Sideloading on iPhone stopped being theoretical in March 2024, when the EU’s Digital Markets Act forced Apple to allow alternative app marketplaces and direct web downloads. The clearest number attached to that change is not a download count, it is a risk figure: apps installed outside an official app store are 50 times more likely to contain malware than apps from Google Play, according to Google’s own March 2025 security data.
What did the DMA actually require Apple to change?
The Digital Markets Act required Apple to open iOS in the EU to three new distribution paths: alternative app marketplaces, direct web downloads, and third-party payment options within apps. Apple’s own compliance filing describes building more than 600 new APIs and developer tools to support these changes. What did not change is Apple’s notarization requirement, a mandatory security review that applies to every iOS app in the EU regardless of which channel distributes it.
Figure 1: Every EU iOS distribution channel still routes through Apple’s notarization review. Source: Apple Developer, DMA compliance documentation.
That single shared requirement is the main reason Apple argues sideloading on iOS carries a different risk profile than sideloading has historically carried on Android, where no equivalent universal review exists outside Google Play.
Is sideloading actually riskier?
The clearest risk data available comes from Android, where alternative distribution has existed far longer than on iOS. Google reported in March 2025 that apps installed from outside Google Play carry malware at a 3% rate, compared with 0.03% for apps sourced from Play itself, a 50 times difference. Google Play’s own third-party app store program shows the same dynamic at work on Android’s side of this comparison.
Figure 2: Malware infection rate by source. Source: Google Android Developers Blog, March 2025.
Warning
This risk data is measured on Android. iOS alternative marketplaces work differently: every app still has to pass Apple’s mandatory notarization review before reaching a device, which Android’s “outside Play” category does not require. We could not find a disclosed, sample-sized malware-rate study specific to notarized iOS alternative marketplaces since the DMA took effect; treat the Android figures as the best available reference point, not a direct substitute for iOS-specific data.
Separately, industry security trackers report that more than 95% of malicious Android apps originate from sideloaded sources rather than the Play Store, though we could not trace this specific figure to one named, disclosed-methodology primary study; treat it as a directional industry estimate rather than an audited statistic.
What does DMA compliance cost developers?
Apple’s Core Technology Fee (CTF) applies once a developer’s app passes 1 million installs distributed outside Apple’s own App Store: 0.50 euros for each first annual install beyond that threshold. This fee exists specifically because of the DMA; it did not apply before Apple had to permit alternative distribution. On top of the CTF, new EU rules taking effect October 1, 2026 add a financial-stability requirement before any developer can operate its own alternative marketplace at all, such as holding a standby letter of credit of 1,000,000 US dollars or being a publicly traded company.
Figure 3: Regulatory milestones since the DMA required sideloading support. Sources: Apple Developer documentation; Tech Times, 2026.
Who actually benefits from a lower distribution cost, in practice?
Not every developer sees a lower cost from sideloading being allowed. A quadrant view of cost versus reach shows why only high-volume publishers see a clear financial upside once the Core Technology Fee applies.
Figure 4: Illustrative developer positioning under DMA fee terms, based on the Core Technology Fee threshold and install-volume figures cited above. Source: synthesized from Apple’s published CTF terms, not a single unified dataset.
Large publishers who pass the 1 million install threshold outside the App Store face the CTF directly, while smaller developers below that line see the DMA mainly as an optional distribution channel rather than a new cost.
How does malware origin break down by source?
Figure 5: Industry-reported share of malicious Android apps by distribution source. This is a widely repeated industry estimate without one disclosed, named primary methodology; treat as directional. Source: aggregated mobile security industry reporting, 2025-2026.
The Bottom Line
The single number that matters most for anyone evaluating sideloading in 2026 is 50 times, the malware-rate gap Google measured between Google Play and everything outside it. The EU’s Digital Markets Act did not remove Apple’s notarization review, the one safeguard most directly comparable to Play Store vetting, but it did add real costs for high-volume developers through the Core Technology Fee and, from October 2026, a financial-stability bar for marketplace operators. If your app or software ships outside a single app store, keep your EULA consistent across every channel it reaches, since license terms and liability language do not automatically transfer between an App Store listing, an alternative marketplace, and a direct download. For the market side of this shift, see the alternative app store market data, and for how license terms hold up once an app ships this way, see the App EULA prevalence data.
Frequently Asked Questions
Is sideloading actually riskier than downloading from an app store? On Android, yes by a wide margin. Google reported in March 2025 that apps installed outside Google Play carry malware at a 3% rate versus 0.03% for apps from Play itself, a 50 times higher rate. An equivalent iOS-specific study has not been published.
What did the EU Digital Markets Act actually require Apple to change? Since March 2024, Apple has had to allow alternative app marketplaces and direct web downloads (sideloading) on iOS in the EU. Apple built more than 600 new APIs and developer tools to comply, while keeping its notarization security review in place for every distribution channel.
Does the DMA cost developers money even outside the App Store? Yes. Apple charges a Core Technology Fee of 0.50 euros per first annual install once a developer passes 1 million installs distributed outside its own App Store, a direct financial effect of DMA compliance.
Are apps distributed outside the App Store still reviewed for security? Yes. Apple’s notarization requirement applies to every iOS app distributed in the EU regardless of channel, App Store, alternative marketplace, or direct web download, and the DMA left this requirement in place.
Sources and References
- Google Android Developers Blog. (2025). “Keeping Google Play Safe.” Malware-rate comparison, apps outside Play versus Play Store.
- Apple Developer. (2026). “Changes for Apps in the European Union.” Core Technology Fee, notarization, and compliance API count.
- Apple. (2025). “Complying with the Digital Markets Act.” Official Apple compliance documentation.
- Tech Times. (2026). “Apple EU Settlement Locks In 5% App Store Rate With Notarization Still in Place.” October 2026 marketplace operator financial-stability requirements.
Note: All figures verified as of August 2026. DMA compliance terms and marketplace fee structures remain under active regulatory proceedings and are refreshed at least twice a year.
