Can rival messengers talk securely? The DMA, encrypted RCS and your phone's AI

Since May, a text from an Android phone to an iPhone can be end-to-end encrypted, with a lock icon on both sides. Meanwhile, in the EU, WhatsApp has opened a door for rival apps, and some of the most privacy-focused messengers are refusing to walk through it. Can different apps really talk to each other without weakening encryption? And once they can, who else on your phone is reading along?

This wraps up our protocols week. On Monday we compared the Signal Protocol, Matrix and MLS, and on Wednesday we looked at why European governments are moving to Matrix. Today: interoperability, the law that demands it, the industry that pulled it off without a law, and the AI assistant as the new third party in your chats.

#What happened

The EU's Digital Markets Act (DMA) obliges the largest messaging services to let smaller rivals connect. The Commission designated Meta as a gatekeeper on September 6, 2023, with WhatsApp and Messenger on the list. In November 2025, Meta said third-party chats were rolling out to WhatsApp users in Europe, with BirdyChat and Haiket as the first partner apps. It's opt-in, covers text, photos, voice notes, videos and files, and Meta said groups would follow once partners were ready.

Not everyone is lining up. Swiss messenger Threema explained in July why it won't connect. Its reasons, in its own framing:

• Identifiers clash. Threema uses random IDs; WhatsApp is built on phone numbers.
• Privacy would sink to the weakest link. Threema warns that connected apps would have to settle for whatever protections the weakest of them offers, especially around metadata.
• No visibility. Once a message reaches WhatsApp, Threema can't check how it's handled, and WhatsApp's code isn't open.
• Meta sets the rules. Because WhatsApp defines the protocol, Threema argues that partners would in effect be building a slimmed-down copy of Meta's messenger into their own apps.
• Business. If people can reach Threema users from inside WhatsApp, fewer will buy Threema, which is how it funds itself.

Why do identifiers matter so much? A phone number is a stable, real-world identifier: whoever sees it can often link it to a name, other accounts and a contact graph. A random ID reveals nothing on its own. Bridging the two means one side's privacy model has to bend.

That last point in the list is Threema's own, and it has a clear commercial interest in it. Note too what Threema doesn't claim: that WhatsApp's third-party chats drop end-to-end encryption. Meta says it maintains end-to-end encryption, though it qualifies that as applying as far as possible, and the law requires it. The objections are about identifiers, metadata, verification and control.

#What the law does

The relevant rule is Article 7 of the DMA, which covers what the law calls "number-independent interpersonal communications services" (think WhatsApp, not SMS). A gatekeeper has to open the basic features to other providers who ask, free of charge, in stages:

• From designation: one-to-one text, plus images, voice messages, videos and files between two people.
• Within 2 years: text in groups, and media between a group chat and an individual.
• Within 4 years: one-to-one voice and video calls, and calls between a group chat and an individual.

The security line is explicit: "The level of security, including the end-to-end encryption, where applicable, that the gatekeeper provides to its own end users shall be preserved across the interoperable services." The gatekeeper also has to publish a reference offer with the technical details, and users of both apps "shall remain free to decide" whether to use the interoperable features. The Commission can extend the deadlines if the gatekeeper shows it needs more time to keep things secure.

A separate rule, Article 6(7), is about operating systems: a gatekeeper "shall allow providers of services and providers of hardware, free of charge, effective interoperability with" the same hardware and software features its own services use. The Electronic Frontier Foundation cites it as proof that interop is now law, not a favor. It comes back in the AI section below.

#Where it stands

• WhatsApp: third-party chats work one-to-one, with two partners announced by Meta. Threema said in July that only single chats were supported. We couldn't find a Meta announcement that groups with third-party users have launched.
• The DMA review: the Commission's first review, published April 28, 2026, kept the law largely as is. Per Tech Policy Press, it declined to extend Article 7 to social networks. The Commission's staff working document behind the review says it is "too soon to draw conclusions" about Article 7's impact and calls interoperability "one of the topics where stakeholder views diverged most."

#The counter-example: RCS and MLS

Now look at what happened without a DMA order. Rich Communication Services (RCS) is the carrier standard that replaces SMS. In March 2025 the GSMA announced end-to-end encryption for RCS based on MLS, the group protocol from Monday's post, as part of Universal Profile 3.0. In the GSMA's telling, that makes RCS the first messaging system at this scale where apps from different vendors can exchange end-to-end encrypted messages with each other.

The RCC.16 specification (version 3.0, February 2026) adds a Key Delivery Service (KDS): a directory that checks a user's identity, certifies and hands out the MLS key packages your phone needs to start an encrypted chat. Each provider runs its own KDS and they federate, so an iPhone can fetch keys for an Android user. That makes the KDS a trust point, the same "is this really their key?" problem from Monday. The spec's answer is an 80-digit verification code users can compare, optionally as a QR code. One detail worth knowing: if the participants' devices share no common cipher suite, the spec says the group is created unencrypted.

The rollout began on May 11, 2026, in beta, for iPhones running iOS 26.5 (where the carrier supports it) and Android phones running the newest Google Messages, according to Google and Apple. It's on by default and shows a lock icon. On iPhone the switch sits under Settings > Apps > Messages > RCS Messaging, per Apple, and 9to5Google reported the "(beta)" wording in the iOS 26.5 release notes. As of early November, Apple's support page still calls it a beta that depends on your carrier and rolls out over time, so it isn't finished.

The EFF frames this as the model case: Google wanted Apple on board to fix the "green bubble" experience, and once both used a common standard, people on both platforms came out ahead. It's also a non-EU win: RCS encryption works wherever carriers support it, driven by industry, not by a regulator.

The contrast with WhatsApp is the design. In the gatekeeper model, the big platform publishes an interface and partners plug into it on its terms; the gatekeeper can change that interface and partners have to follow. In the open-protocol model used by RCS and Matrix, everyone implements the same published standard, nobody owns the pipe, and outside researchers can audit every side of the conversation.

#Who it affects: the AI on your phone

A chat is only as private as its endpoints. Encryption protects messages on the way, but once they're decrypted on your screen, an assistant that can read the screen or your notifications can process them, possibly in the cloud. (We covered the server-side version of that problem last week.)

On the iPhone, iOS 27.2, now Apple's latest release, adds a single switchboard for this. According to Apple's guide, it lives under Settings > Siri > Excluded Apps, an exclusion list to which the user adds individual apps, such as messengers.

Excluded apps are cut off from Siri, Search and suggestions. The EFF notes the price: Siri can no longer read or reply to those messages, and on-screen awareness stops working there. That's the point.

On Android, Gemini's app access works the other way round. Per the EFF's walkthrough, other apps reach Gemini through Settings > Personal Intelligence > Connected Apps in the Gemini app, and that connection is opt-in. Signal isn't hooked into that app-access feature in the first place. Two broader features can still reach chat content, though: "Device Assistance," which reads notifications, and screen context, which has its own switch under Device controls > Screen context. Menu names may vary by version. The EFF wants Google to offer per-app controls and Apple to add an on-device-only AI option.

#What's next

The obligations apply only to designated gatekeepers and only in the EU, which is why WhatsApp's third-party chats appear for European users and nowhere else.

The lessons, as we read them:

• For regulators: interop has worked best so far where it rests on open, auditable standards, as RCS and MLS show. Retrofitting closed systems takes time, and the EFF's position is that security reviews deserve that time but shouldn't become a way to stall; it floats a tiered model, lenient at first and stricter later.
• For companies: preserving end-to-end encryption now includes the assistant layer, not just the wire.
• For users: the differences show up in three places. Encrypted RCS chats display a lock; WhatsApp's third-party chats are opt-in, which decides who can reach an account that way; and on iOS, chat apps can be excluded from the OS assistant.

Under the DMA's timeline, the next big step is calls: one-to-one and group-to-individual voice and video, four years from designation. For WhatsApp and Messenger, that means September 2027.

That's our protocols week: three designs, one government favorite, and a law trying to make rivals talk. Subscribe to the policy feed or the main feed. Which two apps would you most want to connect securely? Tell us.