Key facts
- Google warns EU regulations could lead to increased fraud and privacy risks on Android.
- The EU plans to require Google to share anonymized search data with competitors.
- Google argues that anonymized data can be de-anonymized using AI, potentially linking it to individuals.
- The proposed rules fall under the EU's Digital Markets Act, which designates Google as a gatekeeper.
- Google has expressed concerns that allowing third-party AI integration on Android could enable malicious actors.
- The European Commission is expected to make a final decision on the rules by July 27.
The European Commission is preparing to introduce new regulations targeting Google's market dominance, potentially forcing the company to share search data with competitors and allow alternative AI services on Android devices. Google, however, has voiced significant concerns, framing the proposed changes as a threat to user privacy and security.
Heather Adkins, Google's VP of security engineering, stated that the EU's proposals could lead to a "significant increase in fraud" on Android within weeks if implemented. She explained that granting other AI models system-level access, similar to Google's Gemini, could allow malicious actors to install harmful services that steal data or manipulate user experiences. Google's Gemini currently has access to user files and screen content on Android.
Google also expressed detailed concerns regarding the requirement to share anonymized search data, including search content, rankings, and click rates, with competitors. The company argues that anonymization is technically challenging and that powerful AI models make it easier than ever to de-anonymize large datasets. Google's internal teams have reportedly been able to link supposedly anonymous search data to individual users in as little as two hours using "linkage attacks." Google suggested that smaller European firms might not possess the expertise to handle this data securely, potentially making them targets if data is compromised.
These regulatory efforts are being undertaken under the Digital Markets Act (DMA), which has identified Google, Meta, Amazon, and other major tech companies as "gatekeepers" subject to stricter rules. Google has publicly opposed the DMA, advocating for its revision, citing its dominant market share, particularly in web search where it holds over 90 percent. The company asserts that sharing granular data with competitors is an "untenable privacy issue," despite its own frequent use of anonymized data across its services for various purposes.
The European Commission is currently reviewing feedback from a comment period that ended May 1 and is determining the enforcement mechanisms for these new rules. A final, legally binding decision is anticipated by July 27, at which point the exact nature of AI access and data anonymization requirements will be clarified.