TLDR Tech / InfoSec
The European Commission is turning Google Search into a privacy and national-security risk
The European Commission's draft DMA implementation would force Google to stream EU users' individual search queries, timestamps, location buckets, device classes, and click sequences to qualifying third parties via a daily API feed. The proposed sanitization collapses under trivial attack: the 50-signed-in-user threshold over 13 months allowlists query components for five years, so adversaries can mint persistent selectors by issuing target searches from 50 accounts, while 3 km² location buckets joined against destination logs expose named individuals, clinics, embassies, and government quarters, including the European Parliament and the EDPS. Hostile states could buy in cheaply by funding a formally compliant AI search wrapper or front company, turning the feed into one of Europe's largest mandated privacy and national-security risks of 2026.
Read the full story