A senior Google scientist sent a formal warning on Tuesday to European Union antitrust regulators, saying their plan to require Google to share search engine data with rivals such as OpenAI risks revealing private information about users.
In written comments to regulators, Sergei Vassilvitskii - who has held the title of distinguished scientist at Google since 2012 - said the Commission's proposed approach to anonymization was insufficient. He underlined the vulnerability by noting that Google's AI red team was able to re-identify users from the proposed anonymized dataset in less than two hours.
Vassilvitskii is scheduled to meet with EU antitrust officials on Wednesday to outline his concerns in person and to propose a broader approach with stronger guardrails to protect user privacy. The meeting follows a set of measures the European Commission published about a month ago, which would require Google to give rival search engines access to search-related data - including ranking, query, click and view data - on fair, reasonable and non-discriminatory terms.
The Commission acts as the EU's competition enforcer and has in recent years pursued legislation aimed at curbing the market power of large technology firms. That push to open up markets and provide consumers with more choices has, according to the material presented to regulators, at times provoked criticism from the U.S. government.
Google has reacted angrily to the proposal, calling it regulatory overreach that could endanger user privacy and security. Vassilvitskii framed his engagement as an offer to collaborate, saying the company is "eager to share our technical expertise and work with the EC to establish the right guardrails and protect Europeans from privacy harm."
The red team referenced in Vassilvitskii's statement is an internal group at Google that simulates adversarial activity to surface vulnerabilities, weaknesses and practical fixes. The group's finding that re-identification was possible in a short timeframe is central to Google's objection to the Commission's proposed anonymization techniques.
Regulators are currently soliciting feedback and will finalise the measures in the coming weeks. Under the Digital Markets Act (DMA), the Commission must decide by July 27 on the exact obligations Google will face. If Google fails to comply with the final rules, it could be deemed in breach of the DMA and face a penalty of up to 10% of its global annual revenue.
The Commission's proposal aims to give smaller rivals greater access to data that has been critical to Google's dominant position in search. The measures would cover datasets used to determine rankings and user interactions, and are intended to be provided on fair, reasonable and non-discriminatory - FRAND - terms. Proponents argue these steps are designed to foster competition and increase user choice, while critics warn about potential unintended consequences for privacy and security.
Vassilvitskii's outreach to EU antitrust officials represents the most direct scientific critique so far of the Commission's technical approach. He plans to present alternative options and more robust safeguards during Wednesday's meeting. Regulators will weigh that input alongside responses from other interested parties before issuing the final text of the obligations that will govern data sharing.
Context and next steps
The Commissioner’s measures are in a draft state and will be updated following stakeholder feedback. Google has made clear it will press for modifications, citing privacy and security concerns substantiated by its internal testing. The Commission must translate the draft into binding requirements by late July, and any failure to comply could trigger significant financial penalties under the DMA.