digital Markets Act applies to gatekeepers serving over one million monthly active users in the EU, imposing transparency and interoperability obligations without prescribing specific technical implementations. The UK's Digital Markets, Competition and Consumers Act follows a similar designating framework.
Japan's approach combines features of both designating frameworks with more prescriptive substantive obligations. The MSCA specifies exactly what behaviors are prohibited—not merely hindering alternative browser adoption, but not preventing, not imposing unreasonable restrictions, not creating excessive financial burdens, and not steering users away from alternative engines.
The Guidelines elaborate these concepts with illustrative scenarios and specific thresholds, reducing regulatory ambiguity that characterized EU implementation.
Observers of EU compliance note that Apple's approach, while technically permitting alternative engines, implemented procedural and technical barriers that rendered practical adoption extremely difficult for browser vendors.
Japan's regulatory text and Guidelines specifically anticipate this pattern, using language designed to prevent such compliance circumvention. The explicit prohibition on actions that would "make it difficult" or "commercially unviable" to adopt alternative engines addresses precisely the barriers that emerged in EU compliance.
Market Dynamics and Competitive Impact
For nearly two decades, all web browsers on iOS—Chrome, Firefox, Edge, Opera, Brave, and Vivaldi among them—operated as thin shells around Apple's WebKit engine, unable to implement proprietary rendering engines or leverage performance optimizations available to their desktop and Android counterparts.
This limitation meant that Progressive Web Applications (PWAs), which provide native-like functionality within web browsers, could access only APIs implemented by WebKit, artificially constraining their capabilities relative to native iOS apps.
The Financial Times reported in 2024 that Safari generates approximately 15% of Apple's global operating income, primarily through the Google Search deal providing search-related revenue.
Industry analysis suggests that each percentage point of market share loss translates to approximately $200 million in annual revenue, creating substantial financial incentives for Apple's historical resistance to allowing competing engines.
With alternative engines now available, browsers could potentially gain meaningful differentiation. Firefox could offer its Gecko engine's superior JavaScript performance in certain contexts.
Chrome could utilize Blink's rendering optimizations. Web developers gain incentive to implement PWAs when those applications can access modern web APIs unsupported by WebKit, reducing native application development costs.
However, industry observers express skepticism about rapid market transformation. The complexity of porting full browser engines to iOS, combined with Apple's detailed security requirements and the commercial investment required for Japan-specific implementations, may limit initial adoption.
Mozilla and Google have not yet announced definitive plans for Gecko and Blink implementations on iOS Japan, and regulatory history suggests such ports require multi-year engineering efforts.
Developer Complexity and Commercial Viability
The policy creates significant practical challenges for browser vendors. Developers must maintain separate code paths for Japan—where alternative engines are permitted—and other regions where WebKit remains mandatory.
Shared code between desktop browsers and iOS becomes more fragmented, increasing testing and maintenance burdens. Applications global in distribution must implement geolocation-aware logic to determine which rendering engine to invoke, adding architectural complexity.
Apple's entitlement system, while necessary for security vetting, introduces contractual gatekeeping. Developers seeking authorization must negotiate terms directly with Apple rather than relying on transparent criteria, replicating gatekeeping mechanisms in a different form.
Open Web Advocacy has called for Apple to apply identical security requirements to Safari itself, ensuring equivalent rather than privileged treatment of the company's own engine.
Security Considerations and Ongoing Risks
Apple frames alternative browser engines as introducing security and malware risks, asserting that its historical WebKit requirement protected users from untrusted code execution.
The company required developers to commit to timely security updates and demonstrated secure development practices precisely to mitigate these concerns.
However, this argument carries less regulatory weight in a context where Android permits alternative engines and desktop browsers operate with multiple rendering engines in direct competition.
Security vulnerabilities exist in WebKit itself—the regulatory framework does not exempt Apple's own engine from the security requirements imposed on competitors, though enforcement mechanisms for Safari's compliance remain untested.
The requirement that browsers honor system-level content filtering, parental controls, and data protection laws while implementing alternative engines reflects pragmatic regulatory balancing.
Users benefit from continued device-wide protections even when browsing through non-WebKit engines, while parents retain control over children's access through system settings rather than relying on app-by-app configurations.
Path Forward and Global Implications
Japan's December 2025 implementation occurs simultaneously with ongoing regulatory efforts in multiple jurisdictions. The UK's CMA continues investigating Apple's browser practices and the Apple-Google search agreement's competitive impact.
The US DOJ antitrust litigation directly addresses browser engine restrictions as anticompetitive conduct. Australia's consumer protection regulator is considering whether similar legislation is warranted in its context.
The practical outcomes over the coming eighteen months will substantially influence other regulators' confidence in permitting alternative browsers without catastrophic security consequences.
Successful implementation by Firefox, Chrome, and other vendors in Japan provides proof-of-concept for regulators considering whether similar laws should extend globally.
Apple's strategy of Japan-specific compliance rather than global implementation may face pressure as competing browser vendors seek efficiency through global deployments.
The company's historical reluctance to implement global changes until forced by multiple jurisdictions suggests that accumulation of requirements across Japan, the EU, and potentially the UK or US could eventually drive company-wide policy revision rather than region-by-region modifications.
For web developers and application creators, the opening of iOS to alternative browser engines represents the first concrete evidence that Apple's mobile platform will face rendered competition rather than merely choice of distribution mechanisms. Whether that competition translates to meaningful API access, performance improvements, and PWA viability depends on browser vendors' success in surmounting the technical and commercial barriers now in place.
The next phase of digital market competition in mobile will be determined not by regulatory mandates alone, but by whether browser makers view Japan as a sufficient market to justify engineering investment in iOS ports, and whether users demonstrate demand for alternatives to Safari's long monopoly.
