Apple says it has declined to implement 16 new Web APIs in Safari because they posed a threat to user privacy by opening new avenues for user fingerprinting
Catalin Cimpanu / ZDNet : Tweets: @filipnest , @carnage4life , @jwildeboer , @icanzilb , @usbcguy , and @elliottz Tweets: Filip Hnzdo / @filipnest : Translation: Apple is as usual scared of losing app royalties if people move their apps to the web so will continue hurting web apps and browsers. https://twitter.com/... Dare Obasanjo / @carnage4life : Apple will not add functionality such as NFC or Bluetooth support in the browser for privacy reasons. Coincidentally this prevents web apps from matching functionality of mobile apps. Claiming privacy is the strategy credit that keeps on giving for Apple https://www.zdnet.com/... @jwildeboer : #Apple refuses to add support for 16 web APIs for privacy concerns. I look at the list and I wonder - what is wrong with you web people? What are you doing? This is not the web I want. This is Orwellian and out of control. https://www.zdnet.com/... https://twitter.com/... Marin Todorov / @icanzilb : Wow, 10 minutes using Safari on Big Sur Really puts things in perspective - some websites use 30 - 50 *different* tracking services!!! What are you people doing?? What the hell??? Nathan K. / @usbcguy : Looks like WebUSB got the axe for being a browser fingerprint vector. Doesn't bode well for device firmware updates or emergency recovery images. https://news.google.com/... Elliott Sprehn / @elliottz : I agree with Apple we should be careful, but if they were serious they'd block native install banners which are worse in realized privacy impact. Back in the real world the APIs benefit privacy and security b/c the web has a more robust sanbox than native https://www.zdnet.com/...
Context & Ripple Effects
This refusal lands mid-way through a 2020 privacy offensive: days earlier, Apple made its mobile advertising identifier opt-in under iOS 14's IDFA change, and months before that Safari began wiping sites' offline data after a week of inactivity (the seven-day local storage deletion). Declining the 16 APIs — which include device-access surfaces like NFC and Bluetooth — extends the same logic from data retention and ad tracking into the browser's raw hardware capabilities.
The contested part is the rationale. Developers quoted in the coverage read it as self-serving: capping web APIs keeps web apps from reaching native-app functionality, preserving the App Store's position. That critique later hardens into the broader case that Apple's WebKit monopoly lets it strip-mine the web, and eventually into regulatory intervention.
First-order effects
- Web developers targeting Safari lose access to hardware-level capabilities — NFC, Bluetooth, USB-class APIs — so progressive web apps cannot match what native iOS apps can do on the same device.
- Safari users get a concrete fingerprinting defense: fewer novel API surfaces means fewer side channels advertisers could exploit for covert tracking.
Second-order effects
- Developers who need those capabilities are pushed toward shipping native App Store apps instead of web apps — exactly the outcome critics like Dare Obasanjo argue the privacy framing conveniently produces, given App Store commission economics.
- The refusal adds ammunition to interoperability complaints from other browser makers and web-standards voices, feeding the regulatory pressure that culminates in the EU forcing default third-party browsers and alternative engines onto iOS with iOS 17.4.
Third-order effects
- If the pattern holds, web capability becomes jurisdiction-dependent: European iPhone users access a more capable web through alternative engines while other regions remain locked to Apple's unilateral API decisions — fragmenting 'the web' along regulatory lines rather than standards ones.
- Platform owners emerge as de facto standards bodies for the web on their own hardware, with privacy invoked as both genuine protection and competitive moat — a dual role that invites regulators, not technical committees, to arbitrate which APIs ship.
The trend: Gatekeepers are increasingly deciding the web's capability surface unilaterally in the name of privacy, and regulators are answering by stripping them of that veto engine-by-engine.