Does Google share your search history? Only in a limited way today, but under a binding European Commission decision it must start sharing anonymised search data, covering queries, results, clicks and views, with rival search engines and AI chatbots from January 2027, and on 29 September 2026 it was reported that Google has gone to the EU's General Court to have that order annulled. The Commission adopted the decision on 16 July 2026 under the Digital Markets Act (DMA), alongside a second order opening Android features to rival AI assistants. Google's competition chief says the search order would force it to hand over "people's private search history without sufficient anonymisation". This analysis explains what the decision actually requires, who can get the data, how the court challenge works, why the January 2027 deadline still stands, and what non-compliance could cost.
Does Google share your search history? The short answer
The short answer is that Google will be legally required to share heavily processed, anonymised search records with vetted competitors, not a named user's personal history, and Google argues that the processing does not go far enough. Article 6(11) of the DMA obliges a gatekeeper to give any third-party search engine, at its request and on fair, reasonable and non-discriminatory terms, access to "ranking, query, click and view data" generated on its search engine, and it says that any query, click and view data that is personal data "shall be anonymised".
That obligation has applied to Google Search since 7 March 2024. Google's answer was a paid European Search Dataset Licensing Program, released quarterly and a quarter in arrears. The Commission's July decision records that Google's own anonymisation removed an estimated 90 to 100% of unique queries and 30 to 40% of query volume, and that only one applicant had obtained a licence, for a small sample. The Commission decided that offer was ineffective and specified, in detail, what Google must do instead.
So the honest answer for an ordinary user is this: identifiers such as account details, IP addresses and device IDs must be stripped out before anything leaves Google, rare or identifying queries are suppressed, and recipients are contractually barred from re-identification. Whether that is enough is exactly what the court case is about. Readers who followed the Irish regulator's recent €403m ruling on Google's location data will recognise the underlying tension between competition goals and data protection.
What the Commission decided on 16 July 2026
The Commission adopted a binding implementing decision under Article 8(2) of the DMA that specifies how Google must comply with its search data obligation, together with a parallel decision on Android. The search decision, Case DMA.100209, C(2026) 5091 final, is addressed to Alphabet Inc. and to Google Ireland Ltd in Dublin and was signed for the Commission by Executive Vice-President Henna Virkkunen. Google Ireland's role as an addressee is one reason the case matters to advisers in Ireland as well as Brussels.
The route to the decision was fast by EU standards. The Commission opened two sets of specification proceedings on 27 January 2026, one on Article 6(7) interoperability for AI services on Android and one on Article 6(11) search data. It sent preliminary findings and proposed measures on 16 April 2026, invited comments until 1 May and noted that the final decision had to be adopted by 27 July 2026. Article 8 of the DMA requires preliminary findings within three months and a decision within six months of opening.
Two features of specification proceedings shape everything that follows:
- They do not find a breach. The Commission stresses that specification proceedings are distinct from non-compliance investigations and "do not provide for the imposition of fines".
- They are binding. Google "is required to implement the specified measures under the conditions and timelines included in the decisions", and breaching those measures can itself be fined, as explained below.
The decision also builds in a review. Article 2 provides that the effectiveness and impact of the measures will be evaluated within two years of adoption, and the Commission said it may amend the anonymisation measures depending on market developments and independent third-party evaluation.
What search data Google must share, and what stays out
Google must share the same categories of search data it collects to optimise its own search services, subject to anonymisation, and not just the narrow quarterly extract it offered before. The Annex to the decision requires query data from every access point, naming the Google Search website, the browser omnibox in Chrome and third-party browsers, the Search widget and app, Google Assistant, Google Lens and Circle to Search, as well as ranking, click and view data for the results shown.
| Data element | Position under the 16 July 2026 decision |
|---|---|
| Query text, including modifications by users and by Google | Shared, subject to suppression of rare or identifying queries |
| Ranking and results shown on the results page | Shared, including the existence of ads and interactions with them |
| Clicks and views | Shared; dwell and hover times binned into percentile bands |
| Location | Generalised to NUTS 3 region, or country level if groups are too small |
| User identifiers, IP addresses, device IDs, signed-in status | Removed |
| Exact timestamp | Removed; the day of the query remains |
| Ad URLs | Removed |
| Follow-up queries within an AI Mode session | Removed; only the initial query is provided |
| Image queries | Replaced with a placeholder |
The mechanics matter as much as the scope. Google must share the data in daily batches with daily time stamps, at a latency as close as technically feasible to its own and "no less than 7 days", using the method it uses internally where feasible, and for up to five years from when a recipient first gets access. That is a very different product from a quarterly file that was, on the Commission's figures, about 4.5 months old on average.
How the anonymisation is supposed to work
The decision sets a multi-layered anonymisation method that the Commission says was developed with internal and external privacy experts and in line with draft joint guidelines with the European Data Protection Board. It combines technical suppression inside Google with contractual controls on the recipient.
On the technical side, the key steps in the Annex are:
- Personal data detection. Detectors identify names, addresses, phone numbers, coordinates, IBANs, card numbers and similar identifiers within queries.
- Entity allowlist and length test. Queries are filtered against an allowlist of entities used by more than 50 signed-in users in the EEA over the past 13 months, and against a language-specific length threshold, so that rare and unusually long queries drop out.
- Crowd thresholds. At least 1,000 signed-in users must share the same language, location and device values; if not, location is generalised to country level, and if that still fails the record is removed.
- Short sessions only. Related queries may be grouped into "mini-sessions" of up to three queries, tagged with a random identifier rather than a user ID.
On the contractual side, recipients may use the data only to optimise a search service, may not link it with other datasets, attempt re-identification or pass it on, and face retention limits and independent audits. Before any access, an applicant must procure a "Level 1" reasonable assurance report from an independent practitioner, with further reports later. Privacy engineers and cyber security advisers will focus on whether these layers hold up in practice, which is precisely the ground on which Google has chosen to fight.
Who can receive the data: search engines and AI chatbots
Any undertaking providing a genuine online search engine in the EU can apply, and the decision expressly says Google may not exclude AI chatbots with search functions, even where search is part of a broader service. The Commission described the eligibility of AI chatbots as one of the points that had made Google's offer "ineffective so far". Reuters reporting describes the orders as helping AI rivals such as OpenAI; the decision itself names ChatGPT, Mistral Vibe and Claude as examples of chatbots that compete with Gemini and AI Overviews, and cites Qwant and Ecosia among challenger search engines.
The Annex sets objective gates. An applicant must:
- Be established or credible. It must have provided search services in the EU for at least two consecutive years, or have been founded less than two years ago with more than €50 million of capital investment.
- Have real users. It must have had at least 50,000 monthly average users of its search service in the EU in the past year.
- Clear security screens. Google may reject an applicant subject to EU sanctions, or controlled by a third country posing a serious and structural non-technical cyber security or data protection risk.
- Protect transferred data. If data would leave the EEA, Google must be able to ensure essentially equivalent protection, whether under an adequacy decision or a GDPR transfer tool.
The transfer point links this case to the wider debate over whether the EU-US Data Privacy Framework is still valid, since many AI providers are US-based. Separately, where there are credible indications that sharing with a particular company could undermine public security, Google may ask the Commission for an individual exemption under the DMA's Article 10 procedure. For AI businesses already mapping obligations under the EU AI Act timeline, access to Google's search data is a new variable in product planning.
Price, timetable and the road to January 2027
Google may charge only a cost-based FRAND price in most cases, and it must hit a series of deadlines running from the decision's adoption on 16 July 2026. The Annex says compensation must strictly reflect Google's incremental costs of making the data available, such as preparation, dedicated storage and transmission, plus a reasonable return on capital capped at Google's weighted average cost of capital. Google may earn a margin, capped at the operating margin of its Search business, only if it shows it cannot otherwise recover efficiently incurred collection costs or where a recipient operates at very large scale; small and medium-sized enterprises are exempt from any such margin.
| Step | Deadline in the decision | Approximate date |
|---|---|---|
| Proceedings opened | Start | 27 January 2026 |
| Preliminary findings and proposed measures published | Within three months | 16 April 2026 |
| Final specification decision adopted | Within six months | 16 July 2026 |
| Public information webpage for applicants | Within 45 days | End of August 2026 |
| Template licence agreements and test samples | Within two months | Mid-September 2026 |
| Anonymised Search Dataset finalised; latency justified | Within four months | Mid-November 2026 |
| Pricing offer finalised; sharing begins | Within six months | January 2027 |
| Android AI assistant changes for users | Android decision | From July 2027 |
| Commission review of effectiveness | Within two years | By July 2028 |
Several of those early milestones fall before the court challenge was reported, so rival search providers and chatbot businesses should already be able to test Google's compliance against specific obligations. The approximate dates are calculated from the decision's own time limits.
Why Google is challenging the orders
Google's case, as presented publicly, is that the search order puts user privacy at risk and the Android order weakens device security. Oliver Bethell, Google's senior director for competition, said: "We're appealing decisions that will force us to share people's private search history without sufficient anonymisation and weaken vital security protections on Android." He added, as reported by Euronews, that "mandating we share these personal queries without adequate safeguards would cause irreversible harm to user privacy".
Nick Fox, Google's senior vice-president for knowledge and information, has made a similar point in remarks reported by Search Engine Roundtable, warning that once queries are "handed over to others, they're subject to hacking". On Android, Google argues the platform is already open to other services and that the requirements lack adequate safeguards and user consent. The companion Android decision would require rival assistants to be able to use the same 11 phone features as Gemini, including voice activation and in-app actions, according to TNW.
The Commission's position is that both decisions protect privacy and keep phones secure, that the anonymisation was designed with privacy experts, and that Google can refuse data to a company posing a serious security or privacy threat. Rivals are pushing back hard. A DuckDuckGo spokesperson told Reuters: "The anonymization framework is robust and no amount of manufactured doubt changes that. The only thing an appeal buys Google is time."
The exact pleas will only be known when a summary of each action is published in the Official Journal. Challenges of this kind typically argue that the Commission exceeded its competence, misread the obligation or acted disproportionately, and Article 8(7) of the DMA requires specified measures to be effective and "proportionate in the specific circumstances of the gatekeeper". Proportionality, in the observers' view, is the natural battleground for a privacy argument.
Which court hears the case, and how a challenge works
The case is before the General Court of the European Union in Luxembourg, the EU's second-highest court, as an action for annulment. Under Article 263 of the Treaty on the Functioning of the European Union, an addressee can seek annulment on grounds of lack of competence, infringement of an essential procedural requirement, infringement of the Treaties or any rule of law relating to their application, or misuse of powers. The action must be brought within two months of publication or notification, which fits a challenge to a July decision surfacing at the end of September.
From there, the case moves through written pleadings, a possible hearing and a judgment, and a losing party can appeal on points of law to the Court of Justice. DMA litigation is not quick: Apple's challenge to its gatekeeper designation, Case T-1080/23, was filed in November 2023 and decided in July 2026. Third parties with an interest, such as rival search engines or privacy groups, can apply to intervene, as the United States has done in X's challenge to its €120m Digital Services Act fine. Litigation teams in Luxembourg and specialists in EU dispute resolution and litigation will watch the interventions closely, because who joins the case often signals how contested the evidence will be.
One distinction is worth stressing. Because the July decisions impose no fine, the General Court's unlimited jurisdiction over penalties under Article 45 of the DMA is not engaged. The court reviews legality; it cannot rewrite the anonymisation thresholds, only annul the decision in whole or in part.
Does the appeal stop the January 2027 deadline?
No, not unless the court orders otherwise. Article 278 of the Treaty is explicit: "Actions brought before the Court of Justice of the European Union shall not have suspensory effect." The court may suspend application of the contested act "if it considers that circumstances so require", and Article 279 lets it prescribe any necessary interim measures.
In practice, that means Google remains bound to share search data from January 2027 and to deliver the Android changes from July 2027 while the case runs, unless it applies for, and obtains, interim relief. Reports on the filing did not say whether Google has made such an application. Interim relief in EU courts generally requires the applicant to show urgency, meaning serious and irreparable harm, together with a case that is not unfounded, and the court weighs the competing interests. Google's language about "irreversible harm" to privacy is, commentators note, the vocabulary of that test, since shared data cannot easily be recalled if the decision is later annulled.
For rivals, the practical message is to keep preparing applications on the decision's timetable. For Google's compliance teams, the message is that the deadlines are live obligations, backed by the penalty regime below.
What happens if Google does not comply: DMA fines and penalties
Failing to implement the specified measures is itself a fineable breach of the DMA, even though the specification decision imposed no fine. Article 30(1)(b) allows fines of up to 10% of total worldwide turnover where a gatekeeper intentionally or negligently fails to comply with "measures specified by the Commission in a decision adopted pursuant to Article 8(2)". Article 31(1)(a) adds periodic penalty payments of up to 5% of average daily worldwide turnover per day to compel compliance with those measures.
| DMA tool | Legal basis | Maximum |
|---|---|---|
| Specification decision (as in July 2026) | Article 8(2) | No fine; binding measures and deadlines |
| Fine for breaching obligations or specified measures | Article 30(1) | 10% of total worldwide turnover in the preceding year |
| Fine for repeat infringement | Article 30(2) | 20% where the same or similar breach was found in the previous eight years |
| Periodic penalty payments | Article 31(1) | 5% of average daily worldwide turnover per day |
| Reopening of the specification | Article 8(9) | Possible if facts change, information was wrong or measures are ineffective |
Google already knows the regime is used. On 23 July 2026, a week after the specification decisions, the Commission fined Google €890 million in two DMA non-compliance decisions: €460 million for self-preferencing its own services, such as shopping, hotels, transport and sports results, in Google Search, and €430 million for Google Play anti-steering restrictions. It gave Google 60 days to comply or risk periodic penalty payments of up to 5% of total worldwide turnover, and noted that Google may appeal. For context on how Brussels sets fine levels in other regimes, see our explainers on how EU cartel fines are calculated and on the €550m AliExpress DSA fine.
Where this sits in the wider DMA and US picture
Google's appeal follows a pattern: the first specification decisions under the DMA are being tested in court, and US antitrust law is pushing Google towards data sharing too. Apple challenged the Commission's March 2025 interoperability specification decision under Article 6(7) in May 2025, in Case T-359/25, which remains pending. In July 2026 the General Court upheld Apple's gatekeeper designation, a result the Commission will cite as evidence that the courts are prepared to back the DMA's structure.
Across the Atlantic, the US District Court in Washington, D.C. ordered remedies in United States v. Google in September 2025 under which, in the Department of Justice's words, "Google will have to make certain search index and user-interaction data available to certain competitors". A five-member technical committee to oversee that sharing was approved on 5 December 2025, and in July 2026 the DOJ asked the D.C. Circuit to affirm the data-sharing remedies, Courthouse News reported, while Google pursues its own appeal. That case sits alongside the separate US ad-tech remedies ruling against Google.
The politics are also visible. The Irish Times noted that the Trump administration views the DMA as discriminatory against American companies. The two systems are converging on the same remedy, access to Google's search data for rivals, but through different legal routes and with different privacy safeguards, which multinational search and AI businesses will need to reconcile.
What it means for rivals, gatekeepers and their advisers
For now, the decision is the law and the appeal is a risk to be priced in, not a reason to stand still. Practical points for in-house teams and their advisers include:
- Search engines and AI chatbot providers. Check eligibility against the two-year or €50 million test and the 50,000-user threshold, prepare for the Level 1 assurance report, and map where data would be processed.
- Data protection teams. Treat the contractual controls, including bans on linking datasets and re-identification, as core compliance obligations, and expect audits.
- Other gatekeepers. The decision shows how granular Article 8 specifications can be, down to latency, pricing formulas and user thresholds, and how quickly they can arrive.
- Litigators. Watch the Official Journal summaries of Google's pleas, any interim measures application and intervention requests.
The same companies are also dealing with consumer-protection pressure under the DSA, such as the complaints over financial scam advertising. Businesses that need help with DMA eligibility, data licensing terms or the litigation itself can find competition and antitrust advisers, technology, media and telecoms specialists and advisers in Belgium, close to the Commission, through the Corporate INTL directory. Whatever the General Court decides, the answer to "does Google share your search history" is set to change in January 2027 unless the court intervenes first.
Frequently asked questions
Does Google share your search history with other companies?
Not as a named personal history. From January 2027 a DMA decision requires Google to share anonymised search data, covering queries, results, clicks and views, with eligible rival search engines and AI chatbots. Identifiers such as IP addresses and account details must be removed, and rare or identifying queries suppressed.
Why is Google challenging the EU search data order?
Google says the order would force it to share private search history without sufficient anonymisation, causing irreversible harm to user privacy, and that the companion Android order weakens security. The Commission says both decisions protect privacy and security and were designed with privacy experts.
Which court is hearing Google's challenge?
The General Court of the European Union in Luxembourg, the EU's second-highest court. It hears actions for annulment of Commission decisions under Article 263 of the Treaty on the Functioning of the European Union. A losing party can appeal on points of law to the Court of Justice.
Does Google's appeal suspend the January 2027 deadline?
No. Under Article 278 of the Treaty, actions before the EU courts do not have suspensory effect. The court can suspend the decision or order interim measures if circumstances require, but unless it does, Google must start sharing search data from January 2027.
Can AI chatbots such as ChatGPT receive Google's search data?
Yes, if they qualify. The decision says Google must not exclude AI chatbots with search functions, provided they meet the definition of an online search engine and the eligibility criteria, including at least 50,000 monthly EU users and either two years of EU operation or over €50 million of investment.
How much will rivals pay for Google's search data?
The price must strictly reflect Google's incremental costs of making the data available plus a return capped at its weighted average cost of capital. A margin up to Google Search's operating margin is allowed only in limited cases, and small and medium-sized enterprises are exempt from it.
What are the fines if Google does not comply with the DMA?
The Commission can fine a gatekeeper up to 10% of total worldwide turnover for failing to comply with specified measures, rising to 20% for repeat infringements, and impose periodic penalty payments of up to 5% of average daily worldwide turnover per day.
Did Google pay the July 2026 DMA fines?
The Commission fined Google €890 million on 23 July 2026 for self-preferencing in Search and Google Play anti-steering rules, and gave it 60 days to comply. The Commission noted that Google may appeal. Those fines are separate from the search data specification decision, which imposed no fine.
Is the US also forcing Google to share search data?
Yes, through a different route. In September 2025 a US federal court ordered Google to make certain search index and user-interaction data available to qualified competitors in the Justice Department's search monopoly case. That ruling is on appeal, and the DOJ has asked the D.C. Circuit to affirm the data-sharing remedies.
Sources
- European Commission: Commission provides guidance to Google for AI interoperability on Android and sharing of Google Search data under the Digital Markets Act (16 July 2026)
- European Commission: Decision C(2026) 5091 final, Case DMA.100209, Alphabet, Article 6(11), with Annex (16 July 2026)
- European Commission DMA portal: Alphabet specification proceedings, sharing of Google Search data
- European Commission: Commission opens proceedings to assist Google in complying with interoperability and online search data sharing obligations (27 January 2026)
- European Commission: Commission proposes measures to Google on sharing search engine data with third parties (16 April 2026)
- European Commission: Commission fines Google €890 million for breaches of the Digital Markets Act (23 July 2026)
- Digital Markets Act, Regulation (EU) 2022/1925, Article 6 (final text)
- Digital Markets Act, Article 8 (final text)
- Digital Markets Act, Article 30: Fines (final text)
- Digital Markets Act, Article 31: Periodic penalty payments (final text)
- Digital Markets Act, Article 45: Review by the Court of Justice (final text)
- Treaty on the Functioning of the European Union, Article 263
- Treaty on the Functioning of the European Union, Article 278
- Euronews: Google appeals EU data-sharing order, warns of 'irreversible harm' (29 September 2026)
- TNW: Google takes EU to court over orders to share search data (29 September 2026)
- Business Recorder (Reuters): Google challenges EU orders to open up to AI, search-engine rivals (29 September 2026)
- The Irish Times: Google fights EU attempt to open Android to rival AI (29 September 2026)
- Search Engine Roundtable: Google appeals European Commission's DMA requirement to share search history data (29 September 2026)
- US Department of Justice: Department of Justice wins significant remedies against Google (2 September 2025)
- Courthouse News Service: DOJ urges DC Circuit to beef up remedies in Google monopoly ruling (29 July 2026)
- Free Software Foundation Europe: DMA litigation against Apple
About this article
This analysis was researched and written by The Corporate INTL Newsroom, which covers cross-border legal, regulatory and business developments for lawyers, professional advisers and financiers in over 150 jurisdictions. It has been checked against the Commission's decision and announcements, the text of the Digital Markets Act and the EU Treaties, and primary reporting of Google's court challenge. Google's pleadings had not been published at the time of writing, and reports did not state whether it has applied for interim measures. This article is general information, not legal advice; for advice on a specific matter, consult a qualified adviser. Last reviewed 29 September 2026. For more analysis like this, visit the Corporate INTL newsroom or subscribe to Corporate INTL.
