EU sets Google rules on Android AI access and search data sharing

The European Commission on Thursday issued two Digital Markets Act specification decisions requiring Alphabet's Google to open parts of Android and search to competitors. No fine was announced: the Commission said the measures define Google's obligations as a DMA gatekeeper rather than determine whether the company has violated the law.

The orders are operationally significant for search engines, AI assistant developers and Android device makers because they set dates and conditions for access. Google must comply with the search data specifications from January 2027 and with the Android AI interoperability requirements from July 2027, unless its legal rights of defense or judicial review alter the outcome.

Android assistants get more access

Under the Android decision, the Commission said rival AI assistant providers must be able to integrate more fully with Android devices. That includes the ability for users to activate a preferred assistant by voice instead of Google's Gemini and to let that assistant perform actions inside apps on a user's behalf.

The Commission's position is that competing assistants currently have limited access to Android functions that matter for distribution and usefulness. The decision is meant to make Android less tightly coupled to Google's own AI assistant as AI becomes a default interface on smartphones.

Google objected. Kent Walker, president of global affairs at Google and Alphabet, said the decisions could weaken privacy and security protections for Europeans. On the Android portion, Walker argued that AI assistants already access Android capabilities where device makers allow it, and said the EU approach could give outside apps powerful device permissions without original equipment manufacturer safeguards.

The Commission said Google and device makers will not lose all control over implementation. According to the Commission, Google may apply objective and non-discriminatory eligibility rules for sensitive functions, including standards related to privacy, security and integrity.

Search data must be shared with restrictions

The second decision requires Google to provide certain search data to eligible rival search providers, including services using AI chatbots, so they can improve their own products. The Commission said earlier attempts by Google to open access had not been effective.

The Commission said the data sharing is subject to anonymisation and is intended to cover data Google uses to improve its own search service. Access is not open-ended. The Commission said recipients must have verified investment plans to improve online search, may use the data only for that purpose, may not combine it with other datasets, and may not pass it to third parties.

The Commission also described technical limits intended to reduce privacy risk. Those include suppressing records that contain rare items such as usernames, passwords, addresses or bank account information, generalising metadata, grouping users into cohorts of at least 1,000 people with similar geographic and device characteristics, and removing direct and indirect identifiers.

Recipients would need independent audits before gaining access and annual audits afterward. The measures will also be reviewed every two years, according to the Commission. Google may assess whether sharing data with a specific third party would create serious cybersecurity or data protection risks before handing it over.

Google said Europeans' private searches could be exposed to unfamiliar companies without adequate anonymisation or user consent, and warned of risks to business secrets and national security. The company also said the specifications rely on pseudonymisation rather than full anonymisation and raised concern that AI companies such as OpenAI could use search data to train models, although the Commission's conditions restrict how recipients may use the data.

The Chamber of Progress, a tech industry group funded in part by Google, also criticised the decision. Kay Jebelli, the group's vice president for Europe, said the Commission is relying too much on contractual restrictions and compared that approach to risks exposed by the Cambridge Analytica scandal. He said services could be withdrawn while legal challenges proceed.

This story draws on original reporting from The Register.