Beyond Enforcement: The Apple App Store Case and the Need to Rethink Brazil’s Antitrust Framework

The Apple App Store case before Brazil’s Administrative Council for Economic Defense (CADE) raises the broader institutional question of whether traditional antitrust proceedings can provide the permanent governance structures required to regulate digital ecosystems. Administrative Proceeding No. 08700.009531/2022-04 concerns an investigation into alleged anticompetitive conduct by Apple within the digital ecosystem of the iOS operating system. CADE initiated the proceeding following a complaint filed by Mercado Livre (E.bazar and Mercado Pago) in late 2022. The investigation examined restrictions on the distribution of third-party digital goods and services within apps, the mandatory use of Apple’s In-App Purchase (IAP) payment system for transactions conducted within apps, and anti-steering clauses preventing developers from informing users about alternative purchasing and payment methods. Apple argued that these measures were intended to protect user security and privacy.

In November 2024, CADE’s General Superintendency imposed a preventive measure to halt the effects of these practices until a final decision on the merits. The measure sought to prevent the length of the proceeding from undermining the effectiveness of any future intervention, in a market where the closure of distribution channels and the consolidation of technological standards can produce effects that are difficult to reverse. Following legal challenges and the Tribunal’s confirmation of the measure, Apple requested the negotiation of a Cease-and-Desist Agreement (TCC), registered under No. 08700.006953/2025-62.

In December 2025, CADE’s Tribunal approved the TCC, suspending the administrative proceeding and the preventive measure. The proceeding is expected to be dismissed and the measure permanently revoked upon full compliance with the obligations undertaken. The agreement required, among other measures, the opening of the iOS system to alternative app stores, the authorization of payment processors other than IAP and steering mechanisms, and the implementation of a new commission structure. It also established an ongoing monitoring framework, initially supported by an independent trustee, with periodic reports, third-party complaints, and the possibility of reviewing the agreement.

From Enforcement to Quasi-Regulation

In his vote, Reporting Commissioner Victor Oliveira Fernandes addressed the challenges that digital ecosystems pose for antitrust enforcement and the emergence of new ex ante regulatory models, and reflected on the limits of traditional antitrust intervention in digital markets.

In the absence of a specific legal framework, the proceeding relied on several procedural mechanisms to formulate restorative remedies. The debate over the preventive measure considered, for the first time, a theory of ecosystem harm, analyzing the operating system, app distribution, payment processing, and the sale of digital goods and services in an integrated manner. CADE also held a public hearing on the “competitive aspects of the digital ecosystems in which mobile operating systems operate.”

During the TCC negotiations, CADE made the settlement discussions public in the case file, seeking to facilitate dialogue with app developers. This transparency allowed market tests to be conducted throughout the negotiation.

The agreement also adopted restorative remedies that went beyond ending the practices under investigation. It established positive obligations to open the ecosystem, accompanied by monitoring and review mechanisms.

Taken together, these measures raise a broader question: whether Brazil needs a new regulatory framework to address the challenges of digital markets. In this case, the authority had to build, for a single proceeding, part of the infrastructure that ex ante regulation would ordinarily provide on a permanent basis. The vote itself recognizes that purely injunctive remedies tend to be insufficient and that intervention in access conditions and commercial terms assumes “quasi-regulatory” characteristics.

Do We Need a “Brazilian DMA”?

The Apple case connects directly with Brazil’s legislative debate over a new antitrust framework for digital platforms. The main proposal currently under discussion is Bill No. 4,675/2025, which addresses the market power of large digital platforms and places CADE at the center of the new regulatory regime, but Bill No. 2,768/2022, often described as the “Brazilian DMA,” also remains part of the debate.

The importance and urgency attached to these proposals reflect a central feature of digital markets and a concern that also shaped the Apple case. Traditionally, CADE assesses anticompetitive conduct after it has been implemented or has produced market effects. International experience in digital markets has increasingly moved toward defining obligations in advance for so-called gatekeepers. Yet reducing the debate to ex ante regulation versus ex post enforcement misses a substantial part of the problem. The central question is not merely when the authority should act, but which institutional framework will allow CADE to monitor, understand, and intervene competently in markets characterized by information asymmetry, technological complexity, and the strong capacity of regulated entities to adapt strategically.

The Apple case illustrates this shift and the importance of developing collaborative and permanent governance mechanisms. The challenge was not merely to determine whether a particular clause was lawful or unlawful. It was to define how alternative app stores would operate, which security requirements would be legitimate, how to prevent user warnings from becoming deterrent mechanisms, which fees could be charged, and what information would be necessary to assess compliance. These questions cannot be resolved by a binary choice between finding an infringement and dismissing the case. They require ongoing monitoring, continuous evidence gathering, review capacity, and technical expertise distributed across different stakeholders.

Building Permanent Regulatory Capacity

For new regulation to be effective, it must allow different sectors to participate in the regulatory process. On technically complex issues, such as interoperability, data portability, ranking, access to digital infrastructure, online advertising, and the operation of closed ecosystems, the authority may struggle to formulate appropriate obligations without ongoing technical dialogue with market participants. That dialogue, however, requires permanent institutional structures rather than episodic participation through the procedural mechanisms available in individual proceedings.

The need for continuous technical input also highlights the limits of the procedural tools currently available to CADE. Public hearings can broaden participation, but they are not always sufficient. One-time consultations may not provide sufficiently detailed technical input, particularly when the discussion involves sensitive information, commercial strategies, system architecture, security standards, or competitively relevant data. Nor does one-time participation by market actors ensure continuous monitoring of the implementation of imposed obligations. Although market tests conducted in individual proceedings can help refine a remedy, they cannot, by themselves, provide institutional stability, continuity of dialogue, or adequate mechanisms to keep pace with technological developments.

These limitations point to the need for permanent governance structures, with technical chambers or multisectoral committees offering one possible institutional response. Such forums could support forms of regulated self-regulation or co-regulation and operate as permanent governance structures focused on behavioral standards, regulatory obligations, implementation criteria, and monitoring mechanisms for digital platforms of systemic importance. The participation of competitors, professional users, representatives of affected sectors, independent experts, and relevant public agencies would provide CADE with a more concrete understanding of platform practices in a controlled and institutionally organized environment, reducing the risk of undue exposure of sensitive information and improving the technical quality of decision-making.

A key advantage of this institutional model would be its ability to protect commercially sensitive information without limiting stakeholder participation. These forums could operate under differentiated access and confidentiality rules, ensuring that competitively sensitive information is not shared indiscriminately among all participants. Dedicated technical groups, access protocols, confidentiality obligations, and the disclosure of aggregated results could reconcile the protection of trade secrets with the public interest in building regulatory knowledge.

A permanent structure would also reduce reliance on ad hoc submissions made under the pressure of enforcement proceedings. Stakeholders could report implementation problems, test technical standards, discuss compliance metrics, and propose adjustments without every submission being immediately treated as a complaint or evidence of an infringement. This could facilitate the early identification of risks and allow the authority to distinguish legitimate operational difficulties from strategies designed to circumvent regulatory obligations. CADE would be better positioned to intervene in a progressive and responsive manner, reserving punitive enforcement for situations involving resistance, discrimination, or noncompliance.

Any such arrangement would not deprive CADE of its authority to define obligations, monitor compliance, or impose sanctions. Rather, it could strengthen CADE’s regulatory capacity by allowing decisions to rest on more reliable information, a better understanding of the practical effects of the measures, and continuous monitoring of market developments. Sectoral participation should not mean delegating regulatory power to regulated entities, nor should it allow dominant platforms to control the agenda or delay decisions. Any governance model must preserve CADE’s final authority, establish rules for representation, and prevent conflicts of interest.

Brazil’s Open Finance framework offers a particularly useful point of reference and has emerged as one of the leading international experiences in open finance governance, based on permanent technical governance and structured stakeholder participation. Through Open Finance, the Central Bank established a multisectoral governance model, comprising a deliberative council, a secretariat, and technical groups — in which the various regulated segments participate. This enables operational, technological, and security standards to be discussed in a structured manner between the regulator and market participants. The Central Bank retained its regulatory and supervisory functions while recognizing that the implementation of technically complex requirements depends on the participation of stakeholders who understand the system’s infrastructure, risks, and operational limitations.

This experience demonstrates that Brazilian administrative law already accommodates governance arrangements in which public authorities retain ultimate decision-making authority while relying on structured mechanisms to develop technical standards, address implementation challenges, and monitor compliance. The relevance of this experience lies less in the specific solutions adopted for the financial sector than in the governance architecture it represents. As Brazil debates a new framework for digital markets, Open Finance shows that permanent technical governance and structured stakeholder participation are not foreign concepts, but tools already present in Brazil’s regulatory practice that can be adapted to other contexts.

Conclusion

The debate over a “Brazilian DMA” should therefore go beyond defining prohibited conduct and selecting a competent authority. The central challenge is to build a regulatory framework capable of combining government oversight, technical expertise, effective monitoring, and continuous dialogue with affected sectors.

The Apple case shows how CADE can mobilize existing procedural tools, but it also reveals the limits of relying on preventive measures, ad hoc market tests, and negotiated settlements within enforcement proceedings to regulate entire digital ecosystems. These instruments remain valuable, but they cannot substitute for permanent governance arrangements that support implementation, technical learning, and regulatory adaptation.

Without such a shift, Brazil risks creating a new law to apply old methods that have proved insufficient for the challenges of the digital era. Ex ante regulation should do more than anticipate state intervention; it should create institutional conditions that allow the authority to learn continuously, monitor implementation, and review its decisions as markets evolve. It is this transformation—not merely a list of obligations—that can turn the experience gained from the Apple case into a new regulatory framework for Brazil’s digital markets.