Google's top privacy and security staff have warned that plans in Europe, designed to open up its search data and Android operating system to competitors, could lead to people's search queries being hacked and an increase in cybercrime, according to multiple interviews and documents shared with WIRED.
Google's Security Concerns
Heather Adkins, Google's vice president of security engineering and a founding member of its security team, says the company has concerns around the proposed changes for both Search and Android. In April, the European Commission published initial details on how Google should open up its search data—sharing anonymized search data with rivals—and allowing other AI services to have more access to the Android operating system.
"If implemented as described today, I think within a short period of time on Android, we'd see a significant increase in fraud in the EU," Adkins tells WIRED. "The fraudsters are creative and informed. Past implementation [date], I would give it maybe weeks before we began to see an increase in fraud in Europe."
Adkins also claims the proposed changes to Google Search could result in people's search queries being de-anonymized by bad actors and search data shared with small companies being a target for criminal hackers.
The Digital Markets Act Proposals
The European Commission's proposals are complex, impact technical systems with billions of users, and are steeped in the continent's competition laws. As European officials' deadline of July 27 for announcing its final decisions approaches, Google has been increasingly vocal in its opposition to the parts of the plans it does not believe will work. Some Google competitors, who could benefit from accessing the data, say the plans have less privacy and security impacts than has been suggested.
Since the end of 2022, the Digital Markets Act has allowed European officials to designate tech companies with large market shares as "gatekeepers" and use the rules to open up their systems and data to competitors. Google parent company Alphabet, Amazon, Apple, Booking, ByteDance, Meta, and Microsoft are all considered gatekeepers, with their products—from LinkedIn and TikTok to Instagram and YouTube—being subject to the rules.
Potential Data Exposure
Google's search business, which is estimated to make up 90 percent of the worldwide search market, is the only search engine included under the rules. Under the DMA, Google already shares some data with search engine competitors; however, the planned changes alter how this would work.
The plans broadly say Google should provide online search engines with access to search data "on par" with the data that Google itself collects, including "any query input" people enter into Google Search plus some other metadata. Put simply: what people type into Google. It will also have to share click data and the ranking results of search queries. "This is a unique data set which only Google has had access to for many, many years, and there's not a straightforward way for any other competitor to build or obtain access to something simil..." (the source text is truncated).
Competing Perspectives
These competitors, independent researchers, and academics who have responded to the consultations have pointed out how Europe's plans could work and also potential flaws with them. Rebuttals and counter rebuttals have been issued as competition law collides with privacy impacts. Spokespeople for the European Commission acknowledged WIRED's request for comment but did not respond to questions about Google's concerns.
For enterprise technology leaders who rely on Google's infrastructure, these security warnings highlight potential risks from regulatory-driven data sharing that could expose sensitive query data to new attack surfaces. The outcome of the July 27 deadline may affect how data security is managed across the digital supply chain.
Sources:
