Google Security Staff Warn EU Rules Could Expose Search Data

Senior security engineers at Google are raising alarms that proposed European Union competition rules might create serious vulnerabilities in Google Search and Android. This could potentially expose millions of users’ personal data to hackers.

What the EU Is Proposing

The EU’s effort to open up Big Tech platforms through its Digital Markets Act (DMA) aims to prevent large tech firms from stifling competition. This set of laws would require Google to share specific data and make parts of its systems accessible to third parties. The intention is to give rival search engines and app developers a better chance to compete with Google’s dominant offerings.

However, Google’s security experts argue that forcing the company to open these systems creates new attack surfaces — entry points hackers can exploit. A report from Wired highlights that engineers within Google’s security teams have formally expressed concerns that the proposed data-sharing rules could allow malicious actors to access sensitive search query data. This type of information can reveal much about a person, including health issues and financial situations.

Why This Is More Than Corporate Self-Interest

It’s easy to view Google’s warnings as just a company trying to protect its business model. After all, Google stands to lose the most if competitors gain access to its infrastructure. But the security implications deserve serious attention.

Search data is highly sensitive. Think of it as your browser history, but with more detail. It includes not just the sites you’ve visited, but also the embarrassing questions you Googled at 2 a.m. or the financial decisions you were contemplating. When regulators make that data available to third parties, even with safeguards, the chain of custody becomes longer. More links in that chain mean more chances for something to go wrong.

Concerns about Android are similar. Google engineers reportedly fear that allowing third-party app stores or deeper system-level access on Android devices could compromise the security checks Google currently performs on apps before they reach users. It’s like a bouncer at a club — Google’s view is that the EU rules would require the club to add a second entrance with a different set of rules.

The EU’s Counter-Position

European regulators aren’t fully convinced by Google’s argument. The European Commission insists that its DMA rules include privacy and security protections. They believe Google’s reluctance to share data is partly about maintaining market power rather than safeguarding users.

This tension isn’t new. Apple made similar arguments when the EU mandated that it allow third-party app stores on iPhones with iOS 17. Apple complied, but added friction that some critics deemed deliberately discouraging. Now, Google seems to be following suit, putting security concerns at the forefront as negotiations unfold.

What This Means for Everyday Users

If you use Google Search or an Android phone, this debate impacts you, even if the outcome is a while away. Here’s what you need to know:

• If Google’s warnings are valid: Opening up search data under EU rules could lead to your queries being handled by more parties, each with different security practices. A weak link in that chain could expose data you thought was private.
• If the EU’s position prevails: You might see increased competition in search and app distribution in Europe, which could result in better products and lower prices over time. However, security protections must be carefully implemented.
• For users outside the EU: What happens in Europe often influences global policy. For instance, Apple’s response to the DMA sparked discussions about app store regulations in the US and beyond.

The immediate concern is what this indicates for data security during any transition. Regulatory changes to systems as vast as Google Search don’t happen quickly. The period when systems are being reconfigured is often when vulnerabilities arise.

Community Reaction

“Google saying ‘this will get hacked’ is really just Google saying ‘don’t make us share our stuff.’ The EU has actual technical teams reviewing this; they’re not just taking Google’s word for it.”

“I’m actually somewhat sympathetic here. Search history is genuinely sensitive data. The question is whether Google’s security concerns are real or just convenient.”

What To Watch

• EU DMA enforcement timeline: The European Commission is currently reviewing Google’s compliance proposals for the DMA. Expect formal responses from Brussels in the coming months.
• Google’s formal submission: Reports indicate that security warnings from engineers are being compiled into formal objections to regulators. Keep an eye out for that document; it could allow outside security researchers to assess the claims independently.
• Android’s separate track: The Android-related concerns about app stores may follow a different regulatory timeline compared to the search data issues. It’s possible the EU could back off on one but not the other.
• US regulatory attention: With Google already facing antitrust scrutiny in the United States, any major concessions made in Europe could be referenced in ongoing US proceedings.

Sources: Wired — Top Google Security Staff Warn Search Data Could Be Hacked