Type something into Google. A question about a lump, a debt, a divorce, a political party you would rather not be seen supporting. Under the European Commission’s new interpretation of Article 6(11) of the Digital Markets Act (DMA), that query will shortly be shared with rival search engines and AI chatbots. Under the General Data Protection Regulation, it cannot be, at least not in any form that would be of use to them. The Commission has until July 27, 2026 to decide which of its own regulations Google is supposed to obey.
This is one of two DMA specification proceedings the Commission has opened against Google. Article 6(11), on search data sharing, is now on the table in preliminary findings. Article 6(7), on interoperability between Android’s deepest system features and third-party AI services, is not, even though the same July 27 deadline applies. Interested parties had until May 1 to respond. Half a file, delivered against a deadline that applies to both.
The competition case behind the proceedings is legitimate. Search signals matter to rivals, and they matter increasingly to AI services that depend on them to function. “Access to this data should not be restricted in ways that could harm competition,” said Teresa Ribera, Executive Vice-President of the European Commission and Commissioner for Competition. She is not wrong.
The question is whether what the Commission has drafted so far amounts to a compliance framework or a liability trap. On the evidence available, the answer leans towards the second. Credit where due: the findings specify what data Google must share, in what scope, and at what frequency. Rivals will know what they are asking for. Google will know what it has to deliver. What neither will know is how to do it lawfully.
The European Commission has not specified which anonymization standard satisfies the DMA’s utility requirement and the GDPR’s re-identification threshold at the same time. This is the single most consequential gap in the file. The GDPR requires anonymization rigorous enough to prevent the reconstruction of individual profiles from sequential queries. The DMA requires data still useful enough to improve a rival’s ranking algorithm.
Evidence cited in U.S. vs. Google suggests Google’s own anonymization proposal excluded about 99 percent of queries, leaving the shared dataset dominated by common searches already visible through public signals. Without a binding standard, Google faces GDPR enforcement if it shares too much and DMA non-compliance proceedings if it shares too little. Call it what it is: a liability trap wearing a compliance label.
The Commission has also said nothing meaningful about the other end of the pipe. Google must share with eligible business users on fair, reasonable and non-discriminatory terms. It is not told how to verify that those recipients meet a minimum privacy baseline. It is not given due diligence powers. It is not given a remedy if a recipient quietly breaches purpose limitations months after the data has walked out the door. Draft EDPB-Commission guidelines flagged the problem and proposed implementing acts to cover it. Those have not been adopted. Until they are, the Commission is requiring data sharing at scale before defining the safeguards that would make it safe. The users whose queries are at stake, as usual, have no say in the matter.
And then there is the file that is not even on the table yet. Article 6(7), on interoperability between Android system features and third-party AI, is arguably the more consequential of the two proceedings. Its scope includes neural processing units, system microphones, always-on listening, screen-reading, and sensor access. “Equally effective access” to those features, handed to any qualifying third party without security preconditions, is impossible to reconcile with the Cyber Resilience Act’s secure-by-design principle. The 27 July deadline applies to that file too. The Commission has left itself little time to finish the harder half of its own regulatory homework.
A workable alternative already exists. A tiered-access framework, set out in European Policy Information Center EPiCENTER’s recent briefing, The DMA Compliance Trap, would condition access on demonstrated safeguards rather than mandate it wholesale. Standard app-level APIs would remain open to any third party on ordinary developer registration.
Deep system access, covering microphones, screen-reading, neural processing units and sensors, would require independent certification under the Cyber Resilience Act. Access to search signals would require a completed Data Protection Impact Assessment and auditable retention controls. The precedent is not radical: open banking under PSD2 already works this way. Access proportionate to safeguards is settled European regulatory practice almost everywhere except, apparently, the DMA.
Stakeholders have spent two years pointing out that the DMA, the GDPR and the CRA cannot all be satisfied at once. The public consultation closed on May 1. It will either move the Commission towards a more balanced outcome, or it will not. A specification that will set the global precedent for AI platform access for the next decade deserves more than the current draft. If the consultation did not deliver, we already know what the July decision will say. It will declare another decisive step towards a competitive digital single market, and leave Europe’s companies to work out the contradictions among themselves, and Europe’s users to wonder who now has their search history.