Google Faces Potential Data Security Risks Under Proposed EU Competition Rules

LoaderSave StorySave this storyCommentLoaderSave StorySave this storyGoogle’s top privacy and security staff have warned that plans in Europe, designed to get it to open up its search data and Android operating system to competitors, could lead to people’s search queries being hacked and an increase in cybercrime across the content, according to multiple interviews and documents shared with WIRED.

Mountain View’s alarm comes as European Commission officials are set to make final decisions next month in two cases, around Google Search and Android interoperability, under the European Union’s landmark Digital Markets Act competition rules. The rules, which were first adopted at the end of 2022, are designed to force open Big Tech companies that dominate markets, make it easier for others to compete, and reduce reliance on a handful of firms.

Heather Adkins, Google’s vice president of security engineering and a founding member of its security team, says the company has concerns around the proposed changes for both Search and Android. In April, the European Commission published initial details, plus now-closed public consultations, on how Google should open up its search data—sharing anonymized search data with rivals—and allowing other AI services to have more access to the Android operating system.

“If implemented as described today, I think within a short period of time on Android, we’d see a significant increase in fraud in the EU,” Adkins tells WIRED. “The fraudsters are creative and informed. Past implementation [date], I would give it maybe weeks before we began to see an increase in fraud in Europe.”

Meanwhile, Adkins also claims the proposed changes to Google Search could result in people’s search queries being de-anonymized by bad actors and search data shared with small companies being a target for criminal hackers.

The European Commission’s proposals are complex, impact technical systems with billions of users, and are steeped in the continent’s competition laws. As European officials’ deadline of July 27 for announcing its final decisions approaches, Google has been increasingly vocal in its opposition to the parts of the plans it does not believe will work. Some Google competitors, who could benefit from accessing the data, say the plans have less privacy and security impacts than has been suggested.

These competitors, independent researchers, and academics who have responded to the consultations have pointed out how Europe’s plans could work and also potential flaws with them. Rebuttals and counter rebuttals have been issued as competition law collides with privacy impacts. Spokespeople for the European Commission acknowledged WIRED’s request for comment but did not respond to questions about Google’s concerns.

Since the end of 2022, the Digital Markets Act has allowed European officials to designate tech companies that have large market shares as “gatekeepers” and use the rules to get them to open up their systems and data to competitors. Google parent company Alphabet, Amazon, Apple, Booking, ByteDance, Meta, and Microsoft are all considered gatekeepers, with their products—from LinkedIn and TikTok to Instagram and YouTube—being subject to the rules.

Google’s search business, which is estimated to make up 90 percent of the worldwide search market, is, unsurprisingly, the only search engine that includes the rules. Under the DMA, Google already shares some data with search engine competitors; however, the planned changes alter how this would work.

The plans broadly say Google should provide online search engines with access to search data “on par” with the data that Google itself collects, including “any query input” people enter into Google Search plus some other metadata. Put simply: what people type into Google. It will also have to share click data and the ranking results of search queries. “This is a unique data set which only Google has had access to for many, many years, and there’s not a straightforward way for any other competitor to build or obtain access to something similar,” says Alissa Cooper, the executive director of the tech policy research hub the Knight-Georgetown Institute.

These sharing requirements, according to the EU’s proposals, are protected by anonymization methods to protect individuals’ search queries being linked back to them. Those measures will be accompanied with contracts between Google and search competitors that it shares data with, broadly saying they cannot try to reidentify users, link the search data with other information, and that information must be shared securely.

Google, however, claims in one document seen by WIRED that the proposed anonymization techniques contain “deep weaknesses” and it would have to release search data at “much higher levels of granularity” than it currently does. Google staff say they have proved the data can be reidentified, and if this is the case, “it is not anonymous in the first place.”

“Privacy engineers have proved that this data can be easily reidentified. If data can be reidentified, it is not anonymous in the first place. And the law specifically requires it to be anonymized,” says David Lewis, Google’s director of the company’s privacy advisory for Europe, the Middle East, and Africa. “Whether Google has a vested interest or not is irrelevant to the question of whether millions of people's most private questions may end up with someone they don't know and never expected would see their searches.”

The company previously said, according to Reuters’ reporting, that its security red team could reidentify search users based on the data in “less than two hours.” The specific details of those tests have not been published.

“Anonymization is hard, and you’ve got to have the right technical experts at the table to come up with the solutions,” says Google’s Adkins, who suggests there is a “middle ground” to be found. Adkins says large language models could also be an “ideal tool” for helping to de-anonymize data if it falls into malicious hands and adds that the company’s threat modeling also includes the data its shares being a target for hackers.