The UK Competition and Markets Authority today imposed a formal conduct requirement on Google covering the use of publisher content in generative AI products, marking the first binding obligation the regulator has issued under the Digital Markets, Competition and Consumers Act 2024. The requirement, known as the Publisher Conduct Requirement, takes effect immediately as a legal instrument, with the substantive control obligations coming into force on 3 December 2026 - six months from today. It will remain in force until 10 October 2030, the final day of Google's current designation period under the Act.

The move is the culmination of a regulatory process that began in January 2025 when the CMA launched its strategic market status investigation into Google Search, the first such investigation under the 2024 Act. The regulator found Google accounts for more than 90 percent of all general search queries in the UK, with search advertising spending in the UK having nearly doubled from £8 billion in 2019 to £15 billion in 2023.

What the requirement actually demands

According to the CMA's formal notice, published today under section 19(1) of the Act, the Publisher Conduct Requirement contains nine numbered paragraphs covering three distinct areas: controls, transparency, and attribution. Taken together, the three elements are designed to ensure publishers have sufficient control, transparency, and trust over Google's use of their Search Content - defined in the notice as publisher content collected through Googlebot or any Google crawler fulfilling the function of crawling open web content for Google's general search - to enable them to make properly informed and meaningful decisions about whether and how they interact with Google in respect of its general search services.

The three areas map to three problems the CMA identified during its investigation: publishers had insufficient choice over the use of their content in Google's generative AI; they lacked transparency about that use; and attribution of their content when used in AI-generated responses was ineffective.

The scope: what counts as a generative AI service

Before the obligations apply, a precise boundary matters. The requirement covers two categories of product. Search generative AI features means Google's generative AI-dependent features offered within general search - specifically named in the notice as AI Overviews and AI Mode, along with the models used to generate responses in them. Broader generative AI services means Google's generative AI-dependent products and services offered outside of general search, such as the Gemini AI Assistant and the Vertex AI API, and the models used to generate responses in them.

The CMA's Interpretative Notes address one ambiguity in the definitions: the phrase "training" is clarified to include fine-tuning. This matters because fine-tuning and the base training of a model are technically distinct processes, and some stakeholders during the consultation raised concern that an obligation covering only training could be circumvented by shifting reliance to fine-tuning instead.

The territorial scope applies to the outputs of all generative AI services and features shown to any natural or legal persons located in the UK. Location is determined by the location reported by the user's device - a standard Google already applies across its services.

Google's conduct: the controls it must build

Paragraph 3 of the requirement is the operational core. Google must provide publishers with effective controls to withhold their Search Content from being used in generative AI services and features. Those controls must cover both training - including fine-tuning - and grounding of its broader generative AI services and its search generative AI features. Grounding is the process by which a live generative AI response is constructed by retrieving and incorporating real-time or indexed content, rather than relying solely on the statistical patterns learned during training.

Paragraph 4 imposes an additional granularity obligation specifically for the grounding of search generative AI features. Those controls must enable publishers to withhold their Search Content at directory-level and at page-level. A directory-level control would apply to an entire section of a website - for example, blocking use of all URLs under a specific subdirectory. A page-level control allows blocking at the level of individual URLs, one at a time.

Page-level controls have a separate implementation timeline. According to the final decision document, Google told the CMA during consultations that implementing page-level controls would require additional engineering work and would likely take longer than the six-month window provided for other obligations. The CMA accepted this and set a nine-month implementation period for paragraph 4 specifically, meaning page-level grounding controls come into force on 3 March 2027 rather than 3 December 2026.

Paragraph 5 adds two further obligations. First, the controls must evolve in an appropriate way as Google's generative AI services and features evolve. The CMA expects Google to keep the scope and operation of the controls under active review over time, and to extend them to new generative AI services and features as they are developed and released. Second, Google must not attempt to circumvent any publisher's choice to withhold its Search Content by acquiring that Search Content through other sources.

Google's own position on the engineering challenge

The requirement did not arrive without resistance. A senior Google executive described the challenge of building opt-out controls as a "huge engineering project" at the FT Strategies conference in London on 11 February 2026. The specific difficulty, as described at the time, was not building a mechanism to exclude content from Google Search entirely - that already existed - but rather building the ability to block content from appearing in AI Overviews and AI Mode while still having those pages indexed and ranked in conventional search results.

In subsequent discussions with the CMA, Google confirmed that it would be feasible to ensure that Search Content withheld through the Google-Extended control would not be added back into fine-tuning the models exclusively used in generating responses in search generative AI features - though it would not be feasible to remove Search Content already added into those models before the opt-out was applied. Google also confirmed that introducing page-level controls within general search was feasible but would require the nine-month implementation period.

Separately, Google told the CMA it expected to launch aspects of the new search generative AI features control in June 2026. According to the final decision document, Google's announcement in March 2026 - that it was developing updates to its controls to let publishers specifically opt out of generative AI features in Search - indicated that the onerousness of implementing controls required by the Publisher Conduct Requirement was unlikely to be high.

The Google-Extended control, which already operates on a global basis and covers the training of models underlying outputs to UK end users, forms the starting point for the training obligation. According to the final decision document, Google told the CMA it does not anticipate needing to build an additional control for training, since the requirement can build on the existing Google-Extended architecture. Extending that architecture to include fine-tuning will likely share engineering work with the developments needed to implement the grounding elements of the control.

Google's conduct: the anti-retaliation clause

Paragraph 9 of the requirement is written in unusually direct terms. Google "shall not seek to prevent publishers from, or penalise them for, using the controls described in paragraph 3, for example by downranking their Search Content, or otherwise disadvantaging them, relative to opted-in Search Content, in general search outside of search generative AI features."

The CMA's Interpretative Notes elaborate on what this means in practice. According to those notes, Google must not maintain or introduce ranking signals whose purpose is to downrank, relative to opted-in content, publishers' Search Content in general search outside of search generative AI features as a result of their choice to opt out. The CMA recognises that Google may not be able to control for all possible second-order effects of the controls on its overall ranking algorithm, but the prohibition applies to deliberate action. Opting out of AI features must not cause a publisher to lose features such as snippets in conventional search results.

The anti-retaliation provision has a narrow carve-out. The CMA states Google does not breach paragraph 9 if it promotes to publishers the benefits of being included in search generative AI features, or if it negotiates an agreement with a publisher in relation to that publisher's use of the controls.

This clause directly addresses a problem that PPC Land has tracked in detail since October 2025: publishers who attempted to block AI features faced an all-or-nothing choice, either allowing full participation or opting out of "rich experiences" entirely, substantially reducing visibility in standard search results. The new requirement draws a clear line under that structure.

Google's conduct: transparency obligations

Paragraph 6 of the requirement obligates Google to publish what the CMA terms Explanatory Information - defined as information that is clear, comprehensible, and presented in a user-friendly format - covering two subjects. First, how Search Content is used for the training and grounding of its generative AI services and features. Second, the effect and scope of the available controls.

The CMA's Interpretative Notes specify what Explanatory Information for controls should include: a description of each control and its overall purpose, the key exceptions and limitations to its scope, and an explanation of the publisher content the control covers. This information should be published in an accessible location and format, publicised and directed to publishers when queries are raised about the use of Search Content, and kept up to date as Google's product offerings evolve.

The term "Explanatory Information" was introduced specifically to clarify that Google is not required to disclose trade secrets. According to the final decision document, the CMA introduced the concept to balance the need to ensure publishers are informed against the risk that transparency obligations could require disclosure of the inner workings of Google's generative AI systems. Commercial information may be excluded where its disclosure might significantly harm Google's legitimate business interests - but Google must inform the CMA of any such exclusions and explain why they were made. The fact that a disclosure might affect a publisher's decision to opt out, or that Google does not currently disclose such information, does not in itself constitute significant harm.

Google's conduct: the metrics publishers must receive

Paragraph 7 goes further than transparency about controls. Google must provide publishers with "clear and detailed metrics on user engagement with their Search Content where it is used in its search generative AI features."

The CMA's Interpretative Notes specify three categories of data that must be included. First, user impressions: data on the display of a publisher's Search Content as part of a search generative AI feature in response to a user query, including data on where within that feature the publisher's content is attributed. Second, user engagement with the publisher's Search Content: click-throughs to the publisher's website from links in search generative AI features, along with a means by which publishers can easily identify those clicks and assess their quality. Third, click-through rate: the percentage of users who click on a link to a publisher within a search generative AI feature where that publisher's content has been displayed.

Three additional conditions govern how data must be provided. It must be on a disaggregated basis for each publisher individually. It must be fully disaggregated from other elements of general search, such as organic results. And it must be provided through a commonly accessible platform - the Interpretative Notes name Google Search Console as an example.

The CMA declined to mandate per-feature data separating AI Overviews from AI Mode. According to the final decision document, Google submitted that AI Overviews and AI Mode are increasingly operating as a unified experience rather than siloed features, with users moving between them while maintaining query context. Google argued that distinguishing impressions and clicks by individual feature would not accurately reflect user behaviour, and submitted that [] - the CMA redacted the specific metric - would make feature-level reporting highly volatile and difficult to compare over time. The regulator accepted this position, though it retained the requirement for disaggregation from organic search results as a whole.

Google today also launched dedicated Search Generative AI performance reports in Search Console, covering AI Overviews, AI Mode, and generative AI features in Discover, with impressions, pages, countries, devices, and date granularity data. According to PPC Land's reporting on that announcement, the new reports track impressions but clicks are not mentioned explicitly in the five data categories described - a gap that will be relevant to the CMA's assessment of compliance with paragraph 7's click-through rate obligation.

The absence of granular per-feature attribution in Search Console until today is part of a longer story. A Search Console impressions bug ran for nearly a year from May 2025 onward, inflating impression data across the platform. Publishers attempting to assess AI feature performance were, until today's announcement, working from data that mixed conventional search, AI features, and corrupted impression logs - a fragmented picture that the CMA requirement is designed to correct structurally.

Google's conduct: attribution of sources in AI responses

Paragraph 8 addresses how AI-generated responses must credit the content they draw upon. Google must take reasonable steps to ensure that Search Content in search generative AI features is attributed clearly and accurately, and that end users are provided with a clear means to access that Search Content. The requirement explicitly acknowledges the tension with other product considerations: attribution must take account of the need to reflect broader end-user experience, design aesthetics, and source diversity.

The phrasing reflects a deliberate choice by the CMA. According to the final decision document, several stakeholders during the consultation argued for mandating "prominent" rather than "sufficient" attribution, or for setting a minimum standard. Google pushed back, arguing that requirements could lead to fewer clicks rather than more, and raised concerns about the inherent difficulty in determining which sources make a significant contribution to a response. The CMA responded by removing the phrase "sufficient attribution" and replacing it with clearer language specifying that end users must have a clear means to access the Search Content - without prescribing the specific design approach Google must use.

Paragraph 8 also requires Google to publish Explanatory Information explaining the steps it takes to meet the attribution requirement and to ensure and measure the factuality of search generative AI features. According to the Interpretative Notes, this should include how Google identifies what Search Content to attribute in its search generative AI features, and the steps it takes to monitor the accuracy of its attributions and what steps are available for publishers to identify Search Content that has not been attributed accurately.

The CMA declined to require Google to publish factuality metrics. According to the final decision document, the regulator recognised that doing so could place Google at a competitive disadvantage, as third parties would not be able to make an informed decision about the relative factuality of different services if only Google faced such disclosure requirements.

Google's conduct: the open-source dataset question

One contested element in the consultation concerned whether Google could circumvent publisher opt-outs by acquiring their content through open-source datasets. Many stakeholders submitted that allowing Google to acquire Search Content through open-source datasets could enable it to ignore publisher opt-outs, referencing Google's use of datasets whose legality is contested or unclear.

The CMA's Interpretative Notes address this directly. The CMA considers it would be reasonable for Google to acquire Search Content through open-source datasets, where those datasets have obtained content legally, given the nature of such sources. However, Google must not knowingly pay a third party to crawl the website of a publisher that has opted out of its Search Content being used by Google through these controls.

The distinction matters. It means a publisher's opt-out is protected from deliberate circumvention through paid proxies. It does not mean Google is prohibited from incorporating that publisher's content if it surfaces in a lawfully assembled open-source dataset that anyone can use.

The broader context: a product line that keeps expanding

The Publisher Conduct Requirement does not exist in isolation. It arrives as Google's AI Mode surpassed one billion monthly active users globally as of May 2026, with queries more than doubling every quarter since launch. On 19 May 2026, at Google I/O 2026, the company upgraded AI Mode with Gemini 3.5 Flash, introduced persistent background information agents, redesigned the search box for the first time in more than 25 years, and expanded Personal Intelligence - which incorporates a user's Gmail, Google Photos, YouTube history, and Search history into AI responses - to nearly 200 countries.

According to the CMA's final decision document, the regulator states it will actively monitor the implementation of these and any other changes, noting the statutory obligation to keep the Publisher Conduct Requirement under review. The CMA specifically flags that the development of agentic AI could affect how Google uses publisher Search Content in future - a forward-looking concern that the requirement is designed to accommodate through paragraph 5(a)'s obligation to evolve controls alongside new generative AI services and features.

The CMA notes that if needed, it will bring forward work on further measures to ensure a fair exchange of value between Google and publishers - a signal that the Publisher Conduct Requirement may not be the last intervention in this area.

The compliance machinery: nominated officer and reporting schedule

The compliance reporting structure, set out in the Notice under section 84(3) of the Act, is built around three distinct reporting periods. The first covers 3 June 2026 to 3 December 2026, with a report due by 3 January 2027. The second covers 4 December 2026 to 3 June 2027, with a report due by 3 July 2027. From 4 June 2027 onward, Google must submit annual reports due within one month of the end of each 12-month period. The schedule repeats annually for as long as the Publisher Conduct Requirement remains in effect.

Each report must be submitted by a Nominated Officer - a specific individual appointed by Google whose identity must be notified to the CMA within the first month of receiving today's notice. The Nominated Officer is responsible for monitoring Google's compliance with its digital markets requirements and securing that Google complies with respective compliance reporting requirements. Reports must be submitted via email to searchsms@cma.gov.uk.

Each compliance report must contain, at minimum, four categories of content. First, a comprehensive explanation of the extent to which the Nominated Officer considers Google has complied with the Publisher Conduct Requirement, including any supporting data and internal documents. Second, for the controls obligations, an explanation of each control offered, data on publishers' use of each control, and steps taken to ensure controls function as intended. Third, for the transparency and attribution obligations, copies of all versions of Explanatory Information published during the reporting period. Fourth, a declaration from the Nominated Officer that they have taken reasonable steps to satisfy themselves that the information contained in the report is complete and accurate.

The CMA expects to issue a subsequent notice requiring Google to publish a summary or non-confidential version of each compliance report on Google's own website in a clear, accessible position. Google must also provide a written plan to the CMA on how it intends to comply with the Publisher Conduct Requirement within one month of receiving today's notice.

Compliance reporting starts at six-month intervals for the first year, then shifts to annual reporting, subject to the CMA being generally satisfied with Google's compliance. The regulator states this approach allows it to reduce the reporting burden where compliance appears satisfactory, while preserving the ability to increase oversight if concerns arise.

The Publisher Conduct Requirement arrives in a field already crowded with litigation and regulatory proceedings. Penske Media Corporation filed a 101-page federal antitrust lawsuit against Google in the US District Court for the District of Columbia on 12 September 2025, alleging Google systematically coerces publishers into providing content for AI systems while reducing website traffic. The Penske Media complaint covers Rolling Stone, Variety, Billboard, The Hollywood Reporter, Deadline, and 10 other media entities collectively attracting more than 120 million monthly US visitors.

A US federal judge dismissed a separate publisher antitrust case on 20 March 2026 - the Helena World Chronicle case - finding the plaintiffs lacked standing to bring the claims they advanced. However, the court did not rule on whether the use of publisher content for AI training constitutes a distinct anticompetitive act, leaving that legal theory unexplored.

At the European Commission, a formal antitrust investigation launched on 9 December 2025 is examining whether Google violated EU competition rules by using publisher content for AI purposes without appropriate compensation or viable opt-out mechanisms. The CMA notes in its final decision document that it will continue to take account of developments in other jurisdictions as part of its ongoing monitoring.

Australia has taken a different legislative approach. A News Bargaining Incentive framework introduced by the Australian government in April 2026 proposes a charge equal to 2.25 percent of Australian revenue for large digital platforms that fail to enter commercial deals with news publishers - a levy-and-offset model rather than a direct conduct requirement.

Why today's decision matters for digital marketing

The metrics obligation in paragraph 7 is the element most directly relevant to digital marketing practitioners. Publishers, advertisers, and agencies have been operating in what Martin Splitt of Google described in June 2025 as the "Great Decoupling" - a structural separation between impressions and clicks that began when AI Overviews became standard in search results. Websites receive more impressions; they receive fewer clicks. Research from Ahrefs published in February 2026, examining 300,000 keywords using aggregated Search Console data, found that AI Overviews now correlate with a 58 percent reduction in click-through rates for top-ranking pages.

For media-buying decisions, the click-through rate data the requirement mandates will be significant. Advertisers placing budgets on publisher inventory depend on understanding whether that inventory is generated through genuine user intent from search referrals or through AI-mediated traffic patterns that behave differently in conversion terms. Index Exchange data published in April 2026 found that 69 percent of publishers experienced year-over-year ad opportunity declines throughout 2025, a decline directly tied to the impact of AI features on search referral volumes.

The requirement also matters for the structural question of what kind of content gets created and survives economically. The CMA's final decision states explicitly that the Publisher Conduct Requirement is expected to support the viability of web publishers' business models and the contestability of general search and adjacent activities, by levelling the playing field on access to publisher content. Blocking AI crawlers through robots.txt cost news publishers 7 percent of their traffic on average, while small publishers broadly lost 60 percent of search traffic over two years as AI features reshaped search result pages. The requirement introduces a structural corrective: publishers can now opt out of AI features without paying a search visibility penalty, and must receive the data needed to make that decision on an informed commercial basis.

For brands, agencies, and the publishers whose inventory they buy, the enforcement period from December 2026 onward will be the first test of whether opt-out controls - combined with disaggregated engagement metrics - actually shift the distribution of content across AI search features, and whether that shift alters the traffic and revenue patterns that digital advertising budgets depend on.

Timeline

Summary

Who: The Competition and Markets Authority, acting under the Digital Markets, Competition and Consumers Act 2024, imposed a conduct requirement on Google. The requirement affects all publishers - defined as any party that makes content available on the web - whose Search Content is used in generative AI features shown to users located in the UK. Google must appoint a Nominated Officer within one month and submit an implementation plan within the same timeframe.

What: The Publisher Conduct Requirement obliges Google to provide effective opt-out controls over the use of publisher content in AI Overviews, AI Mode, the Gemini AI Assistant, and the Vertex AI API, covering both training (including fine-tuning) and grounding. It requires Google to publish clear Explanatory Information about how publisher content is used, provide disaggregated engagement metrics - including impressions, click-throughs, and click-through rate - through a platform such as Google Search Console, ensure clear and accurate attribution of source content in AI-generated responses, and refrain from penalising publishers who exercise the opt-out controls by downranking or disadvantaging their content in conventional search.

When: The CMA issued the notice on 3 June 2026. Main control obligations come into force on 3 December 2026. Page-level grounding controls follow on 3 March 2027. The first compliance report is due by 3 January 2027. Annual reporting follows thereafter. The requirement runs until 10 October 2030.

Where: The requirement applies to outputs of generative AI services and features shown to any natural or legal person located in the UK, with location determined by device-reported location. All publishers globally whose content is used in AI features shown to UK users are covered, regardless of where those publishers are based.

Why: The CMA found that Google's strategic market status in UK general search - with over 90 percent query share - left publishers without a realistic option to refuse crawling without losing search visibility, creating a structural imbalance. Publishers had insufficient choice over how their content was used in AI, lacked meaningful transparency about that use, and could not assess whether attribution of their content in AI responses was accurate. The requirement is designed to restore informed commercial decision-making for publishers at a moment when AI Mode alone has surpassed one billion monthly users and the content that feeds those responses remains the core raw material of the entire system.