Apple’s Hold on App Store Set to Face Challenge From New European Law

For the past two years, the iPhone maker has battled lawmakers, regulators and rivals around the world to defend how it serves as the gate keeper to more than one billion users of its devices.

Critics accuse Apple of hurting competition by forcing app developers to use its store and payment tools, from which it extracts a commission of up to 30% for in-app purchases. Apple has countered that it is giving consumers a choice of a digital platform that has proven popular with customers and that proposed changes would open users up to threats to security and privacy, and weaken the overall iPhone experience.

Rivals and critics of Apple’s power hope the EU law will serve as a catalyst for other jurisdictions, such as in the U.S., where similar legislation is pending before Congress.

“Apple is playing 5D chess right now,” said Paul Gallant, a policy analyst for Cowen & Co. “It will struggle to explain why government changes will radically change the iPhone when Google already does it and it will struggle to explain why it can’t do it in the United States when it may soon do it in Europe.”

As the language is finalized behind closed doors, most tech companies and their lobbyists are resigned to passage of the so-called Digital Markets Act. Other provisions in the DMA are aimed at the likes of Amazon.com Inc. and Google parent Alphabet Inc.

The DMA’s most existential threat to Apple comes with a provision that would allow software makers access to the iPhone—through so-called sideloading—outside of the rules and payment scheme of Apple’s App Store. One recent draft of the DMA, overwhelmingly approved in December by a 642-8 European Parliament vote, included sideloading.

Apple said in a statement that the DMA will undermine its security and allow malicious actors to take advantage of sideloading. “Governments and international agencies world-wide have explicitly advised against sideloading requirements, which would cripple the privacy and security protections that users have come to expect,” Apple said in the statement.

The full effect of the sideloading provision isn’t yet clear as lawmakers work on final language defining security exceptions that could give Apple leeway to limit the scope of sideloading.

After the text is agreed upon by negotiators for the parliament and member states as early as this month, the bill is expected to be officially approved by both bodies in coming months. Based on that timeline, it would take effect early next year.

Apple has pushed back when ordered to loosen its grip over the app economy, such as by a U.S. federal judge, legislators in South Korea and antitrust enforcers in the Netherlands. Apple has responded to those orders with appeals or narrow policy changes, refraining from bigger changes that could reduce the billions it takes in from app store commissions.

The EU’s antitrust chief, a major proponent of the DMA, has pointed to Apple’s recent moves and cautioned that the bloc must give itself enforcement power in the law to make its provisions stick.

“Apple essentially prefers paying periodic fines, rather than comply with a decision of the Dutch Competition Authority,” said Margrethe Vestager, the top digital policy and competition official at the EU’s executive arm, in a speech last month. “Effective enforcement, which includes the Commission having sufficient resources to do so, will be key to ensure compliance,” she said.

In early drafts, failure to comply with the DMA would be punishable by fines of up to 10% of a company’s annual global revenue, which for Apple currently would equate to $37 billion, but some legislators have pushed for a higher ceiling.

Court filings have suggested around 20% of Apple’s annual operating income comes from App Store revenue. Apple has said that estimate is too high, but hasn’t disclosed an alternative amount.

That figure underscores why some of the App Store’s biggest revenue generators have been aggressively pushing for changes. Spotify Technology SA and Match Group Inc. have been successful in lobbying to include language in the act that would oblige Apple to allow developers to use competing in-app payment systems, according to people familiar with the matter.

“It is much easier for let’s say companies like Spotify or the Match Group to make their case because it is a clear-cut case,” said Andreas Schwab, a German member of European Parliament who is in charge of shepherding the bill. “The gate keepers have more difficulties explaining their business practices so clearly,” he added.

If the DMA passes as expected, Apple could attempt to challenge the enforcement of the law, both through litigation and in the minutiae of App Store policy changes it puts in place to comply, according to analysts and people involved in the negotiations.

The biggest changes to Apple’s App Store were ordered in September by a federal judge in California who oversaw an antitrust lawsuit by “Fortnite” maker Epic Games Inc. While Apple mostly won the case, the judge ordered Apple to stop prohibiting app developers from being able to send users inside their apps to cheaper alternative payment methods outside of the app. But that change is on hold while Apple appeals the ruling.

When an antitrust regulator in the Netherlands ordered Apple to allow alternative payments in dating apps in that country, Apple responded while still charging apps a fee, 27% of revenue instead of 30%. The changes haven’t satisfied the Dutch, who are fining Apple more than $5 million a week.

“Apple believes its solution is fully compliant with Dutch law,” Apple’s Chief Compliance Officer Kyle Andeer said in a letter to the regulator last month, adding that the issue may ultimately be resolved in court.

—Jiyoung Sohn contributed to this article.

Write to Sam Schechner at sam.schechner@wsj.com and Tim Higgins at Tim.Higgins@WSJ.com