EU orders Google to share search data with rivals in test of digital competition rules

The European Union has ordered Google to share a tightly controlled version of the data generated by its search users with eligible competitors, turning a largely untested provision of Europe’s digital rulebook into a concrete challenge to the company’s command of online discovery.

The European Commission adopted the binding measures on 16 July under Article 6(11) of the Digital Markets Act, or DMA. That provision requires designated search gatekeepers to provide rival search engines with anonymised ranking, query, click and view data from free and paid searches on fair, reasonable and non-discriminatory terms. Independent reports by Reuters, the Associated Press, AFP and Search Engine Land said sharing is due to begin in January 2027.

The decision is not a finding that Google infringed the law and does not itself impose a fine. Instead, it specifies what Alphabet, Google’s parent, must do to comply. Its practical importance will depend on whether rivals can turn the information into better products without compromising privacy—and whether Europeans then choose to use them.

What rivals can receive

The dataset is intended to give competitors access to categories of information that Google collects at a scale they cannot readily reproduce. Subject to anonymisation, it includes queries and modifications to them; metadata such as language and device type; URLs and visual elements displayed on results pages; interactions including clicks and returns to the results page; and information about where and how prominently a result appeared.

Google does not have to disclose its search algorithms or underlying technology. Recipients may use the data to improve query understanding, crawling, indexing, retrieval and ranking, or to strengthen the search and grounding functions of an AI chatbot. They may not use it to train general-purpose AI models, build consumer profiles, improve unrelated advertising services or systematically reproduce Google’s results.

Access is not open to any company that asks. Eligible recipients must provide a genuine online search service in the EU. An established applicant generally needs a two-year operating record; a company founded less than two years ago can qualify if it has received more than €50 million in capital investment. Applicants must also have averaged at least 50,000 monthly EU users of their search service during the previous year.

AI chatbots can qualify when they provide genuine online-search functionality, even if search forms part of a broader service. Applicants subject to EU sanctions or controlled from a country presenting serious structural cybersecurity or data-protection risks can be rejected. The rules also require protected processing in the European Economic Area or safeguards providing essentially equivalent protection.

• By the end of August 2026: Alphabet must publish information on access and submit its eligibility form for Commission review.
• By September: it must make template licences and test samples available and submit cost estimates.
• By November: it must finalise the anonymised dataset and provide technical information for review.
• By January 2027: it must finalise its pricing offer and communicate it to regulators and potential recipients.

A privacy dispute at the centre

Search queries can reveal health concerns, finances, relationships and political interests, making anonymisation central to the measure’s credibility. The Commission’s model removes Google account identifiers, IP addresses, device identifiers and precise timestamps. It suppresses unusually long queries and records containing rare terms or likely identifiers such as full names, addresses, passwords and bank details.

Location and other metadata must be generalised so that each user falls within a group of at least 1,000 users sharing the same location, device type and query language. Account information and search histories are not shared. The dataset is supplied in daily batches after a delay of at least seven days, rather than as a live feed.

Recipients must keep the data in a segregated environment, cannot link it with other datasets, attempt to identify users or pass it onwards, and may retain it for no more than 13 months. Encryption, restricted access and independent audits are required. Google may assess whether a proposed recipient presents serious cybersecurity or data-protection risks, while the Commission can exempt a company on public-security grounds.

“Our decision will help smaller competitors, search engines, or AI assistants, to compete and provide that choice, while protecting the user’s privacy.” — Teresa Ribera, European Commission executive vice-president

Google disputes that the balance is safe. Kent Walker, its president of global affairs, said the decisions risked “undermining vital privacy and security guardrails for millions of Europeans”. The company separately argued that private searches could reach unfamiliar companies without adequate anonymisation or users’ knowledge and consent.

The Commission said the multilayered approach was developed with privacy experts and follows draft joint guidance prepared with the European Data Protection Board. It can revisit the measures after new technical evidence or independent evaluation, and a review is foreseen every two years.

What it could mean in Luxembourg

The measure creates no separate Luxembourg scheme. Residents and businesses are covered because the obligation applies across the EU, and potential recipients may request data relating to specified member states or languages. That could help challengers refine services for particular markets, although there is no assurance that Luxembourg’s relatively small, multilingual search environment will become an early commercial priority.

For local retailers, service companies and publishers, the immediate effect is limited: Google remains the principal route through which many customers discover websites, products and information. If rival engines and search-enabled AI services use the dataset successfully, businesses could eventually gain additional sources of traffic and stronger competition in search advertising. They may also face a more fragmented discovery market requiring content to work across conventional results and AI-generated answers.

Consumers could gain more credible choices, including privacy-focused engines or AI tools with fresher retrieval systems. But the order does not change default habits by itself, guarantee that rivals will buy the data or ensure that access prices will be affordable. Search Engine Land noted that alternatives already exist and that changing user behaviour may prove harder than improving technology.

That makes the decision a test of the DMA’s central promise. Brussels has identified data accumulated at scale as a barrier to entry and has designed a route around it. The result will be measured not by the publication of another compliance page, but by whether competitors improve, businesses see meaningful new routes to customers and users move—or whether Google’s position remains largely untouched.