EU Orders Google to Share Search Data by July

Brussels moves to open Google's search data to rivals by July 27

The EU is set to finalise a DMA order forcing Google to share query, click and view data with rivals and AI chatbots — a competition remedy that carries a real re-identification risk.

The European Commission has until July 27, 2026 to turn a draft order into binding law: Google must hand over ranking, query, click and view data — the same feed it uses to train its own systems — to any rival search engine or AI chatbot that qualifies, on fair terms, via an API, for at least five years. This is not another antitrust fine. It is the first time a regulator has tried to force-share the raw scale advantage that made Google Search unassailable, and it is being done under a legal architecture — the Digital Markets Act — designed to move faster than the courts. The privacy trade-off is genuine: the very granularity that makes the dataset useful to Ecosia, Qwant, OpenAI and Perplexity is what makes European users identifiable inside it.

That is the whole story in one line: Brussels has decided the competition upside is worth the residual re-identification risk, and it is betting that a mix of anonymisation and contract law can hold the line. Whether it can is now a question for the Commission's implementing act, not a debate.

What the Commission is actually ordering

The April 16 preliminary findings, published in case DMA.100209, spell out the mechanics in detail. Under Article 6(11) of the Digital Markets Act, Alphabet must give any qualifying online search engine in the EEA access to "search data on par with the data collected by Alphabet for the purpose of optimising its own OSE services," according to the Commission's consultation paper. That parity principle is the load-bearing clause. It means data equivalence — not a cleaned-up subset — subject to anonymisation.

The scope is broader than Google's existing offer in two ways that matter. First, delivery moves from a quarterly aggregated file to an API that gives beneficiaries only new data each call, at Google's own internal frequency. Second, eligibility extends to "AI chatbots with online search engine functionalities," pulling OpenAI and Perplexity into the framework as data beneficiaries rather than merely as complainants. The Commission press release states plainly that the final decision must be adopted within six months of the January 27 opening — meaning July 27.

Executive Vice-President Teresa Ribera's framing in that release is unambiguous:

"Data is a key input for online search and for developing new services, including AI. Access to this data should not be restricted in ways that could harm competition. In fast-moving markets, small changes can quickly have a big impact."

The reference to AI is not decorative. It is why the file has been accelerated.

The scale problem Article 6(11) was written to solve

Google's dominance in Europe is not marginal. According to a December 2025 European Parliament briefing on European software dependencies, Google Search "exceeds 89% of web search" in the EU. A separate EPRS note on search in the AI era puts Bing at "just around 4%" and observes that roughly 60% of informational queries on Google now surface an AI Overview at the top of the results page.

Behavioural remedies have not moved that number. The 2025 study "Competition and Defaults in Online Search" in the American Economic Journal: Microeconomics found that the EEA choice-screen intervention shifted Google's share by "less than 1 percentage point," while comparable interventions in Russia and Turkey moved it more than 10 points. The EU's conclusion, essentially, is that consent screens do not work because users cannot judge search quality without scale, and scale is what Google monopolises. Article 6(11) attacks the input side of the equation instead.

Bruegel researcher Bertin Martens argued in a 2023 working paper that asymmetric data sharing under Article 6(11) could increase competition but "may also reduce scale and user welfare" if the largest engine's data quality degrades faster than rivals' improves — an ambiguity the Commission's parity-based design deliberately ignores. Martens' own recommendation was to focus the shared data on rare, long-tail queries, precisely where sub-scale engines struggle. The Commission has gone the opposite direction: it wants the full feed.

Where Google's compliance falls short today

Google has been sharing search data with rivals under its European Search Dataset Licensing Program since March 2024. The mechanics were disclosed in a May 28, 2025 status report filed in the parallel US antitrust case before Judge Amit Mehta. For each distinct query, Google discloses the raw query string, the EEA country, device type, quarterly query count, result URLs, impression and click counts, and average rank — but only for queries that pass a "k-threshold" of 30 signed-in users over 13 months and an "m-threshold" of five users per query-result-device-country combination per quarter.

The Commission's problem with that regime is not primarily the anonymisation floors. It is the latency and eligibility gates. Aggregating data over a quarter and releasing it a quarter later means Ecosia and Qwant are always six months behind Google's own ranking systems — an eternity when generative AI reshapes user query patterns weekly. Reserving the dataset to search engines narrowly defined excluded the chatbots that increasingly are the competitive threat. And the Bruegel-linked research note on Article 6(7), the parallel Android interoperability specification, argues that AI competition is now the decisive front — "a market that tips towards Google could extend Google's advantage fast and prove hard to reverse."

The April draft closes both gaps. It also formalises the parity principle: Google cannot degrade what rivals receive without degrading what its own product teams see. That is the single most consequential line in the document.

The privacy problem, honestly stated

Search queries are dangerous data. The Commission's own text acknowledges "rare words and combination of words" and metadata like device type as re-identification vectors, per its proposed measures. Judge Mehta, ruling on the US remedy in September 2025, framed the same risk in one sentence quoted by NPR: "Think of a search query from a user in a small town regarding a rare health condition. Even if the user's name is not included in the data, context could reveal their identity."

A June 2025 Scientific Reports study on re-identification risk in anonymised datasets found that k-anonymity at k=3 leaves "critical" residual risk, with meaningful protection only around k≥11 — and Google's DMA program already sits at k=30. That should reassure. But the same paper flags a subtler problem: anonymisation regimes that rely on "the perfect fulfillment of the three re-identification criteria — singling out, inference and linkability" are "too restrictive" to produce useful data at all. The Commission is trying to escape that trilemma with a hybrid: technical measures to reduce the risk to "residual," then contractual measures — a re-identification ban, a linkage prohibition, a 13-month retention cap, no onward sharing — to reduce it further to "insignificant." This is essentially what Mark MacCarthy of Brookings recommended for the US remedy last summer, and it is what Google's own regulatory VP Lee-Anne Mulholland has warned against most publicly: that "in the hands of a different company without strong security practices, bad actors could access them to identify you and your search history."

Google's argument is self-interested but not wrong. The EU's answer is that a private licensing program managed by the incumbent will never produce sufficient contestability, and that the residual risk is manageable under GDPR-DMA joint guidelines the Commission and the European Data Protection Board have already issued. It is a policy judgement, not a technical proof.

Who wins, who loses

The immediate winners are the two AI firms named in the file only obliquely — OpenAI and Perplexity — and the small European search brands that have lobbied for this outcome for two years. A September 24, 2025 meeting record between OpenAI and the cabinet of EVP Ribera notes that OpenAI representatives "emphasised the need for continued vigilance and timely action by regulatory agencies, to avoid the lock-in of customers by large platforms" and that "access to key data is essential for effective competition." That message landed. Ecosia's chief operating officer Wolfgang Oels, in a November 2025 IMCO presentation, told MEPs the Commission had "decided to not enforce existing laws." July 27 is his answer.

The loser is not principally Google's search revenue in Europe, which will remain dominated by advertising the DMA barely touches. It is Google's AI moat. If Perplexity and Mistral can ground their models on the same fresh query-click signal Google feeds into Gemini, the informational edge that justifies AI Overviews narrows. That is why the file was fast-tracked in parallel with the Article 6(7) Android AI-assistant specification, whose final decision falls on the same July 27 deadline, per the Commission's second consultation.

There is also a strategic loser Brussels does not name. A CSIS analysis of the DMA rollout warns that provisions requiring platforms to hand data to third parties "can enable U.S. rivals, including from China and Russia, to access sensitive user data and even trade secrets." The Commission's eligibility filter — beneficiaries must operate a search engine "in the EU and in the EEA" and demonstrate legitimate use — is meant to answer that concern. Whether it does depends on how tightly it is enforced.

Diplomat View

The July 27 order will be adopted. The Commission has already invested too much political capital and legal reasoning to walk it back over a consultation that closed on May 1. The falsifiable call is narrower: within 12 months of the implementing act taking effect, at least one non-Google AI search product available in the EU will materially close the freshness gap on informational queries — measurable as ranking overlap with Google on rare, time-sensitive terms. If that does not happen, Article 6(11) will have failed on its own terms and the Commission will be back at the drawing board with Article 6(7) as its main lever. The forecast changes if a European data protection authority — most likely the Irish DPC or the French CNIL — issues a binding opinion against the Commission's anonymisation package, forcing the file back into GDPR-DMA arbitration. That is the single event that could push the deadline past 2026.

What to watch next

• July 27, 2026 — Commission's statutory deadline to adopt the binding implementing act on Article 6(11) and the parallel Android AI interoperability specification under Article 6(7).
• Third quarter 2026 — first API access requests from AI chatbot providers; Google is likely to challenge eligibility determinations at the General Court.
• Autumn 2026 — expected opinion from the European Data Protection Board on the anonymisation package, which either hardens the regime or reopens it.

The Bottom Line

The EU has decided that letting Google share search data with rivals under its own terms was cosmetic compliance, and that only a Commission-drawn implementing act — mandating API-parity access, five-year duration, and eligibility for AI chatbots — can dent an 89% market share the choice screens never did. The privacy trade-off is real but manageable through a hybrid of technical anonymisation and contractual bans on re-identification. The decisive question is not whether Google shares the data — that is now a July 27 formality — but whether the resulting parity feed is fresh enough to let a European or AI-native rival build a search product Europeans actually switch to.