Google warns EU data-sharing rules could expose users' search data to hackers

Google's top privacy and security executives have warned that proposed European Union rules requiring the company to share more of its search data and open up parts of the Android operating system could expose users to greater privacy and cybersecurity risks.

The concerns come as European Commission officials prepare to make final decisions next month on two cases involving Google Search and Android interoperability under the European Union's Digital Markets Act (DMA).

Introduced at the end of 2022, the DMA aims to curb the dominance of major technology companies by requiring designated "gatekeepers" to open up their platforms and services, making it easier for smaller competitors to enter the market and reducing reliance on a handful of firms.

As part of the proposed measures, Google could be required to share significantly more search data with rival search engines, including anonymised search queries, click data and search rankings, to promote greater competition.

More from Tech

Google, however, argues that the proposed safeguards do not go far enough to protect user privacy. The company claims the anonymisation methods contain "deep weaknesses" and warns that the shared data could potentially be reidentified, exposing sensitive search histories. It has also cautioned that once the data leaves Google's infrastructure, it could become more vulnerable to cyberattacks or misuse, particularly if smaller companies receiving the information lack robust security measures.

The proposals have sparked a wider debate among privacy experts. While some researchers and rival search providers believe the European Commission's framework includes sufficient safeguards to protect user data, others argue that the risks of reidentification should be more thoroughly assessed before large-scale search data sharing is implemented.

The European Commission is expected to take these concerns into account before issuing its final decisions on the proposed measures.