CMA would put AI assistants on a 12-slot Google choice screen

Identity ran through almost everything the industry published on Wednesday, in four different senses of the word. A competition regulator in London proposed that British phone and browser users be asked, by name, which search service they want. A tracking firm measured how often Google's own answer box now names the websites it read. Two more companies launched identifiers for the open web, in a market that already has at least seven. Google quietly decided that no publisher will see a single AdSense dollar, or serve a single ad, without first handing over a government photo ID. And at a closed-door session in Miami, publishing executives asked whether naming the individual reader inside a newsletter accomplishes anything measurable at all.

None of these were coordinated. Together they describe a week in which the question of who has to be identified, and to whom, moved from the margins of ad tech to the centre of it.

The CMA puts a name on the default

The United Kingdom's Competition and Markets Authority published a strengthened set of proposals on September 23 that would require Google to show Android and Chrome users a choice of search services, and to keep asking them once a year afterwards. The revised consultation runs to 71 pages and replaces the package the regulator first floated on January 28, 2026. Responses are due by 5pm on October 9, a window of sixteen days, with a final decision expected before the end of the year.

The mechanics are unusually specific for a document at consultation stage. A choice screen would carry up to twelve providers: the five most popular, plus seven selected at random from the remaining eligible pool. Order would be fully randomised. Users would have to scroll the full list before confirming a selection. Each entry would carry a short description agreed between Google and the provider, and a description would have to disclose whether the service charges for access or caps free queries. An information screen explaining what a general search service is would appear immediately before the list itself. For the first six months, popularity would be measured by Google Play Store downloads; after that, by how often a provider is chosen as a proportion of how often it is shown.

Selection would not be a single tap and done. The CMA proposes a test-drive period of at least one week, after which a confirmation screen would ask whether the user wants to keep the new default. Notification at the end of the trial would be skippable and visually limited, and there would be no automatic full-screen reappearance. A deliberate choice made recently would earn a six-month exemption from further prompts. The annual redisplay would be tied to a major Android or Chrome update rather than a fixed calendar date, again as a skippable notification rather than a blocking screen.

Coverage is where the numbers get large. The screen would appear on new Android devices where Google Search, the Search widget or Chrome ships pre-installed as the default, and on first use of a new Chrome installation on Windows, macOS or iOS. Existing Chrome users on desktop and iOS would see it after the first major update once the requirement takes effect. The CMA's own estimate is five to ten million screens a year on Android and fifteen to thirty-five million initial screens on Chrome desktop and iOS, with sixty-five to one hundred and thirty-five million redisplay notifications over five years. Circle to Search is out of scope, as are existing non-Pixel Android devices. A typical screen is assumed to take twenty-five seconds, which the regulator costs at five pence of user time using the Department for Transport's £7.21 per hour value for non-working time. Google's implementation costs are put at £5 million to £20 million over five years, against UK search advertising revenue of £10 billion to £20 billion in 2024. Google argued those cost estimates were preliminary and conservative, excluding server maintenance and technical fixes.

The most consequential change from January concerns who qualifies. Three eligibility criteria survive, and one was deleted. Gone is the requirement that a service run general search as a core and central part of what it does, which had effectively barred assistants built around conversation. The CMA's reasoning is blunt: the line between AI-based services and other types of search service is increasingly blurred, and AI assistants could in theory be able to be listed on the choice screen, provided they meet technical and security requirements. Sarah Cardell, the CMA's chief executive, framed the change as future-proofing, saying that the way people search for information online is changing, with new services creating fresh opportunities for innovation and competition. AI assistants had not previously been eligible for Google's choice screens anywhere.

The first surviving criterion carries the attribution language that matters most to publishers. A qualifying service must address the full range of general search use cases, defined as navigational, transactional, simple informational and complex informational queries. Where it produces AI summaries, it must attribute content clearly and accurately, with clear routes through to the source material, and its error rate cannot be significant. The second criterion covers stability, Android compatibility, minimum security standards and the ability to operate on an enduring basis with a growing user base. The third requires that a significant proportion of UK users regard the service as a general search provider, which the CMA defines as a meaningful or non-trivial proportion and explicitly not a majority, with no numerical threshold attached.

Google would also have to build a single-step mechanism for changing the device default across the widget, the search app and Chrome on Android, discoverable by searching settings for "default" or "default search". Eligible providers get an API that lets them detect whether they are the current Chrome or Android default and deep-link into the relevant settings page, with user consent obtained at setup. Applications for eligibility would be assessed every six months, with two weeks' notice before each window opens and decisions within two months of it closing. Rejections must carry detailed reasoning, applicants cannot be compelled to disclose confidential information, and providers already deemed eligible do not reapply each cycle. Providers get at least three months' notice before a rollout.

The evidence base is contested, which the document does not hide. A field experiment by Allcott and co-authors found 1.1% of users moved from Google to Bing after an active choice, and valued the intervention at £4.22 to £14.77 per device. Decarolis and co-authors found Google's share in the European Economic Area fell between 0.5 and 1.5 percentage points after the Digital Markets Act screens arrived from March 2020. DuckDuckGo research from 2020 suggested a well-designed menu could cut Google's mobile share by roughly a fifth. Google's own commissioned research concluded the median user would need £39 a month, or £468 a year, to abandon the product. The CMA notes that a Mozilla study drew on 12,000 participants while Google's had between 20 and 30, and concludes that benefits are likely to significantly outweigh the costs. Google, for its part, argued that annual redisplay would produce choice overload and be ignored through repetition.

This sits inside a regime that is barely twenty months old. Google was designated with strategic market status in general search and search advertising on October 10, 2025, after an investigation opened earlier that year, and warned at the time that the rules could slow the pace of product launches in Britain. The designation runs to October 10, 2030. Two conduct requirements are already in place: the publisher package imposed on June 3, 2026, whose obligations commence on December 3, and fair ranking and data portability requirements imposed on June 17. Google's response to the publisher order was an opt-out toggle inside Search Console, the practical shape of what British publishers stood to gain from the intervention. Google's UK search share is above 90%, across sixty to seventy million logged-in mobile users and twenty to thirty million desktop users. Respondents to the January round included Guardian Media Group, the News Media Association, the Professional Publishers Alliance, the Independent Publishers Alliance, OpenAI, Microsoft, DuckDuckGo, Mozilla, Brave, Samsung, Sony, Which?, the Movement for an Open Web through Preiskel & Co, and the Knight-Georgetown Institute. Stijn Huijts, a partner in the competition and antitrust practice at Geradin Partners, commented publicly on the revised text. The proposals were reported the same morning by Search Engine Roundtable, from the CMA's own announcement.

Google's answer box starts naming its sources

On the same day the CMA proposed writing attribution into eligibility criteria, a measurement firm published data suggesting Google had already changed the behaviour in question. Malte Landwehr of Peec AI posted tracking figures on X showing that external links, previously present in close to 0% of AI Overviews, now appear in more than 25% of them. Landwehr's phrasing was that Google massively increased the number of external links within the feature. Search Engine Roundtable covered the finding on September 23, with Barry Schwartz disclosing a small personal investment in Peec AI and noting he had told the company he would cover its content less often as a result.

A jump from almost nothing to a quarter of results is a large change in a surface that serves an enormous share of queries, and it lands in a context where the traffic consequences have been measured rather than asserted. A randomised study earlier this year found AI Overviews cut clicks to publishers by 39.8%, the first controlled estimate of an effect publishers had previously only observed in their own analytics. Comscore's measurement puts AI Overviews on 39.4% of Google desktop searches. Google has separately built a publisher-facing lever in the form of Preferred Sources, which passed 255,000 user selections since late May and was extended into AI Mode as newer sites lost ground.

The direction of travel is worth stating precisely, because two changes to the same surface point opposite ways. One set of links now sends users deeper into Google's own conversational product rather than out to the web, a pattern documented earlier in the week. The other set, the one Peec AI counted, sends them to named sources. Both can expand at once. What the CMA's first eligibility criterion would do is convert the second into an obligation rather than a product decision, at least for any service that wants a slot on a British choice screen. Clear and accurate attribution with clear routes to source material is a testable standard. A quarter of AI Overviews carrying an external link is a number that can be measured again in six months.

The identifier count goes up again

The open web's identity layer gained two more entries on September 23. Taboola launched Realize ID, pitched at performance marketers who want to capture open-web intent before it disappears, in the words of chief executive Adam Singolda. 51Degrees, a firm affiliated with the Movement for an Open Web, released the 51Degrees Identifier, or 51Did. AdExchanger's roundup filed both under a single heading and then listed the incumbents: third-party identifiers including LiveRamp's RampID, the Trade Desk-backed Unified ID 2.0 and ID5, alongside first-party constructions such as Yahoo ConnectID, TransUnion's TruAudience and the PayPal Ads identifier launched in April 2026. None has achieved standard status. The practical consequence for buyers is fragmentation rather than choice.

That the Movement for an Open Web appears twice in one day's news, as the affiliate behind a new identifier and as a respondent to the CMA's search consultation, is a reasonable summary of how the open web currently argues its case: technically, by shipping alternatives, and legally, by asking regulators to constrain the defaults.

Taboola's launch fits a pattern the company has been building for eighteen months. Realize is the performance platform it expanded with publisher partnerships and then extended into agentic workflows as Realize+. An identifier is the missing input for a performance pitch that competes against platforms with logged-in users. PayPal made the same argument from a different direction when it bet payment data could fix advertising's identity problem, and the underlying observation, that the end of cookies is a myth and the real change lies elsewhere, has held up better than most predictions made in 2020. The Video Advertising Bureau's contribution has been procedural: six questions it says every buyer should put to an identity vendor, covering how a graph is built and what a match rate actually counts. The distinction between a deterministic identity graph, a probabilistic device graph and a clean room match remains the thing most sales decks blur.

Against all of that engineering, the same roundup carried a finding about the simplest possible mechanism. The cybersecurity researcher Buchodi documented an OpenAI cookie classified as analytics with a one-year duration, capable of recording off-site behaviour and conversion events for up to 365 days after an ad interaction inside ChatGPT. Buchodi has not shown it being used that way in practice, and OpenAI's position is that advertisers cannot access personal data or conversation history. A 365-day first-party cookie is nonetheless a reminder that the identity debate is not only about graphs and pseudonymisation schemes.

Google has dropped the identity verification threshold for AdSense from $10 to $0, which means verification now gates ad serving and payment from the first impression rather than from the first ten dollars of earnings. The change surfaced on September 23 through updates to Google's help documentation, with a Wayback Machine capture from September 8, 2026 preserving the earlier figure. The documentation dates the change to June 2026. Address verification stays at $10 or the local equivalent.

What verification requires has not changed, only when it bites. Publishers must submit a government-issued photo identification document. Depending on location, some will also be asked to record a video selfie to confirm the account details and deter fraud. For a publisher earning nothing yet, that is now a precondition of serving any advertising at all through the programme.

The rationale is not stated in the help text, but the direction matches everything Google has done on the buy side. Identity verification was extended to all advertisers rather than a risk-scored subset, the company has spelled out the consequences of submitting false verification information, and business link policies were rewritten with stricter verification requirements. Applying the same logic to the supply side closes a gap: an account with no earnings history has no financial trail to examine, so the identity document becomes the only check available before inventory starts serving. It also arrives alongside the plumbing that makes small payouts practical in the first place, since AdSense added PayPal Hyperwallet as a payment option for publishers in markets where wire transfers are awkward.

The trade-off falls unevenly. A publisher in a market where government photo identification is routine and biometric selfie checks are familiar will treat this as a form to fill in. A publisher in a market where identification documents are harder to obtain, or where handing a video selfie to an American platform carries a different weight, faces a higher barrier to entering the programme at all. Google has not published figures on how many accounts sit below the old $10 line, which makes the size of the affected population impossible to estimate from outside.

Publishers cannot find the payoff in personalisation

At a closed-door town hall during the Digiday Publishing Summit in Miami, publishing executives worked through whether personalised newsletters justify their engineering cost, and came out divided. Sara Guaglione reported the session on September 24.

The evidence offered in the room was mixed in an instructive way. One executive described testing automated, personalised local daily briefings for 20% of registered users, assembled from reading-behaviour data, and reported a 20% increase in click-through with what they described as a non-voicey top of the newsletter. Another had automated a previously hand-curated newsletter after the person curating it left, using identity graphs to assemble it, and found there was no difference in the click-through or open rate, but nobody's curating it, while it provided the same level of referral traffic. Their conclusion, that this is kind of a win, is a cost argument rather than a revenue argument. Holding performance flat while removing a salary from the production line is a real result. It is not evidence that personalisation lifts anything.

The scepticism was about differentiation. One executive said a personalised newsletter does not feel like a diversified product, on the grounds that everybody's kind of doing it. Another reported that a professional audience actively rejected heavy personalisation, because those readers want to be reading everything their peers are reading so as not to miss anything. That is a sharper point than it first appears. For a trade or professional publication, the shared briefing is the product: its value comes precisely from every reader having seen the same thing, which individual optimisation erodes. Ad personalisation logic transplanted into editorial does not automatically survive the journey.

Where the executives did converge was on using personalisation for conversion rather than engagement, mixing free links with paywalled content and adjusting the balance to an individual reader's threshold before asking for money. That reframes the identity graph as a pricing instrument instead of a curation one, which is a narrower and more defensible claim.

The backdrop explains the impatience. Reach reported Google traffic down 46% year on year. AI Overviews appear on 39.4% of Google desktop searches on Comscore's measurement. ChatGPT's share of assistant usage fell from 70% to 35% between January and June 2026. Tripadvisor accounts for 21% of citations in AI travel answers despite being used as a source in 61% of them, a gap between being read and being credited that the CMA's attribution criterion is aimed at. Adam Greenberg, vice president of strategic partnerships at the New York Times, told the summit that where this ends up is very unclear and that maturing AI marketplaces takes years. Elsewhere in the same briefing: CNN and CBS News are consolidating under a shared corporate structure with an independent editorial board, Forbes is cutting staff under advertising pressure, Axios hit its 2026 revenue targets, and Semafor is building a technology show with Reed Albergotti.

Newsletters are the surface publishers control most completely, which is why the personalisation question gets asked there first. It is also the surface where measurement is thinnest, a problem not confined to email: research from Riddle found 78% of interactive content shares escape web analytics entirely, and the BVDW's email guidance had to account for AI agents arriving in a 376-billion-message daily inbox. A 20% click-through improvement measured on a fifth of registered users is a finding. It is not yet a business case, and the executives in Miami appeared to know the difference.

Four of the day's five developments come down to the same mechanic. A regulator wants users to name their default and services to name their sources. Google wants publishers to name themselves before it pays them. Ad tech wants a durable name for the reader. Publishers, given the ability to address readers by name, are not sure it earns its keep. The one asymmetry worth noting is that the party being asked to identify itself is almost never the party doing the asking.

Also noted

September 23: Sephora launched on TikTok Shop with a 12-piece POV Beauty holiday set priced at $265 against a $327 stated value, exclusive to the platform and hosted in a livestream by co-founder Mikayla Nogueira, whose TikTok following exceeds 17 million; the storefront carries roughly 2,300 products, TikTok Shop ranks fourth in US health and beauty retail with sales past $4.4 billion as of May 2026, and monthly drops are planned (Digiday, with the Drop Shop rollout from September 19).
September 23: SQREEM named Stephen Yap chief executive, arriving from roughly eighteen months as chief revenue officer at Perion and nearly two decades at Google, and restated the company's preference for large behavioural models built on state-space mathematics over large language models, citing a correlation in which green tea buyers purchase travel insurance 22% more often than the general population (AdExchanger).
September 23: Google Business Profile owners now get four days to accept or reject user-suggested edits, after which Google may publish the change automatically if other public information such as the business website supports it, and some edits may be applied with no prior review where policy guidelines require it (Search Engine Roundtable; background on the profile as a data layer feeding AI, Maps and Search).
September 23: Google Ads API v25.2 shipped with competitive benchmark percentile metrics, Performance Max draft generation from Smart campaigns, asset group URL options and search bid adjustment recommendations, continuing the monthly release cadence adopted in January 2026 and following v25.1's allowlisted lift metrics(Search Engine Roundtable).
September 23: The US Joint Industry Committee recertified Comscore, VideoAmp and iSpot for video measurement, and Sony confirmed it will stop producing physical game discs from 2028 on console manufacturing costs, a decision affecting a global game resale market worth $7.2 billion, while Microsoft cut 268 gaming jobs on the way to a 20% reduction in the Xbox workforce by year end (AdExchanger).