The DMA's interoperability mandate for WhatsApp dates to 2024. Meta announced the result in November 2025: "third-party chats," letting European users message people on approved external apps from inside WhatsApp. The first partners are BirdyChat and Haiket — two small cross-network messengers. One-on-one chats only: text, images, voice notes, video, files. No groups yet, no calls. Users opt in through WhatsApp's settings and can switch it off. The only personal data that crosses the bridge is your phone number.

Ten months later, the feature is trickling into general Android beta builds, and the coverage is landing the way coverage always does: interoperability is coming, so the pressure to leave the big platform just dropped.

That reading deserves a hard look, because what shipped is not federation, and the difference is not academic. It's the difference between asking the warden to hold a door open and not being in the prison.

What Shipped, and What Didn't

What didn't ship is an open protocol. The list of services that can connect to WhatsApp is the list of companies that implemented WhatsApp's client-side protocols, met the security requirements Meta wrote, and passed an assessment Meta runs, with the European Commission as backstop. That list currently has two entries, both niche.

A Matrix homeserver cannot be on that list. Not a well-run one, not an EU-government-funded one — Neo, FITKO's Matrix-based citizen communication pilot runs on a protocol with an open spec, independently operated homeservers, and published federation semantics. It doesn't qualify because the interoperability here is not protocol-level. There is no spec to implement. There is a partner program.

In federation, nobody decides who may connect; the network is defined by a protocol anyone can serve. In gatekeeper interoperability, the gatekeeper decides — technically, through requirements and assessment, and the regulation only says a door must exist. That's the structural distinction between interop and federation, and it survives every privacy guarantee Meta attaches to the bridge.

Directionality matters too. Your members can message WhatsApp users from a smaller app now — that's real, and for a solo business owner whose customers all live on WhatsApp, it reduces lock-in at the margin. But notice where the topology's center of mass sits: two billion accounts, partner discovery inside WhatsApp's settings, chats rendered in WhatsApp's UI, governed by WhatsApp's terms and WhatsApp's moderation, with the incumbent deciding which apps make the approved list. The incumbent remains the center. Regulation adjusted the terms of the wall. The wall is still there.

The Trust Equation Didn't Move

For this site's audience — fire halls, town offices, co-ops, organizers — the question was never "can my members message their aunt on WhatsApp." It's "who can read or compel access to our communications, and under whose jurisdiction." Third-party chats don't change that answer.

Your side of an interoperable conversation still transits Meta-operated infrastructure on one end and a partner company's infrastructure on the other. Both are service providers inside the same regulatory perimeter this site covered last month: the Chat Control fight, where suspicionless scanning of platform messages was revived by procedural maneuver and the permanent regulation's trilogue resumed this September with client-side scanning proposals in its history. Interoperability doesn't move anyone outside that perimeter. It adds more parties inside it.

The bridge itself is a new surface. Meta's requirement that partners maintain equivalent end-to-end encryption is genuinely unusual for an interoperability mandate and deserves credit. But each approved partner is another company holding your phone number under its own privacy policy, and the approved list grows by Meta's assessment process — not by your choice of server admin, not by a fork, not by a vote of your community. When the rules change — and the same institutions that built this mandate are the ones still pushing scanning obligations — the rules change for everyone inside the wall at once.

Self-hosted federation has the opposite failure profile. A homeserver a community owns is in nobody's assessment queue. Its compliance perimeter is the community's jurisdiction. It changes owners never.

Credit Where Due

It's worth being precise about what regulators actually achieved, because the default posture on this site is skepticism of regulatory fixes and the honest position here is mixed. The Commission designated WhatsApp, held the line for two years, and got a working implementation of cross-app messaging with mandatory E2EE across the bridge — over the objections of a company that spent years arguing it was technically infeasible. Meta's own engineering write-up describes three years of work on it. Whatever you think of the DMA, "the mandate held and code shipped" is not the usual outcome.

So: if you're a freelancer whose clients are on WhatsApp, enabling third-party chats from a smaller client is a genuine exit ramp from a two-app life. The E2EE precedent will be cited by the next regulator to draft an interoperability mandate, including for better mechanisms.

It's just not the mechanism that changes where a community's infrastructure lives.

The Road Not Taken

Open-protocol interoperability — the SMTP model, the Matrix model — was argued for during the DMA's drafting. The final text stayed technology-neutral on how gatekeepers must interoperate, and technology-neutral plus a proprietary client protocol equals partner-by-partner bridges assessed by the incumbent. Nobody broke the law to get here. The regulation's design left the choke point in place, and the choke point is doing exactly what choke points do.

What To Do With This

Three watch items, because this will develop through 2026-27:

  1. Groups and calls. Meta says group chats arrive "once partners are ready." If group interop lands, the reachability argument for staying on WhatsApp gets stronger for individuals — and unchanged for communities, for the reasons above.
  2. Who ever passes the assessment. Two niche messengers in ten months. If that list is still single digits a year from now, the "open" in open-and-mandated will have been measured honestly.
  3. CSAR convergence. A scanning obligation on interpersonal communications services reaches the bridge too. An interop feature built on a compliance regime can be re-shaped by the same regime.

Meanwhile the standing advice is unchanged, because the math is unchanged. A community that runs its own Matrix homeserver or Nextcloud Talk instance owns the trust boundary for every message its members send. A community that relies on gatekeeper interop has rented a slightly wider gate in someone else's wall, on terms set by someone else's lawyers, revocable by someone else's regulator.

Interoperability is what you settle for when you don't own the server.