EU orders Google to share search data with rivals under DMA

The European Commission has ordered Google to hand over anonymised search data to rival search engines and give competitors equal access to its Android operating system, in the most consequential enforcement action under the Digital Markets Act to target artificial intelligence services. The ruling, published this week, sets two deadlines: January 2027 for data sharing and Android AI feature access, and July 2027 for third-party voice-activated assistants on Android devices.

The decision touches the two areas where Google holds the strongest structural advantages in European digital markets: search and mobile operating systems. Roughly nine out of ten web searches in the EU run through Google, and Android powers around seven out of ten smartphones sold on the continent. The Commission's argument is straightforward: without access to the data that makes Google's services effective, rivals cannot compete, and without access to the device features that Google reserves for its own AI assistant, alternatives cannot reach users.

What the Commission has decided

The ruling has two main components. First, Google must share anonymised search data with eligible third-party search providers, including AI chatbots that incorporate search functionality. The data in question is the same information Google uses to train and refine its own services. Second, Google must ensure that rival AI services can access features on Android devices on equal terms with its own Gemini assistant, and that users can set a competing AI assistant as their default voice-activated service.

The Commission described data sharing as essential to creating a competitive market. "Data sharing is crucial for the development and optimisation of third-party search engines," it stated in its release. "It helps to create a more level playing field with Google Search, and fosters innovative search services, which includes privacy-focused alternatives."

The inclusion of AI chatbots with search features in the data-sharing requirement is notable. It means the ruling is not simply about traditional search engines such as DuckDuckGo or Bing, but extends to any service that combines conversational AI with web search, a category growing rapidly since the arrival of large language models. Google's Gemini, which integrates search results directly into its AI responses, would be the primary beneficiary under the current market arrangement; the Commission's decision is designed to ensure that competitors can match that integration.

How the data sharing will work

The ruling sets out specific anonymisation requirements, developed in collaboration with privacy experts and aligned with the draft joint guidelines of the DMA and the General Data Protection Regulation (GDPR), produced by the Commission and the European Data Protection Board. This is a deliberate attempt to prevent the ruling from creating a conflict between competition law, which demands data access, and data protection law, which restricts it.

The practical details matter. Google must anonymise the data before sharing it, and the anonymisation must meet standards that satisfy both the DMA's competition objectives and the GDPR's privacy requirements. The Commission has not published the full technical specification, but the principle is that rivals should receive data of sufficient quality to improve their services, while individual users cannot be identified from the datasets.

Whether this balance is achievable in practice remains an open question. Privacy advocates have long argued that truly anonymised data loses much of its commercial value, while data-intensive companies argue that anonymisation strong enough to satisfy GDPR makes the data far less useful for training machine learning models. The Commission is effectively betting that a middle ground exists.

Android interoperability and voice commands

The second half of the ruling addresses Android. From July 2027, users must be able to activate their preferred AI assistant through voice commands in the same way they currently invoke Google's assistant with the phrase "Hey Google." The Commission also requires that third-party AI assistants be able to perform actions within other apps on the user's behalf: booking a taxi, suggesting replies in chat applications, or answering questions about a place the user has recently visited.

This goes further than earlier EU interventions on Android, which focused on allowing users to choose default search engines or browsers. The new requirements would give rival AI assistants deep integration into the operating system, including the ability to read screen content and interact with other applications. For Google, this means the architectural advantage of owning both the operating system and the default AI service would be substantially reduced.

Google vets its own competitors

One of the more striking elements of the ruling is that the Commission will allow Google to evaluate whether sharing data with a specific third party poses serious cybersecurity or data protection risks before any transfer takes place. On its face, this is a reasonable safeguard: a company designated as a gatekeeper under the DMA should not be forced to hand data to an entity that might misuse it. But it also creates an obvious tension. Google, which has every commercial incentive to limit the data it shares, gets to decide whether a competitor is trustworthy enough to receive it.

The Commission has presumably included this provision because removing all gatekeeper discretion would create genuine security risks, and because the DMA already provides for regulatory oversight of bad-faith refusals. Even so, expect disputes. Google could cite security concerns to delay or deny data access, forcing rivals to complain to the Commission, which would then need to investigate. The process could take months, during which the competitive benefit of the ruling erodes.

The ruling also outlines what the Commission calls a "fair" formula for pricing the shared data. The details of this formula have not been published in full, but the principle is that Google should not charge a price that effectively prevents competitors from accessing the data. This is a familiar challenge in competition law: setting a price for mandatory access that compensates the incumbent without recreating a barrier. The Commission's record on this, from the Microsoft interoperability cases of the 2000s, suggests that pricing disputes will be lengthy and technical.

DMA meets GDPR

The intersection of the Digital Markets Act and the General Data Protection Regulation is one of the more uncertain areas of European digital regulation. The DMA is designed to force large platforms to share data with competitors. The GDPR is designed to restrict how personal data is processed and transferred. If the anonymisation standards required under this ruling are too weak, data protection authorities could challenge them. If they are too strong, the data may not be useful enough to support genuine competition.

The Commission has attempted to pre-empt this by developing the anonymisation requirements jointly with privacy experts and aligning them with the draft joint DMA-GDPR guidelines. But those guidelines remain in draft, and data protection authorities in individual member states, particularly Germany's and France's, have shown a willingness to enforce GDPR strictly even when it conflicts with other policy objectives. A challenge from a national data protection authority against the Commission's anonymisation standard is not hard to imagine.

What this means for AI competition in Europe

For European users, the most visible change will be the ability to choose a different AI assistant on Android phones and have it work as seamlessly as Google's own. For rival search engines and AI services, the value depends entirely on the quality and quantity of data Google is required to share, and on the price it charges. If the anonymised datasets are too sparse, or the pricing formula too generous to Google, the ruling will look ambitious on paper but deliver little in practice.

For Google, the decision adds to an already substantial regulatory burden in Europe. The company has faced three separate EU antitrust fines totalling more than 8 billion euros over the past decade, covering shopping search, Android device bundling, and advertising. The DMA operates differently: rather than punishing past conduct, it imposes forward-looking obligations. Google can comply, but each obligation narrows the advantage of owning the platform.

The broader question is whether structural remedies of this kind can meaningfully shift market dynamics in search and AI. Google's dominance in European search is built on more than data alone. Default placement, user habit, distribution agreements with device manufacturers, and the quality of the underlying index all contribute. Data sharing addresses one of these factors. It does not address the others.