Google warns that the EU's Digital Markets Act could increase fraud and risk de-anonymizing search queries, impacting user privacy.
Google's internal security team has issued warnings about potential risks associated with the Digital Markets Act (DMA) as the European Commission finalizes its oversight of Google Search and Android's compliance with the law. According to documents reviewed by WIRED, certain requirements of the DMA could lead to an uptick in fraud and the de-anonymization of user search queries.
The DMA, enacted in late 2022, mandates major tech platforms like Google to share their systems and data with competitors. Following a clarification from the European Commission in April, Google is expected to provide access to query texts, metadata, click information, and ranking results that mirror its own internal usage.
Heather Adkins, Google's VP of Security, expressed concerns that these provisions might adversely affect EU users. The company foresees an increase in fraudulent activities and warns that the sharing requirements could expose anonymized data, making it a target for cybercriminals.
While the European Commission advocates for strategies to mitigate risks, including prohibiting user re-identification and bolstering the security of sensitive data storage, Google finds these measures lacking. They argue the necessity for detailed data sharing increases vulnerability and that existing anonymization tactics may not withstand hacking attempts.
Security expert Lukasz Olejnik also critiqued the adequacy of data sanitization methods proposed. Conversely, DuckDuckGo supports the European Commission’s framework, claiming it aligns with current legal standards. Alice Cooper, from the Knight-Georgetown Institute, described the proposed system as comprehensive and suggested involving independent experts in its evaluation.
Additionally, concerns regarding Android's security were addressed by Eugene Liderman, who highlighted risks from granting extensive permissions to malicious entities. Interestingly, Google's apprehensions on this front appear to be echoed by Apple as well.
