Apple Defends Decision to Remove Parental Control Apps

What are the differences between the legitimate apps and the others?

Is the difference publicized by Apple somewhere?

Granting access to sensitive data via an app, under stringent but fair conditions, would be a compromise. For example, implementing a controlled device mode, where the "spy" data is on-device only, and spy mode is clearly notified in the status bar, or what-have-you, so the person being monitored knows the rules at all times they are on device.

Someone please correct me if I'm wrong as I haven't used any of these apps, but I thought the point here is that it's not the parents running an MDM server. I mean, I personally have long made use of MDM and profiles on iOS devices for myself and family, it's super useful (and necessary for some things like using S/MIME certs in native Mail). But I've done it via actual MDM, myself (you can also do a lot via simple distributed one shot profiles made with the free Apple Configurator software). There is no 3rd party involved.

It sounds like here that it was 3rd party apps/services that were making use of MDM functionality. "On behalf of parents" sure, but there's still a fundamentally different relationship and set of expectations for loading an app via the general App Store vs specifically enrolling a device/loading a profile from an employer someone has contractual agreements with, or someone running an MDM server themselves on their own behalf. There isn't really any way around the fact that MDM offers enormous power over devices, much of which happens without any user interaction or much (if any) exposure via the GUI. That's much of the point of it after all. That power certainly offers avenues for abuse that are different in scope.

I'm sure many of the 3rd parties are trustworthy and hopefully at least trying their best in terms of not themselves being hacked by malicious actors, but I think Apple also has a genuine legitimate concern here. A real goal for iOS is that someone can browse through the App Store and install absolutely anything they see and think looks interesting based purely on descriptions/reviews and face a known, fairly minimal and easy to reason about threat profile. Of course it hasn't always been perfect, but it's been a lot better at this then the general free for all. If some of those apps make use of MDM powers outside of normal MDM usage that breaks those expectations, that's not made up.

FWIW I personally think Apple should be required to allow other stores and permanent device owner created master signing cert loading capability, even if only via offering a more expensive "developer" model of phone with that capability not fused off. But the security and privacy tradeoffs there are worthy of consideration and efforts to find the best balances, and even in those cases I'd still be fine with Apple having their own curated App Store that remained as strict as they wished.

Apple already takes a moral stance on certain things. This isn't a debate. If they don't want to allow something on their App store, they will shut it down, even if it's 100% legal. These are the slipper slopes people have talked about for years. This is not new.

Apple has shown that if it doesn't want to support something, they won't. This means it's perfectly reasonable to hold them to account for things that are supported by their platform. This is why some platforms simply don't do any policing, or very limited.

MDMs are meant to allow a business to manage its devices through a third-party provider. They are NOT meant for personal usage, as they are privacy and security issues (who do you turn to when your device is bricked by your MDM?).

This is not the first time Apple is shutting down businesses misuing its APIs, and it won't Apple.

Should Apple provide parental control APIs? That's a separate issue. They currently don't have enough, and user who wants more can indeed switch to Android.