EU Lawmakers Propose Google Share User Search Data with Rivals

Key Takeaways

• The European Commission has proposed new regulations under the Digital Markets Act (DMA) compelling Google to share anonymized user search data with competitor search engines and AI chatbots.
• This initiative aims to foster competition and innovation in the European digital market, particularly in the rapidly evolving AI-powered search sector.
• The data to be shared includes ranking, query, click, and view data from European users, delivered via API daily.
• While proponents see this as a crucial step for fair competition, privacy advocates and national security analysts express concerns about potential re-identification risks and access by foreign entities, even with anonymization measures in place.
• A public consultation is underway, with a final binding decision expected by July 27, 2026.

In a significant move to curb Google’s dominant position in the European digital landscape, the European Commission has formally unveiled a proposal mandating that the tech giant share anonymized user search data with rival search engines and AI-driven conversational agents. This landmark enforcement action falls under the purview of the Digital Markets Act (DMA), signaling a robust effort to level the playing field for competitors.

Commission Outlines Compliance Requirements

The Commission’s preliminary findings, announced on April 15, 2026, detail six specific areas where Google must demonstrate compliance under Article 6(11) of the DMA. These encompass the criteria for entities eligible to receive the data, the precise scope of data to be shared, the frequency and technical methods of data distribution, the standards for anonymization, the pricing frameworks adhering to fair, reasonable, and non-discriminatory (FRAND) terms, and the governance protocols for data access.

Crucially, the proposal explicitly includes AI chatbots that incorporate search functionalities, such as those that directly compete with Google’s own AI offerings, as eligible recipients of this data.

Data Scope and Technical Safeguards

The types of data slated for sharing fall into four core categories: ranking data, query data, click data, and view data. These elements collectively represent the continuous feedback loop that powers and refines search algorithms. Google would be required to provide this data daily via an API, encompassing the previous 24 hours of search activity from European users.

Recognizing the inherent challenges in anonymization, the Commission has integrated several technical safeguards into its proposed framework to mitigate re-identification risks. These measures include data binning to generalize sensitive fields, the suppression of rare or low-frequency queries that could potentially pinpoint individuals, stringent contractual obligations on data beneficiaries to prevent secondary use, and the removal of direct personal identifiers prior to data transmission.

The Commission firmly asserts that this proposal does not compel Google to divulge personal search histories, but rather aggregated, anonymized behavioral signals, as highlighted in a press statement.

Industry Reactions and Future Steps

While proponents argue that equitable access to data is fundamental for fostering innovation, particularly as AI-powered search continues to redefine the digital landscape, the proposal has also drawn significant criticism. Privacy advocates caution that even meticulously anonymized query datasets could still pose fingerprinting risks. They suggest that unique combinations of rare search terms, coupled with geolocation metadata and behavioral patterns, could potentially lead to the re-identification of individuals.

Furthermore, national security analysts have voiced concerns regarding the potential for aggregated European citizen search behavior to become accessible to foreign-owned or inadequately vetted platforms, raising questions about data sovereignty and security.

The Commission has initiated a public consultation, inviting all interested parties to submit their feedback by May 1, 2026. Following a comprehensive review of responses from both third parties and Google, the Commission is expected to finalize and issue a binding decision no later than July 27, 2026.

These proceedings are distinct from, yet run in parallel to, the Commission’s broader DMA non-compliance enforcement actions against Google. Google was formally designated a gatekeeper platform in September 2023 and has been subject to the full obligations of the DMA since March 2024.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.