Loading story…
Google has warned that proposed European Commission remedies under the Digital Markets Act for Google Search and Android could introduce new cybersecurity and privacy risks by forcing broader interoperability and data sharing with rivals. According to Google security executive Heather Adkins, requirements that would give alternative AI assistants system-level access similar to Gemini on Android could make fraud easier and expose sensitive user data, while mandated access to Google Search data could weaken existing protections built around tightly controlled internal handling.
Google also argued that sharing so-called anonymized search information—including query content, rankings, and click-rate data—at the level sought by regulators could enable user de-anonymization and create attractive new targets for attackers among smaller third-party recipients. The dispute comes as the European Commission prepares final decisions in two DMA cases covering Search and Android, with Google contending that competition measures can be implemented only if they do not materially erode security and privacy safeguards for European users.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Google publicly warned that proposed EU Digital Markets Act measures for Android and Search could create cybersecurity and privacy risks. Heather Adkins said broader Android access for rival assistants could increase fraud, while sharing granular search data could enable user de-anonymization and create attractive targets for hackers.
The European Commission was described as preparing final decisions in two Digital Markets Act cases covering Google Search and Android, with a deadline approaching on July 27. The cases concern interoperability and data-sharing requirements for Google's services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcewired.com
Open sourcedigital-markets-act.ec.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Commission issued two binding decisions under the Digital Markets Act requiring Google to expand interoperability on Android and provide certain Google Search data to qualifying rivals. Under the Android ruling, third-party AI assistants must be allowed access to capabilities that Google Gemini already uses, including microphone, camera, screen interaction, ambient sensor data, hotword activation, background execution, and app-driving automation, with most changes tied to **Android 18** and a broader compliance deadline of **1 August 2027**. For a smaller set of more sensitive functions, Google may require certification through a **Qualified AI Assistant Programme**, but the Commission limited Google’s discretion and required equal treatment with Gemini. A second ruling compels Google to share anonymized search query, click, and ranking data with eligible rival search engines and AI chatbots that perform search, with rollout beginning in **2027** under contractual, audit, and independent review safeguards. Google said the measures could weaken privacy and security protections, expose sensitive search histories and trade secrets, and create broader national security risks, while the Commission said the final terms include tighter safeguards than earlier drafts. Google is expected to appeal the decisions.
Jul 18, 2026
The European Commission opened specification proceedings to define how Google must meet Digital Markets Act (DMA) interoperability requirements for Android and data-access requirements for Google Search. The Android proceeding concerns whether third-party AI-service providers must receive access to the same hardware and software features used by Google's own services, including Gemini, under Article 6(7). A separate Article 6(11) proceeding examines fair, reasonable, and non-discriminatory access to anonymised Search ranking, query, click, and view data for rival search engines, including whether AI chatbot providers qualify. The Commission said the proceedings themselves did not establish non-compliance but could inform later enforcement, including fines or periodic penalty payments. Google said the Commission's final Android AI interoperability measures would require deeper access for user-downloaded AI agents to sensitive capabilities such as ambient microphones, cameras, on-screen content, and screen automation. The company warned that fraud, social engineering, polymorphic malware, and indirect prompt injection could abuse such access to compromise user data, accounts, and devices. Google also opposed a Trusted Certification Authorities model that could allow third parties to certify restricted-feature access without Google or device manufacturers retaining final approval, suspension, and revocation authority, and called for cybersecurity-expert consultation and strong platform enforcement controls during implementation.
Sep 27, 2026
Microsoft CEO Satya Nadella warned that enterprises are exposing proprietary knowledge when they use third-party AI systems, arguing that prompts, tool interactions, and corrective feedback can transfer valuable internal expertise to model providers. He described the dynamic as a "reverse information paradox," saying customers may pay twice for AI services—once in fees and again in knowledge that improves a vendor’s models—while urging organizations to set clear trust boundaries, keep control of evaluations and feedback, and avoid dependence on a single provider. The concern intensified as Google updated Search privacy settings so media from search interactions—including images, files, audio, and video—can be used to develop and improve its AI models unless users opt out. Separate reporting said enterprises are increasingly weighing private or open models against closed AI services because of fears that sensitive business data could be retained, learned from, or used to strengthen vendors that may later compete with them, even as major providers maintain that some API traffic is excluded from training or covered by zero-retention options.
Jul 14, 2026