Here’s how Apple will check if your iPhone is eligible for sideloading

It’s official: Apple today released iOS 17.4 beta, which enables sideloading for users in the European Union due to the new Digital Markets Act (DMA) antitrust legislation. Unsurprisingly, the changes Apple made to comply with the EU won’t be available to the rest of the world, but here’s how exactly Apple will check if your iPhone or iPad is eligible for sideloading.

iOS 17.4 brings sideloading to iPhone and iPad

iOS 17.4 brings significant changes to how Apple’s mobile operating system works. Firstly, sideloading won’t be openly available. Instead, Apple will allow alternative app stores on iOS, and only these stores will be able to distribute apps outside the App Store. Apple calls these stores “App Marketplaces.”

And App Marketplaces must follow a lot of rules to ensure that they’re given special permission by Apple. For instance, the company says that third-party app store creators must have a letter of credit of at least €1 million to “guarantee support for developers and customers.”

There are also some other features coming exclusively to users in the EU due to local regulations, such as the ability for third-party apps to use NFC for payment without Apple Pay and new APIs for creating web browsers using alternative engines to Apple’s WebKit. But how exactly will Apple limit these features on its devices?

iOS checks multiple infos before enabling sideloading

As it turns out, we predicted it months ago. 9to5Mac reported in April last year that Apple had developed a new system internally called “countryd” that combines multiple pieces of information to determine the region where the user is located. This system has been around since iOS 16.2, but hadn’t been used until now.

This is some of the information that iOS checks to determine whether a device is eligible for sideloading and App Marketplaces, based on system reports and code seen by 9to5Mac:

• Apple ID billing address
• The user’s current location (apparently Apple is only checking the country and not a precise location for privacy reasons)
• The current region set in iOS settings
• The device class (whether it’s an iPhone, iPad, etc.)

Interestingly, this system also specifically checks whether the device comes from China to restrict sideloading – the reasons behind this are unclear. Apple is also implementing a new section in the “About this iPhone” menu to let users see the region of the device. There will be a link to a support article with more details about this system, but it’s not available yet.

The list of countries where sideloading is enabled comes from an Apple server, which means that the company can update it at any time. Eventually, if more countries end up passing antitrust legislation similar to the DMA, Apple can roll out the same changes in those regions without having to release another iOS update.

Of course, this system makes it very difficult for users in unsupported regions to enable sideloading, as this requires not only changing the Apple ID region, but also tricking the iPhone’s location system. An update to iPhone Simulator will let developers simulate this new system of distributing apps outside the App Store.

Apple has also developed a system that can override the regulatory check to enable sideloading for a specific Apple ID. This system is probably used for internal development only.

App Marketplaces feature is based on the MDM API

There’s also another part of the sideloading story that we already knew. As reported by 9to5Mac in November, Apple does indeed use the new Managed App Distribution API (created for MDM solutions) as a backend for App Marketplaces.

The API has basic controls for downloading, installing, and even updating apps from external sources. It can also check whether an app is compatible with a specific device or iOS version, which the App Store already does. iOS 17.4 beta adds a “MarketplaceKitBridge” component to this API, so that both APIs can share what’s needed to download apps outside the App Store.

Apple says iOS 17.4 will be released to the public in March, in time for the March 7 deadline set by the EU.