Google warns EU's DMA rules could expose user data and boost fraud

The European Commission is set to announce new regulations for Google next month under the Digital Markets Act (DMA), which designates Google as a gatekeeper with over 90% of web search market share. Two key proposals are at stake: first, regulators want to end Gemini's exclusive integration on Android, forcing Google to let users install rival AI assistants with similar system-level access to files, screen content, and voice interactions. Second, Google would have to share anonymized search data—including query content, rankings, and click rates—with competitors at a granularity never before provided.

Google's VP of security engineering, Heather Adkins, told Wired that these changes could lead to a "significant increase in fraud in the EU" within weeks of implementation. She argued that opening Android to unknown AI services could allow bad actors to install malicious assistants that steal data or manipulate user experiences. On data sharing, Google's security team demonstrated it can de-anonymize supposedly anonymous search data in just two hours using linkage attacks, and that modern AI makes such attacks easier. While Google regularly shares anonymized data with third parties of its choosing, it claims competitors lack the security infrastructure to protect sensitive datasets, raising the question of whether Google's privacy concerns are genuine or a tactic to preserve its monopoly.