Alphabet specification proceedings - Sharing of Google Search data

Conditions and process to access the data

Who can access the data?

• As a first filter, the measures contain a set of eligibility criteria to ensure that search data is only shared with online search engines that meet basic indicators of trustworthiness. Only those that provide online search services can access the data, and they can only use the data to optimise their online search technologies and services. This includes AI chatbots with online search functionalities. 
• The eligibility measures allow Alphabet to conduct a review based on identified objective criteria to exclude undertakings designated as ‘high-risk’ under EU law because they are sanctioned entities or are controlled by a third country that poses serious and structural cyber security and/or data protection risk, and ensure that only genuine players active in the online search sector with the necessary record of handling sensitive search data or resources to do that can access the data. 
• Alphabet may also only share data with undertakings that meet the conditions for international data transfer pursuant to Chapter V of GDPR. 
• In addition, Alphabet can ask the Commission for an exemption from giving search data access to specific undertaking on grounds of public security pursuant to Article 10 DMA. The Commission may also grant this exemption on its own initiative. 
• Beyond the first eligibility filter, undertakings will only get access to the data if they can demonstrate that they ensure compliance with a comprehensive set of contractual measures, including technical and organisational measures, ensuring anonymisation of search data and security requirements in the context of an initial independent verification mechanism to be repeated annually (see ‘How to meet the eligibility and audit conditions for accessing the data?’ below).

What is in the search data that Alphabet needs to share? 

• Article 6(11) DMA has a well-defined scope aimed at covering important user data to optimise online search engine services. It covers anonymised ranking, query, click and view data that is generated by end users in relation to free and paid search. 
• The measures lay out which concrete ‘ranking, query, click and view’ data Alphabet must offer to third parties providing online search engines, subject to anonymisation. 
• As a basic principle, Google should share the data that it itself collects and uses to optimise its own search services. For instance, the Commission is specifying that Alphabet must give access to data such as queries entered by end users in Google Search on any access point, query metadata (for example, language and device type), URLs viewed by users, users’ actions interacting with search engine results, and information on where a search result is positioned (i.e. ranked) in the search results page. 
• Unlike the data that Alphabet collects and uses, the data to be shared with third party search engines will undertake suppressions and alterations to ensure its anonymisation. For example, no user account information and no search histories are shared, the precise timestamp is not provided, very long queries and queries with rare words are suppressed, location data is generalised, precise interaction durations are aggregated and replaced by time intervals, URLs for paid results (i.e. ads) are removed, etc.   

How will the search data be shared? 

• The measures specify key parameters of sharing. For example, Alphabet must exclude invalid traffic from the dataset, and share the data via a method and with a latency that it uses itself internally to the greatest extent that is technically feasible for a duration of third-party online search engines’ choice and up to five years for each beneficiary. Latency should not be less than seven days, meaning that data is shared at least seven days after a user has entered a query, and it should not be more than the latency Alphabet uses internally to the greatest extent that it is technically feasible. 
• In line with the allowed purpose of use, the minimum seven-day-latency for data access and the maximal duration of data access of five years, for each beneficiary, incentivise data recipients to develop their own search technology.
• The maximum duration of five years applies for each individual beneficiary from the moment when they start accessing the data, Google Search will be subject to the data sharing requirement as long as it is designated under the DMA.

Does this data sharing involve the sharing of Google’s search algorithm and technology?

• The measures do not require the sharing of Google’s algorithms or technology, but rather ranking, query, click and view data, that would allow third-party OSEs to develop their own search technology. 
• The shared data is also only a subset of the user data that Alphabet collects and uses to optimise its own search engine given that the scope is more restricted and the data has to undertake significant alteration to meet the anonymisation standard. 
• Google will therefore retain all incentives to innovate while third parties will be empowered in their own ability to innovate through the removal of a major barrier, namely the lack of search data at scale.

What is the implementation timeline?

The measures set out implementation milestones that Alphabet must meet for different obligations as follows:

• Within 1.5 months after the measures’ adoption (by end August 2026): 
  • Alphabet must submit the eligibility application form to the Commission for review
  • Alphabet must publish a webpage informing beneficiaries of their rights and how to apply for the search dataset
• Within 2 months after the measures’ adoption (by September 2026): 
  • Alphabet must make available template licence agreements for the search dataset and test data samples
  • Alphabet must submit cost items and estimates
• Within 4 months after the measures’ adoption (by November 2026):
  • Alphabet must finalise the anonymised search dataset 
  • Alphabet must submit to the Commission technical information on latency of sharing and personal data detectors so the Commission can review
• Within 6 months after the measures’ adoption (by January 2027): 
  • Alphabet must finalise the pricing offer and communicate this to the Commission and third-party online search engines

How can potential beneficiaries meet the eligibility and audit conditions for accessing the data? 

• Potential beneficiaries must offer online search engine services. They must also demonstrate that they:
  • Provide an online search engine service as a genuine economic activity in the EU or are a credible new entrant into the online search engine industry: namely that the potential beneficiary either has provided online search engine services in the EU for at least the last two consecutive years at the time of applying for eligibility; or was founded less than two years ago but has received more than €50 million in capital investments;
  • Have had at least 50 000 monthly average users of its online search engine services in the EU in the past year;
  • Have not been subject to restrictive measures or other sanctions under EU law and are not controlled by a third country that poses serious and structural cyber security and/or data protection risk.
  • Will process the search data in the EEA or, in case of transfer, can ensure a level of protection of that data essentially equivalent to that provided for in the EEA. These eligibility measures are complemented by an audit which is an independent verification mechanism. Third-party online search engines must prove to a suitably qualified independent auditor that they are complying with the safeguards specified in the measures.
• Third-party online search engines must pass this audit before they receive the search data, within six months of starting processing and annually after that. The Commission can order ad hoc audits outside this yearly window in case of concerns that a third-party online search engine is failing to comply.
• The eligibility and audit measures complement each other. They ensure that only genuine, trustworthy online search engines with the necessary scale and experience to process sensitive search data ever gain access, and that they continue to always comply with the necessary safeguards.
• Third-party online search engines that pose public security risks can also be excluded following a Commission decision.

How will the price of the data be determined? 

• The measures on pricing terms specify the remuneration that Alphabet can claim from eligible beneficiaries under the fair, reasonable and non-discriminatory requirement of Article 6(11) DMA. The measures establish a clear, transparent and predictable framework for eligible beneficiaries and provide Alphabet with a fair opportunity to recover the incremental costs of providing access to the Search data.
• The measures specify that Alphabet must provide the search data to eligible beneficiaries against a compensation reflecting the incremental costs incurred by Alphabet for sharing the search data and a reasonable return on capital employed for that purpose. This capital must be understood as the incremental capital strictly necessary for making the search data available, and the remuneration shall not exceed Alphabets weighted average cost of capital (WACC).
• Exceptional circumstances may justify an additional margin, which however cannot exceed the operating margin (in percentage terms) of Alphabet’s Google Search business, in favour of Alphabet. In particular, this would be the case if at some point Alphabet demonstrates that it cannot cover the costs efficiently incurred in the collection of the data to be shared from its own commercial use of such data, or when an eligible beneficiary operates an online search engine at a very large scale (i.e., meets the thresholds for being designated as gatekeeper). This additional margin will in any event not be applied to micro, and small and medium-sized enterprises. 
• The incremental cost items include: 
  • Costs pertaining to the preparation and formatting of the search data, including all costs directly attributable to the data-sharing-specific further processing of data already stored in Google’s databases;
  • Costs of storing the data to the extent that the storage environment is used for storing data with a view to making it available to eligible beneficiaries; and
  • Costs of dissemination or electronically transmitting the data, including technical onboarding costs and costs of operating data access tools.
• These incremental costs can be recurrent or one-off, and beneficiary-specific or common across beneficiaries.
• The per-beneficiary payment scheme includes a fixed and variable component:
  • the fixed component covers the one-off beneficiary-specific costs and a share of the one-off common costs; and
  • the variable component covers the beneficiary-specific recurrent costs and a share of the recurring common costs.
• Regarding the final allocation of the common costs:
  • the per-beneficiary share of initial one-off common costs will be computed on the basis of the number of beneficiaries at the time the access mechanism is first made available, i.e. the number of third-party online search engines that have either initiated an audit or that have been assessed as eligible to receive the search data within six months following adoption. The computed per-beneficiary share will then be applied to all actual beneficiaries irrespective of the time they start having access; 
  • the recurrent common costs will be shared equally each year among the actual beneficiaries receiving access that year.

How can companies test the data before entering a license agreement?

• Alphabet must offer samples of the search dataset to allow beneficiaries to test the data and make an informed decision on whether to purchase the full search dataset. 
• The measures specify the content and conditions of sharing for these test data samples. Alphabet will make available three types of test samples with different levels of scope and access conditions: a small real-data sample, a synthetic dataset, and a larger representative dataset. These samples can be downloaded and used in the beneficiary’s own secure environment to assess data quality and usefulness.
• Only potential beneficiaries that have received an auditor’s reasonable assurance report under the independent verification mechanism can access the larger representative sample. The other two samples can be accessed without this report.
• This testing framework ensures access on fair, reasonable and non-discriminatory terms.