Software monetizing apps (ones that consumers get for "free" in exchange for an alternative way for the vendor to get paid) know that the trick to getting more installs is to reduce the number of clicks the consumer must make to get the app installed.
Apparently Chrome and Edge know this too, because both of their installers recently changed their behavior: they no longer prompt for EULA/Privacy consent. Instead, they put a new line on their landing pages:
They added a "By downloading Xxx, you agree to the" line. Apparently they felt that this new opt-out, landing-page-only notification substitutes for consent. When their downloaded installers are run (double-clicked), they launch directly into the install.
We don't know how these two monetizing apps (because they are monetizers: they give free browsing and search in exchange for your browsing data and for search advertising revenue) decided that now was time for this change. Maybe one of them did it first to increase installs, and the other company copied. Maybe somebody got promoted for shifting their install rate KPI up a few points (we know from many studies that each click removed increases installs significantly).
What we don't know is if either Microsoft or Google considered the consequences of every monetizing app (wanted and unwanted) copying them. We've spent more than ten years holding the line that installers must obtain consent when the installer is downloaded outside of a store, and if they don't obtain that consent, they go on our active Deceptor list.
The problem is this: we rely on anti-malware products to enforce our active Deceptor list, and no anti-malware product is going to detect Edge and Chrome, because they understand the reality: consumers will think the anti-malware product made a mistake, and they'll either disable or uninstall an anti-malware product that detects Google's and Microsoft's browsers.
In other words, wanted software like Edge and Chrome get to set the rules of what really is unwanted behavior, whether or not that decision seems irresponsible to the rest of us.
It wouldn't be fair to the monetization industry if we held other vendors to a standard that Google and Microsoft refused to follow, so we're adjusting our rules to allow user consent to take place on the landing page, and not in the installer.
We're putting some rules around this, as best we can. We only allow this landing-page, opt-out consent for things that don't reduce the consumer's security posture, don't change defaults or settings in other apps, don't accept offers to install other software, and don't install borrowing software. The three consents that we will allow are EULA/Privacy acceptance, telemetry gathering, and interrupting the workflow with offers. See ACR-042 on our requirements checklist.
We also have beefed up the requirements on installers: it must say that it's installing, it must be cancellable, and it can't auto-dismiss when it's done. See ACR-028 on our requirements checklist.
This represents a big change (and great opportunity) for the software monetization industry. Hopefully it doesn't get abused too much, because we don't want consumers to get tricked or fooled into installing apps that they don't want. We'll keep an eye on how it's going, and if it does get bad, we'll try approaching Microsoft and Google to consider changing their ways...