Google Warns EU That Forced Search Data Sharing Could Re-Identify Users in Under Two Hours
- Google's internal red team re-identified users from anonymized search data in under two hours, the company's top privacy scientist told EU regulators [1]
- The European Commission is requiring Google to share search ranking, query, click, and view data with rival search engines and AI chatbots on fair terms under the Digital Markets Act [2]
- A parallel DMA proceeding would force Google to give competitors like ChatGPT and Claude the same Android access that Gemini enjoys [3]
- Apple filed a submission backing Google's position, warning the Android interoperability rules would create 'profound risks for user privacy, security, and safety' [4]
- The Commission must issue a binding decision by July 27, 2026, with non-compliance penalties of up to 10% of global annual revenue [2]
Google is mounting an aggressive privacy-based defense against European Commission proposals that would force the search giant to share its core search data with competitors, warning that the bloc's anonymization safeguards are dangerously inadequate. Sergei Vassilvitskii, a Google distinguished scientist specializing in differential privacy, told EU antitrust officials that the company's internal red team managed to re-identify users from data anonymized under the Commission's proposed methods in under two hours [1].
The warning is part of Google's pushback against two parallel specification proceedings the Commission opened on January 27, 2026, under the Digital Markets Act. The first would require Google to share search ranking, query, click, and view data with rival search engines and AI chatbot providers on fair, reasonable, and non-discriminatory terms. The second would compel Google to grant competing AI services — including OpenAI's ChatGPT and Anthropic's Claude — the same level of access to Android features that Google reserves for its own Gemini assistant [2][3].
The Commission must issue binding decisions on both proceedings by July 27, 2026. Non-compliance under the DMA carries penalties of up to 10% of global annual revenue — a figure that for Alphabet, with a current market capitalization of $4.3 trillion, amounts to tens of billions of dollars [2].
The Privacy Argument
Google's case rests on an empirical claim: that the Commission's proposed combination of pseudonymization, aggregation, and noise injection is insufficient to protect user identities when modern AI tools are applied to the shared data. Vassilvitskii, who has led Google's differential privacy research since 2012, characterized the vulnerability as structural rather than theoretical [1].
The company has pointed to historical precedent, noting the 2006 AOL search data release, in which researchers re-identified users within days from supposedly anonymized query logs. Google argues that advances in AI have made such linkage attacks far easier in the intervening two decades [1].
Google Senior Competition Counsel Clare Kelly framed the stakes in broader terms: 'Hundreds of millions of Europeans trust Google with their most sensitive searches — including private questions about their health, family, and finances — and the Commission's proposal would force us to hand this data over to third parties, with dangerously ineffective privacy protections' [5].
What the EU Is Requiring
The European Commission's proposals stem from the Digital Markets Act, which designates Google as a 'gatekeeper' and imposes specific obligations to open its platforms to competition. The Commission opened the two specification proceedings in January 2026 to translate those broad obligations into concrete, enforceable requirements [2].
On the search data front, the Commission proposed in April 2026 that Google must provide 'data beneficiaries' — rival search engines and AI services — with access to ranking, query, click, and view data. The data must be shared on fair, reasonable, and non-discriminatory terms, with the Commission setting parameters for pricing, frequency, and access procedures [2].
On Android interoperability, the Commission is seeking to ensure that competing AI assistants receive 'free and effective interoperability' with the same Android hardware and software features that Gemini uses, including voice activation, system-level search integration, and cross-app functionality [3].
EU Executive Vice-President Teresa Ribera framed the measures as essential for competition: 'Data is a key input for online search and for developing new services, including AI' [5].
Apple Joins Google's Defense
In a notable intervention, Apple filed a submission with the Commission in May 2026 backing Google's position on the Android interoperability proceeding. Apple warned that the proposed measures would create 'profound risks for user privacy, security, and safety as well as device integrity and performance' [4].
Apple argued that the Commission had attempted to redesign Android based on fewer than three months of work, displacing engineering decisions Google's team developed over years. The filing was unusual — Apple and Google are direct competitors in mobile operating systems, but both share a commercial interest in maintaining platform-level control over AI integration [4].
The July Deadline
The Commission's self-imposed deadline of July 27, 2026, creates a compressed timeline for resolution. The public consultation period closed on May 1 for the search data proceeding and May 13 for the Android interoperability proceeding. Three outcomes remain plausible: the Commission could revise its specification to address Google's privacy concerns, proceed with the current framework and risk litigation, or reach a political accommodation [1][2].
Google has signaled willingness to negotiate. Vassilvitskii said the company is 'eager to share our technical expertise and work with the EC to establish the right guardrails,' suggesting Google prefers a revised framework over outright defiance [1].
The proceedings are separate from, but parallel to, the U.S. Department of Justice's own antitrust case against Google's search monopoly, which is proceeding through a separate remedies phase. Alphabet shares were trading at $356.16, up 0.7% on the day, and are up roughly 14% year-to-date [6].
What's at Stake
The outcome of the July decision will set a significant precedent for how the Digital Markets Act operates in practice — and whether privacy concerns can serve as a legitimate shield against pro-competition mandates. If the Commission proceeds with its current framework, Google faces a choice between compliance and the risk of fines up to 10% of global revenue [2].
For rivals like OpenAI, DuckDuckGo, and other search competitors, access to Google's search data represents a potentially transformative resource. Google processes over 90% of search queries in Europe, and the data generated by that dominance — the patterns of what users search for, click on, and engage with — is widely considered the single most valuable input for building competitive search and AI products [2][3].
Further sources
The stories that matter, in one email. Free — unsubscribe anytime.