I’m trying to read the law[1] on this but I’m having difficulty finding the part that forces Android devices to have locked bootloaders. There’s recital 19 that talks about “verification by radio equipment of the compliance of its combination with software”, but there’s nothing stopping a vendor from using a seperate modem / baseband and CPU (like Apple does) right?
As is usual, there seems to be a massive misunderstanding what the directive is and means. The TLDR is that the directive contains no clauses that compels phone makers to keep the Android bootloader locked or that forbids EU users from unlocking it.
Samsung's public reasoning might be that disabling unlocking the bootloader because of the directive, but there is nothing in the directive that forces them to lock the bootloader. It does sound like a convenient scapegoat if they don't want to talk about the real reasons though.
The phone makes who end up disabling the unlocking of bootloaders are all doing so on their own accord, not because some regulation is forcing them to.
Finally, the EU’s broader right-to-repair policies makes it kind of impossible that an outright prohibition of unlocking the bootloader could happen. But of course, nuance doesn't make people click article titles on the web...
Lawmakers need to assume that their laws will be interpreted and abused in the worst possible way.
Is there anything from the current directive's text that makes you believe they didn't already? Again, this directive doesn't require them to disable the unlocking of bootloaders in any shape or form.
If the company want to disable the unlocks, they'll do so for as long as there is no regulation forces them to keep them open, regardless if there are unrelated directives or not.
Same here, was hoping the Pinephone to be that, and while it's cool and overall neat, the software wasn't there the last time I tried (year ago or so). Hopefully one day :)
Exactly, I've used unlocked phones for years and treat my smartphone as a pocket computer. I'm fed up with all that security nonsense as it's a fucking hindrance to how I want to configure my devices.
In fact, my actual phone is now just a feature phone and the smartphone my portable computer with internet access via WiFi and a pocket router with SIM card.
It's trendy to blame everything on AI, but this looks like good old-fashioned journo clickbait. The site has been around since 2017 and appears to be a Turkish content mill focusing on Chinese phones.
The means be which restriction of user choice of software would occur appears to be Article 3(3) point (i) of Directive 2014/53/EU.[1] But as you point out, Commission Delegated Regulation (EU) 2022/30 referred to in the source article makes no reference to point (i), only points (d), (e) and (f):[2]
(d) radio equipment does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service;
(e) radio equipment incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected;
(f) radio equipment supports certain features ensuring protection from fraud;
These so-called "requirements" are so vague that if there was a regulatory body gatekeeping radio devices, I could easily see how the regulatory body could interpret those "requirements" however they wish, including just stonewalling any manufacturer who wishes to argue about the vagueness and interpretation of these so-called "requirements". But the fact that point (i) of Article 3(3) of Directive 2014/53/EU is separated from points (d) through (f) seemingly could be used to argue that "requirements" (d) through (f) were not intended to restrict user choice of software, else point (i) would have also been referenced by Commission Delegated Regulation (EU) 2022/30?
Under the section "Software authenticity" does it mention that the secure boot requirement appears to come from article 3, §3 (i).
Quoting article 3, §3 (i):
radio equipment supports certain features in order to ensure that software can only be loaded into the radio equipment where the compliance of the combination of the radio equipment and software has been demonstrated.
The opening of §3 is:
Radio equipment within certain categories or classes shall be so constructed that it complies with the following essential requirements:
Still won't lead to a forced disabling of unlocked bootloaders, or making that illegal, mostly because the directive doesn't outright forbid that. But also because of this section:
(19) Verification by radio equipment of the compliance of its combination with software should not be abused in order to prevent its use with software provided by independent parties.
Put together with the EU’s broader right-to-repair, if any phone manufacturer disables unlocking the bootloader, they're doing so for other reasons, not because RED rules forces them to.
A quick chase around the company information leads to a shell company that is pretty much typosquatting Meta, and seems to be in either Türkiye or Wyoming. So there are a few red flags that this is at best a very low quality news source.
I’m trying to read the law[1] on this but I’m having difficulty finding the part that forces Android devices to have locked bootloaders. There’s recital 19 that talks about “verification by radio equipment of the compliance of its combination with software”, but there’s nothing stopping a vendor from using a seperate modem / baseband and CPU (like Apple does) right?
[1] https://eur-lex.europa.eu/eli/dir/2014/53/oj/eng
Samsung is just inventing a reason to lock the bootloader
What does the law say about vendors that include a special code for "servicing" the device, and the code leaks out?
As is usual, there seems to be a massive misunderstanding what the directive is and means. The TLDR is that the directive contains no clauses that compels phone makers to keep the Android bootloader locked or that forbids EU users from unlocking it.
Samsung's public reasoning might be that disabling unlocking the bootloader because of the directive, but there is nothing in the directive that forces them to lock the bootloader. It does sound like a convenient scapegoat if they don't want to talk about the real reasons though.
The phone makes who end up disabling the unlocking of bootloaders are all doing so on their own accord, not because some regulation is forcing them to.
Finally, the EU’s broader right-to-repair policies makes it kind of impossible that an outright prohibition of unlocking the bootloader could happen. But of course, nuance doesn't make people click article titles on the web...
What can be used for evil, will be used for evil.
Lawmakers need to assume that their laws will be interpreted and abused in the worst possible way.
Is there anything from the current directive's text that makes you believe they didn't already? Again, this directive doesn't require them to disable the unlocking of bootloaders in any shape or form.
If the company want to disable the unlocks, they'll do so for as long as there is no regulation forces them to keep them open, regardless if there are unrelated directives or not.
In general, you cannot stop people from pointing at a thing and claiming it's something else.
I just hate smartphone, at this point I just want pocket PC. I don't want to deal with this for the decades to come.
with linux ofc
Same here, was hoping the Pinephone to be that, and while it's cool and overall neat, the software wasn't there the last time I tried (year ago or so). Hopefully one day :)
Exactly, I've used unlocked phones for years and treat my smartphone as a pocket computer. I'm fed up with all that security nonsense as it's a fucking hindrance to how I want to configure my devices.
In fact, my actual phone is now just a feature phone and the smartphone my portable computer with internet access via WiFi and a pocket router with SIM card.
Isn't there a feature phone in the market that is 5G, good battery and capable of sharing its internet via wifi hotspot?
I'm still looking for one, mine's currently an older 4g.
The linked article says:
But the text at https://eur-lex.europa.eu/eli/reg_del/2022/30/oj/eng mentions no word such as "authorized"/"unauthorized" or "authent(icity)" or "signed" or "approved" so how can we know that this is the EU which does this when it seems like the removal was global, as seen in this article: https://xiaomitime.com/android-makers-remove-bootloader-unlo... ?
I feel like these articles are just AI slop. There isn't anything in those regulations that would necessitate locking the bootloader.
It's trendy to blame everything on AI, but this looks like good old-fashioned journo clickbait. The site has been around since 2017 and appears to be a Turkish content mill focusing on Chinese phones.
The means be which restriction of user choice of software would occur appears to be Article 3(3) point (i) of Directive 2014/53/EU.[1] But as you point out, Commission Delegated Regulation (EU) 2022/30 referred to in the source article makes no reference to point (i), only points (d), (e) and (f):[2]
(d) radio equipment does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service;
(e) radio equipment incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected;
(f) radio equipment supports certain features ensuring protection from fraud;
These so-called "requirements" are so vague that if there was a regulatory body gatekeeping radio devices, I could easily see how the regulatory body could interpret those "requirements" however they wish, including just stonewalling any manufacturer who wishes to argue about the vagueness and interpretation of these so-called "requirements". But the fact that point (i) of Article 3(3) of Directive 2014/53/EU is separated from points (d) through (f) seemingly could be used to argue that "requirements" (d) through (f) were not intended to restrict user choice of software, else point (i) would have also been referenced by Commission Delegated Regulation (EU) 2022/30?
[1] https://eur-lex.europa.eu/eli/dir/2014/53/oj/eng
[2] https://eur-lex.europa.eu/eli/reg_del/2022/30/oj/eng
That's a good point, I have nothing to add. However, another commenter highlighted this interesting section: https://news.ycombinator.com/item?id=44766342
https://www.riskinsight-wavestone.com/en/2025/07/radio-equip...
This page (cited by the article at the bottom) has a lot more context and somewhat detailed technical. Information.
Under the section "Software authenticity" does it mention that the secure boot requirement appears to come from article 3, §3 (i).
Quoting article 3, §3 (i):
The opening of §3 is:
Source: https://eur-lex.europa.eu/eli/dir/2014/53/oj/eng
Still won't lead to a forced disabling of unlocked bootloaders, or making that illegal, mostly because the directive doesn't outright forbid that. But also because of this section:
Put together with the EU’s broader right-to-repair, if any phone manufacturer disables unlocking the bootloader, they're doing so for other reasons, not because RED rules forces them to.
so no updating the baseband software, but that has been the case for years
This sets a new record for worst AI slop posted on HN so far.
A quick chase around the company information leads to a shell company that is pretty much typosquatting Meta, and seems to be in either Türkiye or Wyoming. So there are a few red flags that this is at best a very low quality news source.
Why was this story flagged? This story raises important issues about smartphones that need discussing.
The story may be hyped but the underlying issues are very relevant.
Google killed it, not EU.
So Google influences HN policy, eh?
Maybe some. A large of "hackers" on this site work at Google and they tend to get angry if you mention anything bad about google
As above.
If you consider current Google employees and the laid off yes, Google influences HN heavily
OK, I accept that.
It's absolute bottom barrel, 100% auto-generated slop.