EU Forces Google to Open Search Data to AI R

Brussels Forces Google to Open Its Search Data Vault — and the Real Winners Are AI Rivals

On July 16, 2026, the European Commission adopted binding specification decisions that force Alphabet to share usable Google Search data with rival engines and open Android to competing AI assistants. A regulatory intervention that shifts the DMA from paper compliance into an operational data-transfer regime. The companies best positioned to exploit it are not traditional search rivals but the AI chatbot builders.

Adopted in a single day, the two decisions pursue a common goal. One compels Google to share ranking, query, click, and view data from both free and paid search results with qualifying rivals. Another forces open 11 Android features, from voice invocation to on-device AI model access, that Google's own Gemini assistant has enjoyed while competitors were locked out. The connective thread: a regulator that no longer accepts the gatekeeper's definition of compliance.

Both decisions rest on the Digital Markets Act, the regulation Brussels adopted in 2022 that imposes behavioural obligations on designated gatekeepers. Under Article 6(11), Google must share anonymised search data with rival online search engines on fair, reasonable, and non-discriminatory (FRAND) terms. Under Article 6(7), it must grant developers effective interoperability with Android's hardware and software features. The obligations have existed on paper since March 7, 2024 — the DMA compliance deadline — but the Commission's July 16 measures are the first time Brussels has specified, in granular technical detail, exactly what compliance looks like, using a legal tool called a specification proceeding. These are separate from non-compliance investigations and carry no financial penalty — the carrot, not the stick — yet they map a path Google cannot easily ignore, because failure to implement them would almost certainly trigger a non-compliance case with fines of up to 10 percent of global annual turnover, according to the CSIS.

The data Google did not want to share

Article 6(11) should already have forced Google to share query, click, ranking, and view data. But Alphabet's initial compliance offer, submitted after March 2024, stripped out between 90 and 100 percent of unique search queries and explicitly excluded AI chatbots from the list of eligible recipients.

The Commission described the result bluntly: no meaningful uptake. PPC Land reported the preliminary findings in April 2026, and before that documented an open letter from 18 European trade groups in March urging Brussels to act. The University of Antwerp analysis cited in the Commission's guidance found that DMA remedies had shifted roughly six million EU users to alternative browsers but left Google still near 90 percent dominant in search. DuckDuckGo, the privacy-focused search engine, criticised Google's proposed anonymisation method as creating a dataset "unusable for search training purposes," according to Brookings scholar Mark MacCarthy. The message from rivals was consistent: Google was complying with the letter of the law while gutting its substance.

The July 16 specification decision rewrites the ruleset. Google must now share the data it collects and uses to optimise its own search services — the same queries typed, the same metadata on language and device, the URLs viewed, how users interacted with results, and information on where each result sat on the search results page, according to the Commission's official Q&A. Several categories are excluded to protect individuals: no account information or search histories, no precise timestamps, no rare-word queries that could identify a searcher, generalised rather than exact location, and no URLs tied to paid results.

The exclusion of advertising-click data from the shared set is a concession that limits the immediate value for ad-tech competitors. But the inclusion of AI chatbots — explicitly named in the decision as eligible beneficiaries — changes the calculus entirely, because these firms do not need ad data to train their models. They need query-and-click patterns to understand what users want and how they navigate answers.

The Android opening: AI assistants get a key

The second decision may prove more consequential over the long run. Google owns the Android operating system that powers roughly 60 percent of EU mobile devices, and until now Gemini — Google's own AI assistant — has enjoyed comparatively unrestricted access to on-device functions that competitors could not obtain by equivalent means. PPC Land documented in July 2025 how Gemini gained automatic Android access to phone dialling and messaging data. Third-party AI assistants, by contrast, were limited in how they could offer their services, making them less attractive to users.

The specification decision names 11 Android features grouped into four categories: invocation (how a person starts an interaction with an assistant), context (an assistant's ability to draw on app, sensor, or screen data), actions on apps and the operating system, and access to resources including Google's own on-device AI models. In practice, this means a European Android user will be able to summon a rival assistant by voice as they now say "Hey Google," delegate a task such as booking a taxi, receive proactive suggestions such as a flight number pulled from an email, or use a third-party assistant to read app data stored on the device in a centralised fashion, all functions currently reserved for Google services.

The deadlines stretch into 2028, a timeline that reveals the technical complexity being mandated. Google must deliver these capabilities in Android 18 by August 1, 2027. Concurrent hotword detection — the ability for multiple assistants to listen for their own wake words simultaneously — gets a longer runway. It will arrive in Android 19 by August 1, 2028. For sensitive functions such as screen automation and centralised on-device data access, Google may impose objective eligibility conditions verified by independent certifiers. It must publish draft terms by February 1, 2027, and begin accepting applications from May 1, with each assessment completed within four weeks.

The asymmetry being corrected is precisely the imbalance Fiona Scott Morton, the former chief economist at the DOJ's antitrust division, described in a Bruegel working paper on DMA Article 6(7) that argued the DMA's Android AI access rules could curb Google's advantage and open Europe's AI market to rivals.

Winners and losers: the competitive geometry shifts

The immediate losers are clear. Google loses exclusive control over a dataset that underpins a search business expected to generate close to $200 billion in revenue this year. Alphabet's CEO Sundar Pichai testified in the US remedies trial that forced data sharing amounts to a "de facto divestiture" of the company's core intellectual property, according to NPR. Google's Head of Competition Oliver Bethell has argued separately that the DMA has materially degraded user experiences, with consumers now completing 50 percent more searches to reach their desired destinations and businesses reporting 30 percent less traffic to their sites, per CSIS analysis. The Commission clearly weighed those claims and found them insufficient to justify the compliance status quo.

The winners are more interesting — and not who a casual observer might expect. Traditional search rivals such as DuckDuckGo, Ecosia, and France's Qwant gain access to a dataset they have been demanding for two years. But DuckDuckGo has already signalled deep scepticism, with founder and CEO Gabriel Weinberg arguing that the DMA's full-anonymisation requirement could render the shared data useless by introducing so much noise that no usable pattern remains for search training. The Commission's multi-layered anonymisation method, developed in close collaboration with internal and external privacy experts and in line with draft joint guidelines by the Commission and the European Data Protection Board, attempts to thread this needle. Whether it succeeds will not be known until recipients begin receiving actual datasets in November 2026.

The more significant beneficiaries may be AI chatbot builders — OpenAI, Anthropic, Perplexity, and European entrants such as Mistral. ChatGPT already sought access to Google's search index during the US trial, with OpenAI's head of product Nick Turley testifying that the company tried to develop its own search index but found it too expensive and time-consuming, per NPR's trial coverage. Under the EU specification decision, AI chatbots offering search functionalities are now explicitly eligible to receive shared data, subject to anonymisation. The cost is calculated under a FRAND formula the Commission has specified — not the prohibitive terms Google could have set unilaterally.

This is a competitive advantage no US court has yet granted. In September 2025, US District Judge Amit Mehta ordered Google to share portions of its search index and user click-and-query data with qualified competitors, according to NPR, but Google appealed that ruling in January 2026, the BBC reported, and implementation is likely delayed for years. The EU, operating under an ex-ante regulatory framework rather than ex-post antitrust, has no such appellate bottleneck — the specification decision is binding and carries a compliance calendar measured in months, not years.

A third category of beneficiaries is less obvious: the European Commission itself. Specification proceedings are a regulatory tool that exists precisely because the DMA anticipated that gatekeepers would interpret broad obligations in narrow, self-serving ways. By deploying them against Google — the most powerful search gatekeeper, holding above 90 percent market share — Brussels is establishing a precedent. Meta and Apple will be watching to see how aggressively the Commission monitors the search-data and Android decisions, because specification proceedings are now the default escalation path when a gatekeeper's compliance offer fails to deliver results.

The limits of data-sharing remedies

Scepticism about the remedy's effectiveness runs deep in the economic literature. Bertin Martens of Bruegel, in a working paper on competition in search markets, concluded that asymmetric data sharing may increase competition but may also reduce scale and user welfare, depending on the slope of the search-data learning curve. The risk is that fragmenting the data that powers a high-quality search engine across multiple smaller rivals produces multiple worse engines rather than one dominant engine and several credible alternatives. Martens proposed symmetric data sharing between all search engines — an outcome the DMA does not require — as potentially superior.

The US remedies experience reinforces this caution. A more recent Bruegel paper by Martens noted that the EU data-sharing obligation "so far has had no noticeable effect on market shares" and observed that a one-off search-index-sharing rule faces the problem that new websites appearing subsequently will not be revealed to data recipients; the value of the index decreases rapidly. The Commission's specification decision partly addresses this by requiring ongoing data flows — latency of at least seven days but no more than Google's internal latency — rather than a one-off snapshot, for a duration of up to five years per beneficiary. That is a materially stronger intervention than either the original DMA obligation or the US remedy order.

Yet the privacy tension is unresolved. Brookings scholar Mark MacCarthy argued that Europe's demand for full anonymisation could require introducing so much noise as to destroy usable patterns, while the US DOJ's proposed reasonable deidentification standard paired with a ban on reidentification attempts represented a better compromise. The Commission's decision acknowledges this tension by allowing the measures to be amended based on future market developments, including independent third-party evaluation. The escape clause is there — but using it would require the Commission to admit that its initial calibration was wrong.

What to watch next

The decision sets concrete deadlines that create hard observation points for market participants.

Within 1.5 months — by late August 2026 — Google must publish a description of the anonymised search dataset it plans to share. By November 2026, four months after the decision, it must make the full dataset available to qualified third-party online search engines. Those potential beneficiaries must demonstrate that they offer online search engine services, will process the data in the European Economic Area or ensure equivalent protection if transferred, and must undergo independent audits to verify their compliance with the safeguards specified in the measures.

On the Android side, the first milestone arrives February 1, 2027, when Google must publish draft terms for the eligibility programme that will govern access to sensitive features. Applications open May 1, 2027.

The broader regulatory context amplifies the stakes. On July 2, 2026 — exactly two weeks before the specification decisions — the European Court of Justice upheld a €4.1 billion fine against Google for using Android to block rivals, the BBC reported, the largest penalty the Commission has ever imposed. A separate non-compliance probe into Google's self-preferencing of its vertical search services (Flights, Hotels, Shopping) remains open, with preliminary findings released in March 2025 and fines expected. The specification decisions are not happening in isolation; they are part of a sustained regulatory campaign in which the Commission is testing every lever the DMA provides.

The Bottom Line

The European Commission's July 16 specification decisions transform the DMA's search-data obligation from a theoretical right into an operational data-transfer mandate — Google must begin sharing usable query-and-click data with rival engines and AI chatbot makers by November 2026. The companies best positioned to benefit are not DuckDuckGo or Ecosia but the AI firms that can now train answer engines on Google's intelligence without building their own search infrastructure. The open question — and the one on which the entire remedy will be judged — is whether the required anonymisation leaves enough signal in the data to build a competitive product, or whether privacy protections designed to satisfy the GDPR produce a dataset that satisfies regulators and serves no one else.