Two Orders, One Fight Over What 'Anonymized' Means
On 16 July 2026, the European Commission issued binding specification decisions ordering Google to open two of its most defensible moats. Under Article 6(11) of the Digital Markets Act, Google must give rival search engines and AI chatbots access to anonymized Google Search ranking, query, click, and view data on "fair, reasonable and non-discriminatory" (FRAND) terms, with sharing due to start in January 2027. Under Article 6(7), Google must give competing AI assistants the same access to Android system features that Gemini enjoys — voice-activation parity, in-app actions, and suggestion surfaces in messaging apps — with that deadline set for July 2027 (Commission decision notice; Silicon Republic).
These are not the Commission's opening moves. It launched both specification proceedings on 27 January 2026, giving itself six months to conclude and a self-imposed three-month window to share preliminary findings with Google before finalizing terms (Commission proceedings notice, 27 Jan 2026). That six-month process is exactly the kind of iterative, evidence-gathering enforcement the DMA was designed to enable — a real improvement over one-shot antitrust litigation that takes a decade to resolve nothing.
The Case for the Order
The steelman here is genuinely strong. Search is a data-scale business: ranking quality improves with query volume, and Google has amassed volumes no rival can replicate independently. A search engine that can never see click-through or ranking signal at Google's scale is permanently locked out of quality parity, no matter how good its algorithm is — that's a structural barrier to entry, not a competitive outcome earned on the merits. The Commission's own review of Google's prior data-sharing proposals found the company stripping "between 90pc and 100pc of unique search queries" from shared datasets, per reporting cited in coverage of the decision — a redaction rate that would gut the data's competitive value entirely if left unaddressed. On Android, letting Google's own assistant answer "Hey Google" while blocking rivals from equivalent voice activation is a plausible self-preferencing lock-in, the same theory of harm that underpinned the DMA's default-app and choice-screen provisions in the first place.
Where the Order Overreaches
But Google's objection is not simply reflexive. Kent Walker, the company's president of global affairs, said the decisions "risk weakening privacy and security safeguards for Europeans," warning that private searches could be exposed to unfamiliar third parties without adequate anonymization and without users' knowledge or consent (Daily Newsfront). That is not merely a competitiveness complaint dressed up as a privacy one. Search queries are among the most re-identifying categories of personal data that exist — a handful of distinctive queries can single out an individual even after names and device IDs are stripped, a risk the EU's own privacy regulators have spent years formalizing. The European Data Protection Board's anonymization framework requires a dataset to pass three cumulative tests — it cannot be used to single out an individual, cannot be linked to other records, and cannot support inference about the person — before it can be called anonymized rather than merely pseudonymized, and the EDPB itself now runs a joint framework with the Commission specifically because DMA data-sharing mandates and GDPR anonymization standards were pulling in different directions (EDPB–Commission joint guidelines notice).
That tension is the real story here, and it is not one the Commission has fully resolved by fiat. The July 16 decision describes a "multi-layered" anonymization method built with input from internal and external privacy experts, but multi-layered is a design description, not a guarantee. The EDPB's own guidance acknowledges anonymization techniques can leave residual re-identification risk depending on what tools a recipient holds — and under this order, the recipients are not one trusted party but an open set of competing search engines and AI chatbot operators, each free to combine the shared data with their own logs. Widening the number of parties holding a dataset is generally understood to increase re-identification risk, not hold it constant; the Commission's decision doesn't explain why FRAND access terms should be expected to fully offset that dynamic rather than just constrain price and non-discrimination.
The Better Fix Was Already on the Table
The proportionate response was not to abandon interoperability — Article 6(7) and 6(11) obligations are lawful and, on Android, largely reasonable — but to sequence search-data sharing behind a completed, binding anonymization standard rather than a parallel-track one still being finalized between the Commission and EDPB. Ordering compliance by January 2027 while the joint DMA-GDPR guidelines remain in a consultation-to-adoption pipeline inverts the order operations should run in: settle what "anonymized" legally means first, then mandate the sharing. Regulators do not need to choose between competition and privacy on this file; they need to stop treating the two workstreams as separable when the data at issue is exactly the kind where they aren't.