AICOA returns: what a US App Store shake-up would mean for mobile developers

A bipartisan pair of senators, Judiciary Committee Chairman Chuck Grassley (R-Iowa) and Sen. Amy Klobuchar (D-Minn.), reintroduced the American Innovation and Choice Online Act (AICOA) on June 11, reviving a bill that first appeared in 2021 and has stalled repeatedly since. Apple responded the same day with a sharp rebuttal that leaned heavily on its existing arguments against Europe's Digital Markets Act. If you build for iOS and Android, this is not abstract policy noise. It is a preview of how the rules around app distribution and payments could shift in the largest app market you ship to.

What the bill actually covers

AICOA targets a narrow set of platforms by design. It applies only to companies with at least $175 billion in average annual gross revenue that also reach at least 34% of U.S. subscriber households, or 34% of U.S. monthly active users over the age of 12. That threshold is deliberately tuned to capture a handful of gatekeepers, Apple and Google among them, without sweeping in smaller marketplaces.

For covered platforms, the prohibited conduct list reads like a catalog of long-running developer complaints:

• Unfairly favoring their own products or services over third-party ones
• Misusing nonpublic business-user data to copy and compete against the businesses on the platform
• Limiting competitors' access to key platform features
• Blocking business users from accessing or moving their own data off the platform
• Retaliating against users who raise legal concerns
• Conditioning platform access or product placement on the purchase of unrelated services
• Locking users into default settings
• Skewing ranking or presentation against similarly situated business users

The bill would let both federal and state agencies bring enforcement actions, while carving out explicit protections for privacy, security, and intellectual property. The endorsement list skews toward companies that have spent years arguing they sit on the wrong side of platform power: Mozilla, Y Combinator, Proton, Yelp, DuckDuckGo, and Replit, alongside several antitrust scholars and advocacy groups.

The developer-facing reality

Strip away the legislative language and AICOA points toward the same structural changes the Digital Markets Act already produced in the EU. If you have shipped an iOS build into Europe in the past two years, you have already lived through a version of this.

The data portability and self-preferencing clauses are the ones with the most direct technical implications. "Blocking business users from accessing or moving their own data" maps cleanly onto the kind of export and interoperability requirements that force platform owners to expose APIs they would rather keep internal. The anti-self-preferencing language targets default placement and ranking, which affects everything from App Store search results to which apps get to register as the system default for a given capability.

The payments angle is where most developers will feel it first. The EU's DMA opened the door to alternative app marketplaces and third-party payment systems on iOS, letting developers route transactions around Apple's in-app purchase commission. AICOA's prohibition on conditioning platform access on the use of unrelated services covers similar ground. In practice that means an iOS payment flow in the U.S. could eventually look more like the fragmented model EU developers already navigate: StoreKit for some users, external purchase links or alternative processors for others, and a tax and compliance matrix that varies by region.

For cross-platform teams, the asymmetry matters. Android already permits sideloading and third-party stores in most markets, so Google's exposure under AICOA is narrower than Apple's on distribution, though the data-misuse and self-preferencing clauses cut across both. If you maintain parallel iOS and Android codebases, AICOA would narrow the behavioral gap between the two platforms on payments while leaving plenty of platform-specific plumbing intact.

Apple's counterargument

Apple did not hedge. In a statement to 9to5Mac, the company said it "strongly disagree[s] with the Senate's consideration of European-style regulation that would hamper innovation and force changes consumers never asked for, while undermining the privacy, security and child safety protections they rely on every day."

The company drew an explicit line to the DMA, arguing that surveys show Europeans now perceive their online experiences as worse than before the regulation took effect. It raised its familiar concerns about alternative app marketplaces and external payment systems: reduced oversight over off-store purchases, weaker parental controls, and the availability of adult-content apps through third-party distribution channels. Apple also flagged the impact on its trust and safety APIs and child-protection safeguards, framing those as casualties of mandated openness.

The most pointed argument is economic. Apple pointed to a study it commissioned last year claiming developers largely pocketed DMA-related commission savings rather than passing them to consumers. Per that study, developers "kept prices the same or increased the prices on 91% of products" despite an average commission decrease of 10 percentage points. Read that for what it is: a preemptive rebuttal to the bill's affordability framing, and a reminder that commission relief and consumer pricing are separate questions. For a developer, lower platform fees are margin, and margin does not automatically become a price cut.

What to actually do about it

Nothing in AICOA is law yet. The bill has advanced with bipartisan support before and never reached the president's desk, so the base case is continued uncertainty rather than imminent change. But the engineering lesson from the DMA rollout is that platform compliance deadlines arrive faster than re-architecture work, and teams that had already abstracted their payment and entitlement logic shipped EU-compliant builds with far less pain.

If you want to be ready without betting on a specific outcome, the durable moves are the ones that pay off regardless. Keep your purchase and entitlement logic behind an abstraction layer rather than hardcoding StoreKit assumptions throughout the app. Treat receipt validation as server-authoritative so you can swap or add payment providers without trusting the client. Audit how much of your app's behavior assumes a single distribution channel, because that assumption is exactly what both the DMA and AICOA chip away at.

The broader pattern here is regulatory convergence. Europe moved first, and the U.S. proposal borrows its structure closely enough that Apple is reusing the same rebuttals nearly verbatim. For mobile developers maintaining apps on both platforms, that convergence is the useful signal: the compliance work you do for one jurisdiction increasingly transfers to the next, and the architecture decisions that survive regulatory churn are worth making now whether or not AICOA ever clears the Senate.