The European Commission has set out two sets of binding specification measures to Google under the Digital Services Act (DSA).
The aim of the first set of measures is to make sure that Google’s competitor AI services can compete with its own AI services, such as Gemini, by having equal access to features on Google’s Android services. The second gives third-party search engines access to search data that only Google Search can collect at scale.
On Android phones, competitors’ AI assistants currently have only restricted access to key functionalities of Google’s Android operating system. Therefore, these alternative AI assistants are not competing equally with Google’s own services that have full access. The third-party assistants are limited in how they can offer their innovative services, and the Commission says this makes them less attractive to the 60% of EU users who have Android devices.
The Commission’s decision is designed to make sure that users can activate their preferred AI assistant via voice commands and will be able to use third-party assistants to perform actions in apps on their behalf. The measures incorporate safeguards aimed at ensuring the privacy of users in addition to ensuring device integrity and security are protected.
The Commission’s second decision sets out how Google should share search data with third-party search engines. The decision provides guidance on several aspects which have made Google’s data sharing ineffective up until now. For example, it specifies that AI chatbots offering search functionalities are eligible to receive shared data, and that Google should share the same data that it collects to optimise its own search services, subject to anonymisation.
The decision is aimed at ensuring anonymisation of search data and sets out a multi-layered method to anonymise the shared data. This method has been developed in close collaboration with internal and external privacy experts and in line with the draft Joint Guidelines on interplay of the DMA and GDPR by the Commission and European Data Protection Board (EDPB). The decision allows Google to assess whether sharing data with specific third parties poses cyber security and data protection risks before sharing said data.
The measures also include a formula to calculate the price of shared data, and a transparent process for accessing it. These decisions are legally binding and Google will be required to implement these measures under the conditions and timelines included in the decisions. Google must also start sharing search data with eligible third-party search engine providers from January 2027.
