On Friday I attended the Microsoft’s second DMA enforcement workshop at the European Commission in Brussels, to hear their update on first year of DMA compliance. I was there on behalf of Vivaldi, as part of the Browser Choice Alliance (BCA), but this write-up is personal opinion only, and doesn’t represent the BCA or any other members.
The first session was about LinkTin, where Microsoft mentioned their “DMA journey”, making it sound like a melancholy backstory of some crappy reality show (“Big Tech Love Island”) where everyone bangs on about their “journey”. As Jan Penfrat, Senior Policy Advisor at EDRi and former podcast victim, noted on mastodon and verbally,
I also stressed on the record how disappointed we are with how slow Microsoft is with its compliance. For a company that claims to “take compliance seriously”, it’s unacceptable to still being “on that journey” 2.5 years in, being unable to even provide exact dates for compliance.
After a short break, it was time to talk about Windows. Joining me to represent browser vendors was Rhys Jones from Wavebox, a Vivaldi competitor, and therefore my mortal enemy. Here’s a photo of your two British Browser Boiz preparing for the fray. Quotations below are from a transcript I made of the official EU webcast.
In its March 2025 Compliance report, Microsoft says
Microsoft believes that the open nature of Windows is the most relevant indicator that the objectives of the DMA are being achieved.
Regarding DMA Aricle 6(3) on uninstalling gatekeeper software and changing defaults, the report says
Microsoft confirms that as of the date of this report it has ensured compliance with the obligation laid down in Article 6(3) of the DMA, as applicable to Windows
On Article 6(7), which requires free, effective interoperability with hardware and software, Microsoft’s report says
Microsoft complies with Article 6(7) of the DMA because Windows provides a robust set of publicly-documented APIs that can be called by Microsoft and third-party applications and which ensure effective interoperability with the hardware and software features controlled by Windows …
Windows follows a proactive “interoperability-by-design” model to ensure compliance with Article 6(7) of the DMA … Because of the Windows “interoperability-by-design” model, there are only a handful of areas where Microsoft has created new extensibility for the purposes of the DMA
Despite claiming in March that it’s been DMA compliant literally forever, on June 2nd Microsoft announced further Updates to Windows for the Digital Markets Act:
- Setting an alternative browser as default will associate it with more file types (for example, .svg, .xht, .xhtml, .xml, FTP)
- Setting the default browser with the “Set default” button will pin it to the Taskbar in the EEA, unless you choose not to by unselecting the checkboxes.
- You can set the .pdf file type default for browsers (if the browser registers for it) in the EEA.
- Windows Search and Widgets will open links in the default browser. Currently, they are given a
microsoft-edgepseudo-protocol, which is reserved solely to Edge. - Microsoft Edge will not prompt you to set it as the default browser unless you open it directly, for example, by clicking on its icon on the Taskbar.
- When Microsoft Edge is uninstalled, other Microsoft apps won’t prompt you to reinstall it in the EEA (excluding PWAs distributed in the Microsoft Store using Microsoft Edge technology).
I asked the Microsoft lawyer “Will the changes that are announced on the 3rd of June be rolled out before the 2nd anniversary of the DMA?”, to which he tersely replied “Yes”. When? “They’re all on the blog.”
BCA member, Rhys from Wavebox, asked about S mode, a locked-down version of Windows in which Edge and Bing are always the default browser and search engine, and which users can exit (with scare screens) but not return to.
Can you… expand why in S mode you’re forcing people to use both Edge and Bing, and users need to move out of S mode in order to take advantage of the DMA compliance that you’ve mentioned in the past workshop and today’s.
Microsoft replied
S-mode ships on well under 10% of machines in the EEA. It is a mode that is designed for novice users, and it was explained in our initial compliance report, and it’s explained in our subsequent compliance report, that it is designed so that those novice users have a lower degree of control. something, for example, you could hand a computer in S-Mode off to a child or a student.
And because of that, it is shipped on a very small percentage of Windows devices.And of that small percentage of devices, the vast majority of those switch out of S-Mode. And so what we have is S-mode ships on under 10% of devices in the EEA, and of that 10%, over 80% of those people switch out of S-mode.And when over 80% of your users do something, it’s likely an easy thing to do.
And so we think that it is completely compliant as designed. We think it solves a relatively niche purpose for novice users. And because once you switch out of that mode, which can easily be done and is done by most users, that it is therefore completely compliant with the DMA.
I asked about Edge’s notorious pleading to be restored as the default browser:
So to be clear, the only circumstances in which Edge will ask to be restored as default is if it’s open from the start bar or the task bar or actually opened as a browser?
Microsoft responded
The only time that Edge will prompt the user to be made the default is when the user volitionally opens Edge as a browser. It will not do so when it’s open as a PDF, and the times that it will do so is when it is launched as a browser, like from the task bar, from the start menu, or other ways that you launch applications.
Mozilla (who did not send a representative to attend, nor joined the Browser Choice Alliance) asked
the ability of Windows users to set a newly downloaded browser to default with one click from within that browser was removed several years ago. Would Microsoft consider reinstating this capability to comply with Article 6(3) and 6(4)?
Microsoft demonstrated an unexpected change of heart: it claims that it now respects user choice, and ease of setting defaults:
So we believe that the user should be in control of setting their defaults. And the way that we get user consent to change defaults is by sending users to settings, where the user can control which app is set as their default. If the application was able to set defaults for the many different file and link types that they register for, it’s possible that the user wouldn’t know. And the next time they opened, for example, a mail to link and it opened a browser, they would wonder what happened. And so the way that we manage this is by putting the user in control and sending them to settings.
As the room digested this Damascene conversion, Sebastian Pant from the European Consumer Organization asked
have you used A to B testing to test with end users whether the uninstallation process for apps and defaults on Windows is sufficiently neutral? … If you have carried out such testing, can you share or will you share those results with the Commission and/or publish those results?
Microsoft replied
I’m not aware of any A/B testing with regard to the uninstall experience. Applications can create their own uninstall experience, and they can have multiple different screens, or they could just have one screen. Windows does not control that uninstall experience for applications.
As it explained above, Microsoft does control the default-setting experience, but did not explain whether it has conducted A/B testing of its neutrality.
Glamorous and suave Gerardo Proaño of BCA asked
you also mentioned that for apps distributed in Microsoft Windows Store and Microsoft Edge technology, users will be prompted to reinstall Edge when Edge is uninstalled. Would it be possible to get a bit more clarity as to which instances the users will get these prompts and what do you exactly mean when you say Microsoft Edge technology and how is that justified under the DMA?
Microsoft answered
The Microsoft Edge team invested in using the APIs available that allow applications to provide what’s called identity, which means that they exist as applications on the Windows operating system, as independent applications. But of course they depend still on the browser because it’s browsers that provide PWAs. As you know, other browsers can provide PWAs on Windows in the way that they choose, and if they chose to use these APIs to provide identity, they would also appear as first-class applications.
Now, today, Microsoft Edge is the only browser that takes advantage of those APIs, and we make it possible for PWAs as well as native Windows applications to be distributed in the Microsoft Store. Today that only works with Microsoft Edge because Microsoft Edge is the only browser that implemented that support. And so when you install one of these applications from the store, of course it necessarily depends on the browser.
It says in the system requirements on the store page that it requires the Edge browser if other browsers implemented this support we’ve committed to make it possible for those applications to also be delivered through the store but nobody so far has done that and so that’s the reason why those applications work differently they have a dependency on the browser to provide the runtime and and the technology with the edge technology that you describe is basically the PWA support that’s built into Microsoft Edge.
It’s not clear to me what these “APIs to provide identity” are, and whether it’s only the PWAs that use these specific APIs that will prompt to reinstall Edge or what happens if Edge is not uninstalled, but is no longer the user’s default browser. (If you know, please enlighten me!)
Then back to Rhys from BCA:
I’ve got a question related to the Windows Annex of the DMA compliance report this year. Specifically item 275 and I’m just quoting from it here it says that some applications are designed to use a specific application that is not the default application because it may provide the user with a more consistent end-to-end experience or enable the use of new features that are supported by the chosen specific application. My question is related to Microsoft apps in particular, could you expand on which of those Microsoft apps have been designated or could be designated to ignore the user-selected default browser and how eventually this could actually give a better end-to-end user experience if it goes against the user’s choice?
Microsoft’s belief in the sanctity of user control was fleeting. Now, it claims that it complies with the DMA by over-riding the user’s chosen default browser:
So today there’s two Microsoft applications that rely on Edge. That’s Microsoft Teams and Outlook. Both of those applications have controls within them where the user can choose to use the default browser or Edge. And if the user selects Edge, we think that there is innovative technology that we’ve built in Edge, where if the user clicks a link in Outlook or Teams, it will open as a side-by-side with Edge where the user doesn’t have to switch between apps to see what they clicked on.
But again, we think this is compliant. The application, the user has control and can choose to rely on the default browser if they prefer.
Now, I’ve done many terrible things in previous lives, but I am not a lawyer. So I am unable to comment on the legality of Microsoft’s assertion that it complies with the DMA by simply ignoring the DMA, and requiring the user to tell Teams and Outlook not to use Edge, but instead to use the browser they have already chosen as the default.
My third and final question of the event was
You’ve said that we won’t have nags to set Edge as the default anymore. Some of our users tell us that when they do a Windows update, One of the steps in the update says something about, do you want Microsoft’s recommended security settings? And that re-establishes Edge as the default browser. Is that correct?
Microsoft replied
So that practice has ceased in the EEA. I think if you have users that are experiencing something like that, then perhaps their PC isn’t configured to be in the EEA.
Which would be good news, if it were true.
I continued,
One of our users in the EA recently got a message saying “your default browser was reset. An app caused a problem with your default browser setting. So it was reset to Microsoft Edge”. And it also reset the email handler to the Outlook, which actually wasn’t installed on the Windows device. Is this a replacement dark pattern?
Quoth Microsoft:
So I’m not aware of that as being a common practice. It’s certainly not something that we’re aware of as being a promotion. From your description, it sounds like that there was some kind of problem detected … I don’t know the details of that particular scenario, but this isn’t a general practice.
Afterwards, the Microsoft lawyer asked me to send details to the DMA Compliance team at Microsoft, which I did yesterday.
BCA’s total megahunk, Mark English, asked
I think I’m happy to hear that as a policy it’s stopped, that practice. I would invite Microsoft to just go back and check that it’s done completely because we are still seeing instances of this happening in devices that have lived in the EEA for many years.
Microsoft were adamant that re-setting the default back to Edge after a Windows update has ceased:
Most of the time when we see people with an issue where they’re not experiencing the compliant behavior is because their machine was actually configured for a location outside of the EEA and then subsequently the user’s location was changed but that doesn’t change the the PC location and And so that’s the thing to check.
To be clear (because I wondered): you get what Microsoft says it believes to be DMA-compliant Windows if you set your region to be within the EEA when you configure Windows, and it doesn’t automatically change if you go outside the region:
the compliance measures that we’ve put in place that are specific to PCs running in the EEA operate for PCs that have that configuration setting. setting is the initial location that a PC is configured as during the first run experience and so it doesn’t change just by changing the users locale
When the meeting closed I took the opportunity to get my photo next to an EU flag, taken by
Rita Wezenbeek, Director of Platforms Policy and Enforcement in DG CONNECT:
Then it was time for a debrief, so we sampled what are reputedly the best frites in Brussels, from Maison Antoine (with samauri sauce, of course) and a glass of cold Kriek beer.
Microsoft has said it will stop some of the most egregious dark patterns – opening some links in Edge, regardless of the default browser, and resetting it as the default browser after a Windows Update. Of course, these are not yet released, so I can’t judge whether Microsoft will comply with the spirit of the DMA.
However, Windows will continue ignore the default browser in two heavily-used Microsoft applications, Outlook and Edge. They will still require users to dig around in Windows Settings to set a browser as the default instead of asking a user during installation, and on choosing it to become default, it should automatically replace Microsoft Edge in the taskbar.
So, we persist.
And then it was back to the Eurostar, the sweaty Underground, and a train back home, arriving home 20 hours after I woke. Don’t you envy me?