The European Commission's order forcing Google to share search data with rival search engines will succeed or fail on how closely Brussels polices figures that Google itself supplies, according to Aurélien Mähl, Lead Public Policy Manager at DuckDuckGo, a company that stands to receive the data. In an interview published on October 13, 2026 as episode 56 of The Binary Agora, a podcast on European digital regulation hosted by Alba Ribera Martínez, Mähl welcomed the anonymisation method the Commission set out in July under Article 6(11) of the Digital Markets Act, but said Google faces no external audit of the filters and costs it will report, while recipients of the data are subject to "pretty stringent auditing requirements."

"And the devil is in the enforcement," Mähl said, describing the pricing terms. Later in the 22-minute conversation, he applied the same test to the whole regime, which he called "an obligation that lives and dies on enforcement."

DuckDuckGo is not a neutral observer. It is one of the companies the data-sharing obligation is designed to help, and PPC Land noted in July that Bing and DuckDuckGo already have the infrastructure to use the new access rights immediately, while Ecosia and Qwant would need to build it. A DuckDuckGo privacy engineer co-wrote the most detailed public alternative to Google's anonymisation approach, published in April. Google has argued the opposite case throughout: when the Commission adopted its decision on July 16, the company said the measures risked undermining privacy and security protections for millions of Europeans. The podcast's own description notes that guests' views are their own.

In Short

Europe has ordered Google to sell rival search engines a privacy-filtered copy of what people search for and click on, with sharing due to start in January 2027. DuckDuckGo, which wants that data, says the new rules are far better than Google's first offer, but that Google itself reports the costs and filters that decide what rivals receive, and no outside auditor checks Google's side. If the Commission does not watch those numbers closely, rivals could pay more for less useful data and the order would change little. Google argues the opposite risk: that sharing the data at all exposes European users' searches.

A long tail only Google sees

The case for the obligation, as Mähl set it out, rests on scale. Google's search share in Europe has stayed above 90 percent for years, and more searches mean more evidence of what people click on, "which is the most important signal in terms of relevance of the results," he said.

The common queries are not the issue. "If I take an absolute example, being able to serve you with facebook.com if you are searching for Facebook is not really the issue here," Mähl said. The gap lies in "the more unusual and the more complicated ones," the rare searches that are hardest to answer well.

To illustrate the size of that gap, Mähl cited a figure from the US antitrust trial. "They found that of the 3.7 million unique phrases that were searched, either on Google or on Bing, which is the second-biggest index over a seven day period. 93% were seen only by Google, and just 4% only by Bing." Earlier findings from the same case point the same way. When Judge Amit Mehta ordered remedies in September 2025, PPC Land reported the court's finding that Google receives nine times more queries than all rivals combined, and that Google collects in 13 months the volume of data Bing would need 17.5 years to gather.

From more than 99 percent to under 5 percent

Ribera Martínez opened by describing Google's compliance with Article 6(11) before the Commission stepped in as "suboptimal, not really targeted to attaining those regulatory objectives." She reminded Mähl that, speaking for DuckDuckGo at Alphabet's DMA compliance workshop on July 1, 2025, he had said Google's anonymisation stripped out more than 99 percent of distinct queries.

Google had offered an anonymised dataset since March 2024, when the DMA's obligations first bound Alphabet. Mähl's account of why that offer failed was blunt. "The anonymization filters that Google applied removed any query that is not very common," he said. What remained were queries such as "facebook.com, chocolate cake recipes," which "rivals effectively already see in sufficient numbers."

The underlying thresholds were set out in an April 28, 2026 essay in TechPolicy.Press by Paul Francis, director emeritus at the Max Planck Institute for Software Systems, and Andreas Dewes, a privacy engineer at DuckDuckGo. According to the essay, Google required a query to have been searched by at least 30 signed-in users worldwide in the previous 13 months, and required each combination of query, result, device and country to come from at least five unique signed-in users per quarter. The authors estimated that the dataset omitted more than 99 percent of distinct queries and around 42 percent of total query volume. TechPolicy.Press disclosed that it had received donations from DuckDuckGo in 2024 and 2025.

The Commission reached a similar conclusion through its own figures. According to PPC Land's review of the decision text, the 30-user threshold removed between 90 and 100 percent of unique queries and between 30 and 40 percent of query volume, ranges the published decision redacts. The offer had attracted a single licensee, which, according to the decision, had acquired only a small sample.

DuckDuckGo's alternative worked in four steps: pseudonymisation that strips cookies and Google identifiers and rounds timestamps to 24 hours; targeted removal of personal identifiers such as emails, phone numbers and card numbers through pattern matching and named entity recognition; a rare-word filter checked against a dictionary built over a longer window; and a k-anonymity threshold of 1,000 users applied to combinations of device, language, country and timestamp. On a sample of DuckDuckGo's English-language searches, the authors said the method removed fewer than 5 percent of distinct queries, and estimated that around 2 percent of searches would be filtered at Google's scale. They acknowledged that the analysis used only DuckDuckGo data and called on Google to supply what would be needed to validate it.

Mähl described that work in the interview. "And we found that it was possible to apply targeted content-based filtering thresholds that remove under 5% of distinct queries while still protecting privacy," he said. "And so our conclusion was that Google can, and in fact, Google must deliver both on usefulness and on privacy."

The Commission's final method resembles that structure without matching its numbers. As Damien Desfontaines, a privacy engineer who advised the Commission, described it, the decision removes any record containing an entity searched by fewer than 50 signed-in users in the past year, applies a 1,000-user floor to combinations of region, device category and inferred language, drops queries longer than the 95th percentile for their language, and chains refinements into mini-sessions of up to three queries. Under that entity-based approach, according to PPC Land's reading of the decision, the share of unique queries removed falls to between 10 and 20 percent. That is far below Google's original filter, but well above what DuckDuckGo said was achievable.

Mähl drew the same distinction. "The Commission terms now, we have a cautious optimism," he said, because the adopted framework "shares the same approach conceptually that we worked on." He added: "So I'm not talking about the specific parameters and the details here."

The detector DuckDuckGo says it asked for

Ribera Martínez put it to Mähl that, between the draft and the final decision, the Commission had leaned more heavily on contractual safeguards, which could be read as an admission that "the technical approach can only get so far with regard to anonymization."

Mähl disagreed with that framing and argued that the technical measures were strengthened. He gave one example. "We suggested to the Commission that they should add a specific detector to always remove what we call known identifiers, which are things like addresses, names, IBANs, etcetera," he said. Such strings, left in a query, can help link queries back together "even if you remove the user ID from the set of queries." According to Mähl, "It was adopted for this detector to be applied and to remove those known identifiers when they exceed a certain threshold."

The adopted text does contain such a step. According to PPC Land's review, personal data detectors first identify addresses, names, phone numbers, location coordinates, IBAN numbers, credit card numbers and other well-known identifiers, then normalise them, before the remaining text is split into entities tested against the 50-user allow list. The detectors must be publicly available tools; the decision gives Google Sensitive Data Protection as an example. Google must tell the Commission which detectors and entity types it plans to use, along with confidence thresholds, reasons and computing costs. Desfontaines noted that the detector also catches typos, describing these as unavoidable false positives. DuckDuckGo is not named in PPC Land's review of the decision text, so the account of where the detector came from rests on Mähl.

Red-teaming and the "fear-mongering" charge

Mähl said the Commission's choice showed it "did not buy into what I would call it really the fear-mongering of Google over the last few months when it comes to these filters and privacy." He was referring to Google's publication of what he called a "so-called red teaming report where basically hypothetical attackers would try to re-identify the anonymized data sets." In his view, the filters Google tested "were faulty, they were not really applying the Commission filters in full."

Google's side of that dispute is on the record. In May 2026, Google scientist Sergei Vassilvitskii wrote to the Commission claiming that Google had re-identified individual users in under two hours, according to Reuters. The decision records that the test used one week of Irish data. The Commission rejected the conclusion, describing Alphabet's tests as atomic attacks run without the contractual security controls rather than end-to-end red teaming, and said none of the examples met its criteria for risk beyond a residual level. Desfontaines argued separately that Google had tested the preliminary version of the measures and ignored the non-technical safeguards.

Google's objections were not without effect. Between April and July the Commission excluded sponsored results, enlarged the geographic regions used for location, and raised the metadata threshold, according to PPC Land's account. The April proposal had used S2 cells covering at least 1,000 users and 3 square kilometres; the final text uses NUTS 3 regions, designed to hold between 150,000 and 800,000 inhabitants.

Now that the measures are fixed, Mähl expects the reverse problem. "One concern we have is Google being, so to say, zealous in applying these filters," he said: applying them more aggressively than the terms require, and so sharing less than rivals are entitled to receive.

Who checks Google

That concern led to the point Mähl returned to most often. The Commission, he said, "applied very important and useful transparency rules," but "Google is not subject to external auditing for this. Recipients are subject to pretty stringent auditing requirements, Google is not. And so there is a degree of Google self-reporting in this that is potentially concerning."

The asymmetry is visible in the decision as PPC Land has described it. Recipients must provide independent reasonable-assurance reports under the ISAE 3000 standard or an equivalent: a Level 1 report before receiving any data and a Level 2 report every year, with a first compliance audit within six months and ad hoc audits available to the Commission. Google's obligations take the form of disclosure. It must publish quarterly which detectors it used, their performance statistics, and the share of unique queries and query volume that each measure suppressed or altered. It must explain its exclusion of invalid traffic on request and justify its data latency to the Commission. The Commission's July announcement said it may amend the anonymisation measures later in light of market developments, including independent third-party evaluations, and the decision provides for an evaluation within two years of adoption.

Those quarterly figures are produced by Google. Mähl's objection is that nobody independent verifies them.

Contracts on top of filters

Mähl rejected the idea that the contractual layer signals a weakness in the technical one. The contractual measures, he said, "include things like compliance with strict security standards for recipients and rules like the prohibition on re-identifying users or also the obligation to process data in a segregated environment, all of this being verified, importantly, by external audits."

He placed that structure within the draft joint guidelines the Commission and the European Data Protection Board published on how the DMA and the GDPR interact. "These technical measures already bring the risk of re-identification to a residual level. And the contractual and organizational measures take them to this insignificant level," Mähl said. "That's the correct GDPR structure and it's not in our view an admission that the tech fails."

The data protection side of that argument remains contested. The EDPB's May 5 letter on the preliminary measures, made public in September, accepted contract-backed anonymisation where an implementing act imposes it, and described click data as highly unique. Brussels lawyer Peter Craddock argued that the letter clashes with the board's own anonymisation guidance, which the EDPB adopted as Guidelines 02/2026 on July 7 and which remain open for comment until October 30, 2026.

Recipients also accept restrictions beyond security. The data may be kept for no more than 13 months, may not be used to train general-purpose AI models, and may not be used to build advertising or profiling tools or to reproduce Google's results systematically. Any attempt at re-identification is a breach whether or not it succeeds.

Asked whether DuckDuckGo worried about carrying more legal risk as a recipient, Mähl first pointed to where the obligation sits. "We are not the subject of this specification decision," he said. On the prohibition on re-identification: "We are not, obviously, because as a privacy search engine, it's not something that we would do in the first place."

Pricing: a ceiling built on Alphabet's numbers

Ribera Martínez summarised the Commission's interpretation of FRAND pricing as an incremental cost model in which beneficiaries pay only the direct costs Alphabet incurs plus a reasonable return on capital employed. Mähl endorsed the principle. Incremental cost plus a modest return "is the right reading of FRAND," he said, because "beneficiaries pay the genuine cost of sharing and no more."

The decision's formula, according to PPC Land's July report and its later review of the full text, lets Alphabet recover the incremental costs of preparing, storing and transmitting the dataset, plus a return capped at Alphabet's weighted average cost of capital. Overheads, sunk costs, speculative risks, ordinary compliance costs and legal dispute costs are excluded. A fixed fee covers one-off costs and a variable fee covers recurring ones. Alphabet may depart from that formula in two situations: where it cannot recover its efficiently incurred collection costs, and for beneficiaries operating at very large scale, defined by the DMA's gatekeeper thresholds of at least 7.5 billion euros in EU turnover over three years or 75 billion euros in market capitalisation. In those cases it may add a margin no higher than the operating margin of its Google Search business. Micro, small and medium-sized enterprises never pay more than cost plus the capped return.

Mähl's worry was the inputs. "The costs that are to be reported are largely the figures coming from Google themselves," he said, and they "have to be scrutinized, not taken as the ultimate truth in themselves simply because of the incentives that Google has in this context." The same applied to the margin exception. "These costs can be inflated in a way that would make the final pricing higher than it should be."

"One thing we would have liked to see in this specification decision is to actually have a cap to this reasonable return simply because they would have provided a lot more certainty to the beneficiaries around pricing and would have avoided disputes," he added.

The decision does set ceilings: the weighted average cost of capital for the standard return, and Google Search's operating margin for the exception. Both, however, are figures drawn from Alphabet's own finances rather than fixed numbers written into the decision. Mähl did not say in the interview what form of cap DuckDuckGo would have preferred. Final pricing is due in January 2027, so the first real test of the formula has not yet arrived.

A thin escalation path

Disputes over price or filters, Mähl argued, have nowhere quick to go. "If we disagree as recipients on cost, but also on the filters for anonymizing, for instance, and some other things that are to a certain degree in Google's control, our path for escalation is pretty thin," he said.

He contrasted the Google decision with the Commission's March 19, 2025 specification decisions on Apple's interoperability obligations, which he said "included really tight, multi-step procedures." In Google's case, "We see no auditing requirement being imposed on the one company that has the most incentive to actually undercomply. And we also see few escalation paths for recipients."

Recipients can always complain to the Commission, Mähl acknowledged, but "the Commission has quite a lot of fish to fry these days on the DMA." The Google workload alone is considerable. A week after the data-sharing decision, the Commission fined Google 890 million euros in two non-compliance cases on search self-preferencing and Google Play steering, and the self-preferencing decision carries cease-and-desist orders covering nine services. What DuckDuckGo wants instead, Mähl said, is "a fast and binding way to contest the price if necessary."

Neither the Commission's July announcement nor Google's program page for licensees describes a dedicated dispute procedure. The Commission said only that the decision sets out a transparent process for access.

The US version goes further

The same data is the subject of a separate remedy in the United States. Judge Mehta found in August 2024 that Google had illegally maintained its search monopoly, ordered remedies on September 2, 2025, and entered a final judgment on December 5, 2025. Google filed its notice of appeal on January 16, 2026. The judgment runs for six years and is overseen by a five-person technical committee. It requires Google to give qualified competitors access to user-side data and its web search index, and to offer syndication of its search results, with usage capped at 40 percent of annual US queries in the first year and declining over the five-year licence.

"They are a bit behind in terms of timeline compared to the EU," Mähl said. In Europe, data could be flowing "from next year onward"; in the US, the technical committee has been working since it was constituted earlier this year, and "the case is subject to appeal."

He described the two regimes as overlapping on click and query data, which the US judgment calls user-side data. "We're talking about a very similar dataset and in fact, you could even argue the same dataset," he said, and a similar anonymisation approach could serve both, adapted to each legal system.

The US remedy, though, adds two elements the DMA lacks. The first, as Mähl described it, is "a snapshot, a one-time picture of the Google index, which carries a lot less privacy risk and gives rivals the precious information of like where to crawl the web, what URLs are actually useful." The second is syndication, under which competitors can send a query to Google and use the results in their own engine. Mähl called that "a bit limited because it's capped at 40% of the query volume" and tied to Google's best ordinary commercial terms, which he said companies generally cannot see. He expects the technical committee to have a role in establishing what those terms are.

The broader point, in his view, is that both jurisdictions reached the same diagnosis. "You cannot make search contestable without opening that up in a way," Mähl said. DuckDuckGo called for syndication to be added to the DMA during the Commission's first review of the regulation, whose results the Commission published in April 2026 with the conclusion that the law remained fit for purpose. Mähl said syndication remains "absolutely relevant in the age of AI-powered search engines."

What happens next

Google has already put the first steps of the EU regime in place. Its program page for the Google European Search Dataset Licensing Program, last updated on September 4, 2026, lists the eligibility criteria the decision set: at least two consecutive years operating a search engine in the EU, or founding within the last two years with more than 50 million euros in capital investment, plus at least 50,000 average monthly users in the EU over the past year. Applicants controlled by non-EEA states that pose serious cybersecurity or data protection risks, or by sanctioned persons, are excluded.

According to the page, Google offers the licensing agreement from September 17, 2026 and makes data samples available from November 16. Three tiers are planned: a free sample of 1,000 rows, a synthetic dataset of up to 10 million queries for a fee, and a paid 5 percent sample of the full dataset that requires a Level 1 assurance report. Google says it responds to expressions of interest within seven calendar days. Prices are not published and will be given to applicants later.

The Commission's schedule has Google finalising the dataset in November 2026 and setting final prices in January 2027, the month sharing is due to begin. Data will arrive in daily batches with a minimum latency of seven days, and each recipient can choose an access period of up to five years.

How DuckDuckGo would measure success

Ribera Martínez closed by asking for a single metric. Mähl offered two levels.

The first is uptake, and whether it lasts. He recalled that the Commission's July announcement and Q&A found "no meaningful uptake of the terms that Google put out before this specification decision." The question now is whether companies find the data "affordable enough, useful enough, worth the investment," given the cost of meeting the security standards and submitting to external audits. A company that "buys the data, makes the investment and then walks away from it a few months later because it realizes that it's actually effectively useless" would not count as success, he said. Alongside uptake, he would track how many concerns recipients raise with the Commission and how quickly they are resolved.

The second level is the market itself. "Are we seeing rivals actually effectively building on it? Are we seeing competition at the search infrastructure level developed, are we seeing viable indexes out there competing against Google," Mähl asked.

Why it matters for search marketers

For advertisers, the data-sharing order is not a targeting tool. Paid-result URLs are excluded from the dataset, and recipients are barred from using it to build advertising or profiling products. Its relevance lies in the distribution of search itself. Google's share of EU search has stayed above 90 percent for years, and earlier DMA measures have done little to move it: browser choice screens added an estimated 6 million Firefox users while leaving Google at about 90 percent, according to a University of Antwerp study PPC Land covered in July.

The Commission's bet, which Mähl shares, is that better access to rare queries would let rivals answer the searches where Google's advantage is largest. If that happens, more query volume could shift to engines whose ad inventory is not sold through Google Ads. AI chatbots with search functions are also eligible recipients and may use the data for real-time retrieval, though not to train general-purpose models. The order follows years of pressure, including a March 2026 letter from 18 European industry and consumer groups urging Brussels to act on Google's search compliance.

Whether any of that materialises depends on the questions Mähl raised and that the decision leaves partly open: what Google charges, how strictly it applies the filters, and how quickly the Commission settles disputes once data begins to flow in January 2027. Uptake under Google's previous offer amounted to a single licensee. The next uptake figure will be the first measurable sign of whether the new terms have changed that.

Timeline

Summary

Who: Aurélien Mähl, Lead Public Policy Manager at DuckDuckGo, a search engine that would be a recipient of the data, interviewed by Alba Ribera Martínez, host of The Binary Agora podcast. Google, the European Commission and the US court overseeing the search remedies are the other parties.

What: Mähl said the Commission's anonymisation method for Google search data under Article 6(11) of the Digital Markets Act is conceptually close to DuckDuckGo's own proposal and far more useful than Google's original filter, which removed more than 99 percent of distinct queries. He warned that Google is not externally audited on the filters and costs it reports, that pricing depends on Google's own figures, and that recipients have a thin path to escalate disputes.

When: The episode was published on October 13, 2026. The Commission adopted the decision on July 16, 2026, and data sharing is due to begin in January 2027.

Where: The European Union, with comparisons to the US remedies ordered by Judge Amit Mehta in Washington.

Why: Google's search share in the EU has stayed above 90 percent, and the Commission's order is meant to let rivals improve results on rare queries. Whether it works depends on pricing, filtering and enforcement that, according to Mähl, rest heavily on figures Google supplies itself.