Access to European Union law
<a href="https://eur-lex.europa.eu/content/help/eurlex-content/experimental-features.html" target="_blank">More about the experimental features corner</a>
Choose the experimental features you want to try
EUR-Lex
Access to European Union law

This document is an excerpt from the EUR-Lex website

You are here
Use quotation marks to search for an "exact phrase". Append an asterisk (*) to a search term to find variations of it (transp*, 32019R*). Use a question mark (?) instead of a single character in your search term to find variations of it (ca?e finds case, cane, care).
Search tips
Need more search options? Use the Advanced search

Document 52026DMA100209

Summary of the Commission Decision of 16 July 2026 relating to a decision pursuant to Article 8(2) of Regulation (EU) 2022/1925 (Case DMA.100209 – SP – ALPHABET – Article 6(11))

C/2026/5091

OJ C, C/2026/4443, 14.8.2026, ELI: http://data.europa.eu/eli/C/2026/4443/oj (BG, ES, CS, DA, DE, ET, EL, EN, FR, GA, HR, IT, LV, LT, HU, MT, NL, PL, PT, RO, SK, SL, FI, SV)

ELI: http://data.europa.eu/eli/C/2026/4443/oj

European flag

Official Journal
of the European Union

EN

C series

C/2026/4443

14.8.2026

Summary of the Commission Decision

of 16 July 2026

relating to a decision pursuant to Article 8(2) of Regulation (EU) 2022/1925

(Case DMA.100209 – SP – ALPHABET – Article 6(11))

(C/2026/4443)

On 16 July 2026, the Commission adopted a decision pursuant to Article 8(2) of Regulation (EU) 2022/1925 of the European Parliament and of the Council  (1) . In accordance with the provisions of Article 44 of Regulation (EU) 2022/1925, the Commission herewith publishes the names of the parties and the main content of the decision, having regard to the legitimate interest of undertakings in the protection of their business secrets.

1.   Introduction

On 5 September 2023, the Commission adopted a decision designating Alphabet Inc. (‘Alphabet’) as a gatekeeper under the Digital Markets Act (‘DMA’) for a number of its services. One of these services is Alphabet’s Online Search Engine (‘OSE’) Google Search, which is listed as a core platform service (‘CPS’). As a result, Alphabet must comply with the obligations set out in the DMA. This includes Article 6(11) DMA, which imposes on Alphabet an obligation to share anonymised ranking, query, click and view data in relation to free and paid search generated by end users on its OSEs (‘Search Data’) with third-party undertaking providing OSEs (‘third-party OSEs’) under fair, reasonable and non-discriminatory (‘FRAND’) conditions.

This Implementing Decision (the ‘Decision’) concludes, within the time limit set by the DMA, the specification proceedings opened on 27 January 2026 pursuant to Article 8(2) DMA and specifies measures that Alphabet must implement in relation to Google Search to effectively comply with its obligations under Article 6(11) DMA.

This Decision follows a structured six-month process, which includes extensive discussions with Alphabet and a public consultation to gather input from relevant stakeholders.

On the basis of its exchanges with Alphabet and third parties, the Commission had identified a number of areas in Alphabet’s data sharing offer that needed to be improved to effectively comply with Article 6(11) DMA: One of the key issues raised by third parties is Alphabet’s extreme anonymisation approach, which removes the large majority of unique queries from the dataset. In addition, third parties reported that several key data types were missing (e.g., URLs displayed in advanced search blocks, granular location data and user interaction data), that the dataset was shared with a substantial lag and only for a short duration, that pricing conditions were not FRAND and that Alphabet has also rejected operators of AI chatbots with search functionalities as beneficiaries of the data.

Following this process, this decision imposes measures Alphabet has to implement under Article 6(11) DMA to improve the sharing of the Google Search data so that independent providers of OSEs can access the data and optimise their own search services.

2.   Procedure

Since October 2023, the Commission has held an extensive regulatory dialogue with Alphabet concerning Alphabet’s compliance with Article 6(11) DMA, including numerous meetings and requests for information to discuss its approach to various aspects of the Article.

On 27 January 2026, the Commission opened proceedings pursuant to Article 20(1) DMA in view of specifying the measures that Alphabet must put in place to effectively comply with its data sharing obligation in relation to Google Search. Since the opening of the proceedings the Commission has extensively engaged with both Alphabet and third parties, including through multiple meetings and requests for information.

On 16 April 2026, the Commission communicated to Alphabet its preliminary findings in line with Articles 8(5) and 34(1) DMA (‘Preliminary Findings’), providing Alphabet with the opportunity to comment on its findings and the proposed measures.

In parallel, the Commission published the proposed measures and a non-confidential summary of the case to enable interested third parties to provide comments. The Commission received over 140 contributions in the context of the public consultation, including from business users, end users, and other interested third parties. These submissions were shared with Alphabet.

On 18 May 2026, Alphabet provided its response to the Preliminary Findings after exercising its procedural rights pursuant to Articles 8(1), 8(2) and 8(3) of the Commission Implementing Regulation (EU) 2023/814 (2).

In accordance with Articles 17 and 50(2) DMA, the Digital Markets Advisory Committee was consulted and issued its positive opinion on 15 July 2026.

3.   Legal framework

Pursuant to Article 8(2) DMA, the Commission may, on its own initiative or at the request of a gatekeeper, issue an implementing act to specify measures that the gatekeeper should implement to effectively comply with certain obligations.

Pursuant to Article 8(5) and 8(6) DMA, before adopting such an implementing act, the Commission is required to communicate to the gatekeeper its preliminary findings within three months, and to publish a non-confidential summary of the case and the measures that it is considering taking or that it considers the gatekeeper concerned should take. The implementing act should be adopted within six months from the opening of the proceedings pursuant to Article 20 DMA.

Pursuant to Article 8(7) DMA, in specifying the measures that the gatekeeper concerned is to implement to effectively comply with its obligations, the Commission shall ensure that the measures are effective in achieving the objectives of that Regulation and the relevant obligation, and that they are proportionate in the specific circumstances of the gatekeeper and the relevant service.

Pursuant to Article 6(11) DMA, a gatekeeper must provide to any third-party OSEs, at its request, with access on FRAND terms to ranking, query, click and view data in relation to free and paid search generated by end users on its OSEs. Any such query, click and view data that constitutes personal data must be anonymised.

4.   The Commission’s assessment

This Decision specifies measures in relation to five areas:

(1)

Eligibility - the measures specify which third parties are eligible to receive the Search Data under Article 6(11) DMA and how Alphabet is to assess applicants’ eligibility. The final measures specify an eligibility review to ensure only legitimate, trustworthy OSEs gain access. This assessment will be conducted by Alphabet but is subject to safeguards to protect OSEs’ rights and interests, including Commission supervision. It complements the annual audit process. The final eligibility measures specify the following requirements:

(a)

The beneficiary must operate an OSE: the measures specify that beneficiaries must operate an OSE in the EEA to be eligible to receive the Search Data. This includes AI chatbots that provide OSE functionalities.

(b)

OSEs must demonstrate to Alphabet that they:

(i)

Are not subject, directly or indirectly, to restrictive measures or other sanctions under EU law (such as economic and trade sanctions under the Common Foreign and Security Policy); and

(ii)

Are not subject, directly or indirectly, de jure or de facto, to the control of a third country that poses a serious and structural non-technical cyber security and/or data protection risk; and

(iii)

Operate an OSE as a genuine and established player or have a credible business activity to scale up (by showing that they have at least 50 000 monthly users, and have operated an OSE for at least two years in the EU or have received at least EUR 50 million in investments);

(c)

In accordance with the GDPR, Alphabet must verify whether the data will be processed in the EEA or in a third country providing an adequate level of protection (based on the Commission’s adequacy decisions). If that is not the case, Alphabet must ensure, on the basis of a transfer impact assessment, that access to Search Data involving transfers to a third country will effectively guarantee a level of protection of personal data essentially equivalent to that guaranteed in the EEA. If Alphabet concludes that it cannot guarantee the required level of protection in accordance with Chapter V GDPR, it must find the OSE in question ineligible; and

(d)

The measures also contain an explicit reference to Alphabet’s right, under Article 10 DMA, to submit a reasoned request to the Commission asking to be exempted from its obligation to provide Search Data to individual undertakings on public security grounds.

(2)

Data scope - the measures specify which data Alphabet must share to effectively comply with Article 6(11) DMA. Subject to anonymisation requirements, Alphabet must share with eligible third party OSEs:

(a)

Query data: queries entered by end users into Google Search on any access point, any modifications made by end users and Alphabet to initial queries, and any other metadata about the users and their queries, on par with the data collected by Alphabet for the purpose of optimising its OSE service.

(b)

View data: all URLs and the description of visual elements which are displayed on search engine result pages, served to end users in response to their queries and are viewed by them (i.e., they generate an impression), no matter their type, format, structure or tab in which they are included, on par with the data collected by Alphabet for the purpose of optimising its OSE service.

(c)

Ranking data: the URL’s or visual element’s (together: ‘SERP elements’) (i) absolute, whole page position on the results page as displayed on the user’s device, (ii) the SERP element’s relative ordinal position in relation to other SERP elements presented in the same area on the results page and (iii) any other information on the URL’s relative and absolute position, prominence and visibility on the results page, as displayed on the user’s device, on par with the data collected by Alphabet for the purpose of optimising its OSE service.

(d)

Click data: all data on user interaction with the results page as displayed on the user’s device, with any SERP element, including the type, timing, order and duration (where relevant) of user actions, or lack thereof, on par with the data collected by Alphabet for the purpose of optimising its OSE services.

The measures also specify key parameters on how Alphabet must share the data. Alphabet must:

(a)

exclude invalid traffic from the shared Search Data applying the same methods and process it uses itself in its ordinary course of business,

(b)

share the data via a method and with the latency that it uses itself internally to the greatest extent that is technically feasible within a timeframe of no less than seven days, in daily batches and with daily data time stamps, and

(c)

for a duration chosen by the beneficiary third-party OSE choice, up to five years from the moment when the Search Data becomes effectively accessible to that beneficiary.

(3)

Anonymisation - the measures specify how Alphabet must anonymise the Search Data, taking into account the Joint Guidelines of the Commission and of the European Data Protection Board on the interplay between the DMA and the General Data Protection Regulation (‘GDPR’) (‘Joint Guidelines’) (3). The measures consist in technical measures complemented with contractual measures to reduce the likelihood of re-identification of end users to an insignificant level:

(a)

Technical measures: they play a prominent role by altering the Search Data so as to reduce the re-identification risk of end users to a residual level while preserving the quality and usefulness of the data.

(b)

Contractual measures: they include an extensive set of administrative, contractual and organisational measures that complement the technical measures to further reduce the residual risk of re-identification of end users to an insignificant level.

The technical measures require Alphabet to release data daily and to inter alia (i) suppress direct identifiers and other identifying attributes from search records, (ii) suppress long queries and queries that contain rare words and combination of words, (iii) generalise location and user interaction metadata to ensure indistinguishability among users, (iv) limit session data to sets of maximum three queries where each is a refinement of the previous query and (v) coarsen durations (e.g. click-back time, and hovering and viewing durations) into time intervals instead of precise time data.

The contractual measures further mitigate the residual risks stemming from data processing by eligible beneficiaries. In substance, they ensure that data recipients are legitimate and have concrete and verified plans to use the data to optimise their online search engine services, they require beneficiaries to process the Search Data within a segregated processing environment under their effective control and they prohibit beneficiaries from attempting re-identification (e.g., by linking the Search Data with auxiliary datasets), using the dataset outside of the purpose of optimising online search engine services, retaining the data beyond 13 months, and sharing the dataset onward with any third-parties. The contractual measures also require beneficiaries to protect the integrity and confidentiality of the Search Data from unlawful access by unintended recipients (e.g. by requiring encryption of data at rest and in transit). Finally, to verify implementation of the contractual measures, beneficiaries are subject to an independent verification mechanism, consisting of an independent audit prior to accessing the Search Data and annual monitoring audits to maintain such access. The scope of the assurance engagement and the corresponding assurance objectives are defined by the Commission.

(4)

Pricing terms - the measures on pricing terms specify the remuneration that Alphabet can claim from beneficiaries under the FRAND requirements of Article 6(11) DMA. The proposed measures specify that, in the specific context of a data sharing obligation applicable to a gatekeeper, and absent comparable market-based benchmarks, FRAND pricing corresponds to incremental cost-based pricing, where eligible beneficiaries pay only the incremental costs incurred by Alphabet for sharing the Search Data, plus a reasonable return on capital employed for that purpose. Exceptional circumstances may justify an additional margin.

(5)

Process for data acquisition and pre-acquisition data testing - the measures specify how Alphabet must make the data available to beneficiaries under Article 6(11) DMA. The proposed measures specify:

(a)

The testing samples that Alphabet must make available. Alphabet must provide three types of testing samples: one small testing sample provided free of charge, a synthetic data sample, and a 5 % sample of the Search Data subject to beneficiaries meeting all conditions for accessing Search Data.

(b)

The process that Alphabet must follow to review the eligibility of requesting third parties, request ad hoc audits of beneficiaries (outside the normal annual audit window), and for refusing, suspending and terminating access to the Search Data to ensure strict compliance with contractual measures.

(c)

The timeline in which Alphabet must make the Search Data available in a way that complies with the specified measures in the Commission’s implementing act.

(d)

The process for finalising Alphabet’s pricing terms and communicating them to third-party OSEs applying for eligibility and, ultimately, to eligible beneficiaries.

5.   Conclusion

The Decision specifies measures pursuant to Article 8(2) DMA that Alphabet must implement in relation to its OSE Google Search to effectively comply with its obligations under Article 6(11) DMA to provide any eligible third-party provider of OSEs, with access on FRAND terms to ranking, query, click and view data in relation to free and paid search generated by end users on Google Search.

(1)  Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (OJ L 265, 12.10.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/1925/oj).

(2)  Commission Implementing Regulation (EU) 2023/814 of 14 April 2023 on detailed arrangements for the conduct of certain proceedings by the Commission pursuant to Regulation (EU) 2022/1925 of the European Parliament and of the Council (OJ L 102, 17.4.2023, p. 6, ELI: http://data.europa.eu/eli/reg_impl/2023/814/oj).

(3)  Joint EDPB and Commission guidelines on the interplay between DMA and GDPR, version for public consultation, available at: https://digital-markets-act.ec.europa.eu/document/download/8ba0913f-2778-4a6d-9c58-10f8c7ead009_en?filename=Joint_COM-EDPB_GLS_interplay_DMA_GDPR_for_public_consultation.pdf.

ELI: http://data.europa.eu/eli/C/2026/4443/oj

ISSN 1977-091X (electronic edition)

Top