EFF Urges Regulators to Balance Security and Interoperability in Platform Rules
EFF released new guidance urging platform interoperability without compromising security in regulations.
Why it matters: Digital platform rules affect legal compliance, user privacy, and competition strategies for in-house and law firms managing tech contracts and policies.
- EFF published guidance in October 2026 advocating regulatory frameworks that ensure both interoperability and robust security.
- EU’s Digital Markets Act mandates interoperability from gatekeepers with over €7.5 billion annual revenue.
- FTC stated in December 2023 interoperability can align with privacy and security to enhance competition.
- Thailand’s draft Digital Platform Economy Act (May 2025) proposes specific gatekeeper thresholds including 500 million baht annual revenue and aims for secure data sharing.
- CMS requires healthcare payers to adopt APIs for data interoperability under 2024 rules.
The Electronic Frontier Foundation (EFF) issued a detailed guidance in October 2026 emphasizing the necessity for regulatory policies that balance platform interoperability with strong security safeguards.
This guidance specifically addresses concerns that interoperability mandates may compromise security, asserting that well-designed rules can promote open ecosystems and protect user data simultaneously.
International regulatory efforts reflect this principle. The European Union’s Digital Markets Act (DMA) requires designated gatekeepers—typically platforms with annual revenues exceeding €7.5 billion and serving over 45 million monthly users—to provide interoperability features to foster competition. The DMA became enforceable in 2023 and represents a leading regulatory model.
Similarly, the U.S. Federal Trade Commission stated in December 2023, via its policy research release, that interoperability can coexist with privacy and security, emphasizing its role in enhancing consumer choice and addressing barriers to switching between competing platforms.
In Asia, Thailand’s draft Digital Platform Economy Act, proposed in May 2025, sets gatekeeper thresholds—including 500 million baht (approximately $15 million USD) in annual local revenue and at least 2 million users—to implement interoperability and data portability mandates. The draft aims to encourage competitive digital ecosystems while including security provisions.
Healthcare is also subject to interoperability rules. The Centers for Medicare & Medicaid Services (CMS) finalized 2024 rules requiring payers to implement standardized APIs to reduce data exchange barriers securely.
Independent legal experts caution that implementing interoperability demands requires careful alignment with data protection and cybersecurity laws to ensure compliance and risk mitigation.
For legal and compliance professionals, understanding these evolving standards is critical when advising on platform contracts, data security protocols, and regulatory risk management.
By the numbers:
- €7.5 billion annual revenue — EU DMA gatekeeper designation threshold
- 45 million users — Monthly active user threshold under EU DMA
- 500 million baht annual revenue — Proposed gatekeeper revenue threshold in Thailand’s draft law
Yes, but: While interoperability aims to foster competition and user control, implementation challenges include safeguarding against security vulnerabilities and aligning with diverse privacy laws across jurisdictions.
What's next: The EU Commission plans DMA enforcement reviews in 2027; Thailand expects to finalize its Digital Platform Economy Act by late 2026.