Google Security Chiefs Warn EU Data-Sharing Rules Could Expose Billions to Hackers

Google Sounds the Alarm on EU Data Rules

Google's most senior security and privacy leaders have warned that proposed European Union measures could expose billions of users to hacking and fraud. The warnings, reported by WIRED, target the European Commission's specification proceedings under the Digital Markets Act (DMA), which the Commission opened in January 2026.

The measures would force Google to hand rival search engines and AI chatbot providers access to anonymised ranking, query, click, and view data from Google Search. They would also require Google to grant competing AI services deeper interoperability with Android.

What the Commission Is Demanding

After issuing preliminary findings to Google on 16 April, the Commission specified measures requiring the company to share granular search data at the individual-record level, on a daily basis, via an automated API. The data would cover what users search for, what they click, how they refine queries, device identifiers, and coarse location data. Recipients would include AI chatbots with integrated search, such as those rivalling Google's own Gemini assistant.

Under Article 6(7) of the DMA, Google must also give competing AI services equally effective access to Android features including wake-word activation, contextual data, and the ability to act within apps, ordering food, sending an email, or sharing a photo on a user's behalf.

The Security Objections

Google argues the breadth of the data sharing introduces cybersecurity vulnerabilities, warning that hackers could reconstruct sensitive information from supposedly anonymised datasets and that smaller recipients would become attractive targets. A top Google scientist made similar warnings in a Reuters report in May.

Privacy researchers are split. Cybersecurity expert Lukasz Olejnik warned in April that the Commission's sanitisation scheme, based on entity allowlists and query-length thresholds, could still release unique queries made only once. The Centre for Cybersecurity Policy and Law and the Progress Chamber raised similar concerns. Yet DuckDuckGo says the proposal already reduces reidentification risk to an insignificant level, and researchers at the Knight-Georgetown Institute call the safeguards robust enough to support competition.

What Happens Next

The clash reflects growing tension between the EU's competition goals and security considerations. A US federal court last year ordered limited search-data sharing in the antitrust case against Google, but the EU's approach is broader, covering more data types and more recipients. The Commission is expected to adopt a binding final decision by 27 July 2026.