European Citizens’ Initiative Draft

Objectives

Why can you install any software on a PC, but not on the phone you paid for? It doesn’t have to be like this.

Big Tech locks devices and uses checks like Play Integrity to block banking and transport apps if you use alternative software.

We demand EU legislation through an official European Citizens’ Initiative (ECI) to:

1. Guarantee the right to unconditionally unlock bootloaders and install any OS.
2. Stop apps and essential services from discriminating against alternative/open-source systems.
3. Enforce open, vendor-neutral security standards so users truly own their phones.

Annex

1. Context and Problem Statement

When you buy a computer, it belongs to you. You own the machine, and you choose what operating system and programs it runs. But on phones, that basic rule of ownership has been broken. Big Tech locks bootloaders and uses proprietary integrity checks to decide what software you’re allowed to use on hardware you already bought.

These closed integrity frameworks act as private gatekeepers. When European citizens choose independent, European, or open-source operating systems (e.g., /e/OS, postmarketOS, GrapheneOS), essential applications arbitrarily deny service. Critical everyday tools, including retail banking, public transport, and digital identity systems, treat user-controlled devices as inherently compromised. These operating systems are not compromised and are as secure as the default ones. This creates an unacceptable barrier to European digital sovereignty and forces citizens into an exclusive dependency on foreign Big Tech software stacks.

2. Why This Matters for All European Citizens

Even for consumers who never replace their default operating system:

• Electronic Waste Reduction: Forced obsolescence occurs when manufacturers terminate security updates for functional hardware. Unlocking bootloaders allows community maintainers to extend device lifespans safely, keeping toxic e-waste out of landfills, advancing the EU Circular Economy Action Plan, and fulfilling the core objectives of the Right to Repair Directive.
• Consumer Protection & Market Resilience: Critical European services must not depend on the private policies or proprietary servers of foreign gatekeepers. Open standards guarantee continuous access and safeguard European strategic autonomy.
• European Tech Innovation: Eliminating arbitrary attestation barriers enables European software vendors, SMEs, and privacy-focused startups to compete fairly in the digital market.

3. Specific Legislative Measures Proposed

A. Mandatory Bootloader Freedom and Hardware Sovereignty

The Commission must propose binding rules requiring all computing devices with general-purpose processors sold in the EU to provide user-accessible mechanisms to unlock the bootloader.

• Unlocking must not depend on third-party cloud accounts, manufacturer whitelisting, or arbitrary delay periods.
• Hardware security modules (Secure Elements, TPMs, StrongBox) must allow users to enroll custom cryptographic root-of-trust keys, enabling Verified Boot on independent operating systems.
• Bootloader unlocking or software modification must not void mandatory hardware warranties.

B. Open, Direct Hardware Attestation

Proprietary cloud verification frameworks must not serve as mandatory gatekeepers to digital life.

• Device security must be evaluated through open, standard hardware APIs (such as native key attestation) or open WebAuthn/FIDO2 standards, rather than routing trust decisions exclusively through gatekeeper cloud services.
• The use of self-signed or user-enrolled root keys must not trigger automatic blacklisting from digital services. Services must accept cryptographic possession proofs generated inside isolated hardware chips without mandating proprietary OS certification.

C. Non-Discrimination in Essential Services

• Essential public-sector services and regulated consumer services (e.g., PSD2-regulated banking) must remain accessible to users of independent operating systems.
• When native app attestation cannot be supported by a custom build, services must be legally required to provide standard, fully functional web-based or FIDO2-based authentication pathways.

D. Sustainability and Post-Support Source Availability

To prevent artificial obsolescence, when original equipment manufacturers terminate regular software updates, they must:

• Release the device trees and hardware interface documentation necessary for the open-source community to maintain security updates.
• Provide a legal safe harbor for the redistribution of compiled firmware components (blobs) required to keep the hardware functional throughout its physical lifespan.

4. Legal Basis in the EU Treaties

This initiative falls strictly within the legislative powers of the European Union to regulate the internal market and protect consumers, specifically under:

• Article 114 TFEU (Internal Market): Harmonizing consumer hardware rights and removing technical barriers in the Digital Single Market.
• Article 169 TFEU (Consumer Protection): Promoting the economic interests and rights of consumers regarding the goods they purchase.
• Regulation (EU) 2022/1925 (Digital Markets Act): Specifically advancing the principles of Article 6(7) regarding hardware interoperability and access to secure elements.
• Directive (EU) 2015/2366 (PSD2): Article 98, mandating technology neutrality and open communication standards in financial services.
• Directive (EU) 2024/1799 (Right to Repair Directive): Ensuring that artificial software or hardware locks do not prevent consumers and independent maintainers from maintaining, updating, and extending the operational lifespan of functional devices.
• Ecodesign for Sustainable Products Regulation (ESPR): Mandating design requirements that prevent premature software-induced hardware obsolescence.