EU vs Google: The DMA Battle Over Android, AI, and User Security

The DMA already requires that any integrity or security measures Google imposes on third-party access must be "strictly necessary and proportionate" — meaning Google cannot broadly block interoperability on security grounds without proving each restriction is narrowly tailored .

Search data sharing (Article 5(10))

A separate specification proceeding, also opened on 27 January 2026, addresses Google's obligation to provide third-party search engines and AI developers with access to its online search data — including data related to the Gemini AI model — on "fair, reasonable, and non-discriminatory" (FRAND) terms . Reuters reported that the Commission's guidance covers how rivals can access Google's search ranking data, click-and-query data, and AI-related services .

Cybersecurity and privacy concerns raised by Google and outside experts

Google's position

Google has argued that "Android is inherently open" and that it is "already sharing Search data with rivals in accordance with the DMA," but warned it is "apprehensive that a prescriptive approach may harm user security and privacy" . In a September 2025 blog post, Google stated the DMA is "making it difficult to protect users from scams and malicious links on Android by forcing us to remove our legitimate safeguards that protect users' security and safety," citing the risk that interoperability mandates force Android to weaken protections against sideloaded malware and phishing . Google has also complained that gatekeepers under investigation do not receive full access to the Commission's file, which it calls "inconsistent with the rights of defense" in EU law .

Outside expert and think-tank concerns

• ECIPE warned in a policy brief that Article 5(4) DMA could "force mobile operating system providers to allow unregulated external links, bypassing critical security controls and exposing millions of smartphone users to cyber threats" and that Android's "widely used open-source system may also be compromised by DMA enforcement, potentially limiting its flexibility, security, and innovation" .
• The Center for Cybersecurity Policy and Law published a paper warning that the DMA's push for interoperability "may weaken" mobile platform security controls as core functions are opened to outside developers who may not follow the same security standards .
• The Information Technology and Innovation Foundation (ITIF) submitted comments arguing the Commission's draft interoperability measures are too broad and could "undermine the security of the Android ecosystem" if third-party AI services are granted system-level access without commensurate security obligations .
• An arXiv computer science paper (February 2025) noted that "interoperability initiatives have generated significant controversy over their potential to introduce new security vulnerabilities, weaken platform defenses, and increase the attack surface available to malicious actors" .
• Stanford Law School's TTLF Working Papers observed that the DMA rulings "could significantly affect [platform] design and business models, with effects extending well beyond the geographical boundaries of the EU," deepening the transatlantic regulatory divide on security versus competition .

Broader context: EU competition goals vs. security considerations

The DMA's core tension

The DMA was designed to increase "market contestability in digital markets" and "create more room for innovation and more choice for consumers" . Its interoperability and data-sharing provisions are seen as essential to breaking platform lock-in, especially in the emerging AI market. The Commission's own two-year review (June 2026) concluded the DMA "remains fit for purpose and does not need to be revised" , signaling the EU's intent to press forward despite industry warnings.

Escalating regulatory confrontation

The specification proceedings against Google follow similar measures against Apple in 2025 over iOS interoperability for connected devices like smartwatches . This demonstrates a systematic regulatory push across both major mobile ecosystems. The confrontation is sharpest around AI: the Commission is effectively trying to prevent Google from using Android as a competitive moat for Gemini, just as the generative AI market takes shape. TNW described it as determining "whether artificial intelligence becomes the next great platform lock-in or the first to be broken before it sets" .

Conflict with other EU frameworks

ECIPE noted that "DMA enforcement is now also generating tensions with other EU regulatory frameworks, particularly in the areas of data protection, cybersecurity, intellectual property rights, and consumer protection" . The enforcement of interoperability obligations "illustrates these tensions particularly clearly" because what the DMA demands for competition may directly conflict with what the GDPR, NIS2 Directive, and Cyber Resilience Act require for security. The Commission acknowledges this tension in its own documents: the DMA allows integrity measures only where "strictly necessary and proportionate" , but critics argue the burden of proof rests on the gatekeeper, creating a chilling effect on proactive security.

Bottom line: The EU is pushing Google to open Android's core features and search data to competitors — especially AI rivals — while Google and numerous security experts warn the mandated interoperability will weaken malware protections, increase attack surfaces, and create conflicts with other EU cybersecurity laws.