The DMA search data decision adopted on 16 July 2026 obliges Google to share anonymised query, click and ranking data with rival search engines, and explicitly with AI chatbots that offer search. It arrives with no fine attached, which has already earned it a verdict of toothless. The number worth your attention is the one describing what Google was shipping before it.
Let me start with the figure that should have led every report on this: Alphabet’s own compliance proposal was removing between 90 and 100% of unique search queries from the dataset it was supposedly sharing. This is what European Commission’s, published on its own DMA portal. The obligation is not new, since Article 6(11) of the Digital Markets Act has required Google to share anonymised search data on fair terms ever since Google Search was designated a gatekeeper in 2023, and two years of it produced what the Commission describes as no meaningful uptake by potential beneficiaries. So when you read that Brussels has finally moved against Google, the question worth asking is what exactly it moved against, and with what.
The Two Years The DMA Search Data Decision Is Really About
Article 6(11) says Google must share anonymised ranking, query, click and view data with eligible search engines on fair, reasonable and non-discriminatory terms. Google complied. It built a dataset, it offered it on terms, and it satisfied every word of the sentence. It also stripped out almost every unique query, which is to say almost everything that would have made the data worth having; a search dataset with the unusual queries removed is a dictionary with the interesting words taken out. Google further excluded AI chatbots with search functions from the pool of who could receive it, which was a technicality when it was written and is the whole ballgame now.
The result was predictable, and one suspects it was not unwelcome. Nobody took the data. The Commission spent two years in talks, concluded that a specification process was the fastest way to make the dataset actually meet the requirement, opened proceedings on 27 January 2026, and adopted the final decision on 16 July under case number DMA.100209.
That is the story here, and it is a considerably more useful one than “EU versus Google, round nine”. A rule existed. A company complied with the rule while defeating its purpose. It then took the regulator two years and a formal proceeding to write down what the rule had meant all along, in enough detail that it could no longer be complied with dishonestly.
A Rule Without A Penalty Is Dead Letters on Paper
This decision carries no fine. Reporting suggests a penalty in the billions had been prepared and that Commission President Ursula von der Leyen personally intervened to take it off the table. What was published instead is a cooperative specification procedure: detailed, technical, binding, and financially painless. Google, for its part, is already arguing that the private search queries of Europeans will be handed to a range of companies without adequate anonymisation and without users knowing or consenting, and that trade secrets and national security are at stake. The tug of war continues, as it always does.
A law that prohibits something and then declines to punish it is a dead letter on paper. That is not cynicism so much as a description of how compliance departments allocate attention: a requirement with a date and a number attached gets a budget, and a requirement with neither gets a meeting. The Commission has been under sustained criticism that the DMA has delivered very little practical improvement to the European digital market during its life so far, and a specification decision with no penalty attached looks a great deal like an institution answering that criticism with paperwork.
However, The Penalty Was Never Meant To Live Here
A specification decision is not an alternative to a fine. It is the thing that makes a fine straightforward. Article 30(1)(b) of the DMA allows the Commission to impose fines not exceeding 10% of total worldwide turnover on a gatekeeper that fails to comply with, in the regulation’s own words, “measures specified by the Commission in a decision adopted pursuant to Article 8(2)”. Article 31(1)(a) goes further still, allowing periodic penalty payments of up to 5% of average daily worldwide turnover, per day, for the specific purpose of compelling compliance with those specified measures.
Read that again with the last two years in mind. Previously, Google could say it had shared anonymised data on fair terms, because it had, and any argument would have turned on what “effective” was supposed to mean. That defence is now gone. There are dated milestones: an eligibility application form and a public webpage for beneficiaries by the end of August 2026; template licence agreements and test data samples by September; the finalised anonymised dataset by November; the pricing offer by January 2027. There is a specified anonymisation method, down to k-anonymity groups of at least 1,000 users sharing a location, a device type and a query language. There is an audit regime with named intervals.
You cannot dishonestly comply with a milestone. Either the webpage was published in August or it was not.
The honest reading, then, is narrower than either the celebration or the dismissal. The Commission did not decline to punish Google; it built the tripwire first, because until last Thursday there was nothing precise enough to trip. Whether it ever chooses to trip it is a political question, and on that question the von der Leyen reporting is genuinely damning. The mechanism exists. The will is unproven.
The Eligibility Bar Does More Filtering Than A Fine Ever Would
If you want to know how much competition this actually creates, do not look at the penalty. Look at who is allowed through the door.
To receive the data, a company must operate an online search engine as a genuine economic activity in the EU for at least two consecutive years, or have been founded less than two years ago and raised more than 50 million euros. It must have had at least 50,000 monthly average users in the EU over the past year. It must process the data inside the EEA, or guarantee protection essentially equivalent to it. It must pass an independent audit before access, another within six months, and one every year after that. Access is capped at five years per beneficiary, and the data arrives with a minimum latency of seven days, which is the Commission’s way of ensuring nobody can simply mirror Google in near real time.
Then come the limits on use, and these matter more to our field than anything else in the decision. Beneficiaries may use the data to improve query understanding, to improve ranking and retrieval, and to improve indexing. They may not use it to train general-purpose AI models. They may not use it to improve unrelated services such as consumer profiling or advertising. They may not use it to systematically replicate Google’s results instead of building their own technology. Google’s algorithms are not shared at all, and never were going to be.
I want to be precise here, because the loose version of this story is already circulating, and it says AI chatbots are about to be handed Google’s data as training material. That is not what the decision says. A qualifying AI answer engine can use this data to get better at finding and grounding; it cannot pour it into its model. The distinction sounds academic until you are the one deciding whether AI answers are about to start looking a great deal more like Google’s.
What You Should Actually Do Before January 2027
Here is the honest answer: nothing, and you should be suspicious of anyone selling you otherwise between now and the autumn. No dataset exists yet. No beneficiary has been approved. Nothing that touches your visibility changes this quarter.
What does change is the reasoning behind a decision you are probably already weighing. The standard objection to investing in answer engine optimisation is that Google holds the moat regardless, so why spend money being visible in engines that cannot really compete. That objection just got weaker, and not because of a press release. The retrieval quality of Google’s rivals, the AI answer engines included, is now scheduled to be improved using Google’s own click and ranking data, under a legal instrument with daily penalty payments sitting behind it. That is not a vendor’s promise; it is an implementation timeline with an auditor attached.
So the posture is this. If you are a DACH brand already investing in AI visibility, keep going, and expect answer engines to get better at retrieval rather than worse, which makes specific, verifiable, machine-readable content matter more than it does today. If you have been waiting for AI search to collapse back into Google and save you the trouble, stop waiting; the European Union has just spent two years and a formal proceeding making sure that it does not. And if a consultant tells you that you must act on the DMA search data decision this month, ask them which of the four milestones applies to your business. There is not one.
Watch the end of August. Not because the deadline affects you, but because it is the cheapest test available of whether any of this is real. If Alphabet misses it and nothing whatsoever happens, then my first instinct was right, and this was paperwork after all.