Google no longer gets to decide, alone, what happens when you long-press the home button

On July 16, the European Commission adopted two final specification decisions against Alphabet and Google under the Digital Markets Act. One, under Article 6(7), orders Google to open exactly 11 Android features to rival AI assistants on the same terms it gives Gemini. The other, under Article 6(11), orders Google to share anonymised Google Search data with eligible rival search engines and AI chatbots.

Here's the deal, and let's kill the biggest misconception up front: this is not a fine. It is not an infringement finding either. A specification decision is compliance guidance — the Commission telling a designated gatekeeper, "your DMA obligations already exist, and here is precisely how you must satisfy them." No penalty is attached to either decision. If Google fails to comply, that opens a separate non-compliance proceeding, and the DMA's theoretical ceiling there is 10% of global annual turnover. But that number is not stapled to what happened on July 16. Plenty of coverage smudges this line. We won't.

So why does it matter? Because until now, the seat labeled "AI assistant" on a smartphone was a chair only the OS owner could sit in. Long-press the home button, Gemini appears. Say the wake word, Gemini wakes. Read what's currently on screen to figure out context — Gemini only. Every other AI app on the store was a guest who had to be summoned by tapping an icon. Gemini was the landlord. What Brussels did this week is announce that the landlord's apartment is being converted into a share house.

That's the part worth watching. Whoever controls the assistant layer on the phone controls the next interface era — the layer where you stop opening apps and start telling something to do things for you. Brussels just decided that layer will not belong to Google alone.

The players — Brussels' tech sovereignty chief and Google's shield

The face of these decisions is Henna Virkkunen, Commission Executive Vice-President. Her full title is a mouthful: Executive Vice-President for Tech Sovereignty, Security and Democracy. The job exists, roughly, to stop Europe from becoming technologically dependent on American Big Tech. Her comment on the decisions, as reported by Euronews: "Thanks to these measures we hope to see emerging alternatives to Google Search and Google's AI services, such as Gemini, and that users in the EU can enjoy greater choice of services."

Notice the word Gemini in there. A regulator named a specific product and said, out loud, that it hopes alternatives to it emerge. That's not abstract market-structure language. That's an admission that this action is aimed squarely at the structural advantage Google's assistant enjoys by virtue of owning the operating system underneath it.

On the other side stands Kent Walker, President of Global Affairs at Google & Alphabet — the man Google has fielded on regulatory and litigation front lines for years. He published a rebuttal on Google's blog the same day, and the load-bearing sentence is this one: "Today's decisions risk undermining vital privacy and security guardrails for millions of Europeans."

Walker's argument compresses to five words: open the permissions, break the safety. He said specifically that the Android decision "threatens device security by granting external apps sensitive and powerful device permissions without these safeguards." And honestly? Look at the actual list of what's being opened and the worry isn't baseless. Reading what's on your screen. Reaching into other apps' on-device data. Running in the background after you've closed the app. Listening on the microphone permanently for a wake word. Those are all permissions with enormous blast radius if abused. The Commission's answer is a certification program gating who gets in — and how tight that gate turns out to be will decide whether this remedy works at all. Google has said it is weighing an appeal.

What actually happened — 11 features, four buckets, two deadlines

Start with the Article 6(7) decision. There are exactly 11 Android features Google must open, and the Commission clusters them into four groups.

Invocation — long-press of the home button or navigation handle, and always-on hotword detection. This is the "how do you summon the AI" channel. Until now it was Gemini's private driveway.

Context — centralised access to apps' on-device data, context-aware intelligence, and ambient data. These are the raw ingredients an assistant needs in order to know what you're actually doing right now, rather than starting every conversation from zero.

Actions — structured on-device integration, screen automation, and system integration. This is the part that lets an AI stop talking and start operating your phone. Everything people mean when they say "agentic AI" on mobile lives in this bucket.

Resources — system-level on-device models, on-device model implementation, and background execution. The Google models and compute already sitting inside the handset, plus the right to keep running after the user swipes away.

Now the timing, which most coverage flattens incorrectly. Most of the measures must ship with Android 18, by 1 August 2027 at the latest. But one item is carved out: concurrent hotword detection — multiple assistants each listening for their own wake word at the same time — is deferred to Android 19, by 1 August 2028 at the latest. Presumably that's an acknowledgment that several always-on listeners sharing one microphone pipeline is genuinely hard. Write "it all opens in 2027" and you've written it wrong.

And not just anyone walks in. There's a certification program. Draft eligibility terms are due 1 February 2027, final program terms and the start of applications land 1 May 2027, and each assessment must be completed within four weeks.

Second, the Article 6(11) search data decision. Google must share ranking, query, click and view data, anonymised, with qualifying rival search services on FRAND (fair, reasonable and non-discriminatory) terms. Excluded from the share: user account information, search histories, precise timestamps, very long queries, and paid result URLs. The anonymisation safeguards are dense — k-anonymity (the rule that any individual must be indistinguishable within a group of at least a certain size) is applied with a floor of 1,000 users per group, and the Commission notes that in practice 95% of users fall inside groups of at least 29,000. On top of that: suppression of rare and sensitive queries, removal of direct identifiers, contractual ringfencing, and outright bans on re-identification attempts.

Who can receive it? Genuine online search services — and crucially, AI chatbots with search functions count. The bar is 50,000+ monthly EU users, plus either at least two consecutive years of operating history or, for companies founded less than two years ago, more than €50 million in capital investment. Applicants must operate in the EEA under GDPR-equivalent protection and submit to independent audits before access and annually thereafter. Reuters-sourced reporting names OpenAI among the likely beneficiaries.

And the price? FRAND compensation covers incremental costs plus a return on capital that cannot exceed Alphabet's WACC (weighted average cost of capital). An exceptional margin may apply to large-scale operators, but explicitly not to micro enterprises or SMEs. The regulator, in other words, wrote the pricing formula itself.

Item Article 6(7) — AI interoperability Article 6(11) — Search data sharing
Adopted 16 July 2026 16 July 2026
Nature Specification decision (compliance guidance) — not a fine, not an infringement finding Same
Scope 11 Android features (invocation · context · actions · resources) Anonymised ranking, query, click and view data
Beneficiaries Third-party AI assistants and AI services Search engines + AI chatbots with search functions
Main deadline Android 18, by 1 August 2027 Final pricing offer January 2027
Carve-out Concurrent hotword detection → Android 19, by 1 August 2028 Prep milestones August, September, November 2026
Entry gate Certification program (draft 1 Feb 2027, applications 1 May 2027, 4-week review) 50,000 monthly EU users, or €50M investment if newly founded; independent audits
Exclusions / safeguards — No account info, search histories, precise timestamps, very long queries, paid result URLs; k-anonymity floor of 1,000
Compensation — Incremental cost + return capped at Alphabet's WACC (no exceptional margin for SMEs)

Worth pinning the search-data calendar too. By end-August 2026, the eligibility application form and a beneficiary webpage. In September 2026, template license agreements and test data samples. In November 2026, finalisation of the anonymised dataset. In January 2027, Google's final pricing offer. That last milestone is why outlets describe data sharing as beginning January 2027.

What each side gets — who walks through the door

The most obvious winners are AI assistant companies like OpenAI. Right now ChatGPT is an app, on iPhone and Android alike. You tap an icon to open it. It doesn't know what's on your screen. It can't follow you in the background. Gemini, being part of the OS, does all of that. Erasing that gap means assistant competition stops being rigged and starts being decided on something closer to merit — not just "whose model is better" but "who is allowed to reach into the phone." Add search data on top and you've drilled a hole in the moat Google spent two decades filling: click logs. A very large share of search quality comes from knowing which results humans actually clicked.

European search and AI startups win too. Look closely at how the eligibility rules are drafted and the intent is visible. The €50 million capital-investment alternate track for young companies. The rule barring an exceptional margin against SMEs. Both exist so that a small European firm can also afford to buy this data. That's exactly what "tech sovereignty" in Virkkunen's job title is for.

European users get choice. From roughly August 2027, on Android phones sold in the EU, it should in principle be possible to bind long-press-home to something other than Gemini. Across iPhone and Android alike, that has been effectively impossible until now.

So is Google purely a loser here? Not quite. Several defensive lines remain. Google, under Commission supervision, is the one drafting the operational detail of the certification program — and where the review bar sits determines how many companies actually get through. Search data isn't free either; Google can charge cost plus a WACC-capped return. Most importantly this is an EU-only measure. Android in the US and Asia is untouched, and running a "compliance edition" alongside a "global edition" is a maneuver Google knows well. Walker's security argument isn't purely defensive, either — it's a ready-made justification for setting certification thresholds high.

Precedents — what worked and what didn't

Start with choice screens. The EU has understood for a long time that defaults are market share — going back to the Windows browser ballot and continuing through Android search engine choice screens. The results were half a success. The screen appears, and most users tap the familiar name anyway. You can force a door open and people will still walk back into the room they already lived in. This decision carries the same trap. Being able to bind a different AI to the home button and people actually doing it are two completely different problems.

Now the counter-example, where intervention clearly bit. Post-DMA, Apple had to permit third-party app stores and alternative payments in the EU. That wasn't a nudge like a choice screen — it was surgery on the platform's plumbing, and the EU build of iOS genuinely diverges structurally from the rest of the world as a result. This Android decision is much closer to that second category. It doesn't tell Google what to display; it tells Google to expose APIs and system permissions. That's intervention at a far deeper layer.

There's also the lineage question. The EU has gone after Android before, with very large fines over bundling practices, and issued another major penalty over the adtech business in September 2025. But those are entirely separate matters. Those were after-the-fact punishments for established violations. This is an ex ante specification, handed over with no penalty attached, that says: build it this way. The whole philosophical bet of the DMA was replacing multi-year litigation with rules written in advance, and these decisions are the cleanest expression of that bet so far.

And the honest failure risk. August 2027 and August 2028 are geological timescales in this industry. By then the assistant competition may not look remotely like it does today, and regulation that arrives finished but obsolete is a repeat failure mode in platform policy. An appeal from Google could stretch the calendar further still.

How rivals counter

The most interesting name is Apple. This decision targets Android only, but the reasoning copy-pastes onto iOS without much editing. Siri invocation, screen awareness, access to on-device models — Apple reserves those privileges for its own assistant in exactly the same way. Apple has already been forced to restructure things in the EU multiple times under the DMA, so it is almost certainly reading this as "we're next." Apple's counter is always the same: argue security and privacy to shrink the scope of opening as far as possible, and where opening is unavoidable, route it through a certification process Apple itself controls.

OpenAI's counter-play runs in the opposite direction. Named as a likely top beneficiary, its interest is in clearing eligibility and attaching to the data and APIs as fast as possible. There's a trap here too, though. Building product for a door that only opens in one region costs money, and the audit and governance burden required to pass certification is not trivial. For a regulator-opened door to convert into real competitive advantage, OpenAI has to actually commit engineering resources to a Europe-specific Android integration.

Google's counter is already on the table — Walker's security frame. Keep pushing the narrative that opening these permissions endangers Europeans, and use it to set the certification bar high during the design phase. That's why 1 February 2027, the date the draft eligibility terms appear, is the real decisive moment. The decision says "open it." It could not fully specify "and make it this easy to walk through." Rarely has the devil lived so plainly in the details.

And there's one more quiet candidate for winner: Android OEMs like Samsung. Handset makers have long wanted to push their own assistants and kept hitting the ceiling that OS-level privileges belonged to Google. If that layer becomes a standard third-party API, OEMs gain real leverage over which AI gets the default seat. Picture Google, OpenAI and Anthropic bidding to manufacturers for assistant placement — the search-default contract model migrating to assistant defaults. That auction could open in Europe first.

So what actually changes

If you're a developer — put August 2027 on the calendar. From then, on EU Android, four layers of API (invocation, context, actions, resources) are open to third parties. Screen automation and background execution in particular are a genuine game-changer for anyone building agentic apps. But you must pass the certification program, and since draft eligibility terms land 1 February 2027, treat that document as the real spec release. Also budget for codebase divergence: these are EU-scoped capabilities, so you're maintaining a regional fork.

If you're an investor — the takeaway is that the barrier to entry in phone-based AI assistants has been lowered by regulation rather than by technology. Assistant competition on mobile was structurally unwinnable on model quality alone; in the EU, that structural advantage is being removed by law. Add search data access and the cost structure of search and AI startups shifts as well. Be careful, though, and the reasons are concrete: the deadlines sit in 2027–2028, Google is weighing an appeal, and the real width of the opening depends entirely on where certification thresholds land. This isn't an event that prices in this quarter — it's a multi-year regulatory track to monitor.

If you're a regular user — nothing on your phone changes today. If you live in the EU, from the second half of 2027 you will likely gain the option to route long-press-home or voice invocation to an assistant other than Gemini. Outside the EU, none of this applies to you directly. That said, there's a real chance Google decides maintaining two Androids is more expensive than promoting parts of the open interface globally. On privacy, the picture cuts both ways: it's true that powerful permissions are being extended to more apps, but the search data side is wrapped in the 1,000-user k-anonymity floor and the exclusion of account info, search histories and precise timestamps.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? If you're outside the EU, nothing directly — this applies to the European market only. The indirect path is real though: if Google decides that maintaining a separate EU Android build is more trouble than it's worth and pushes some of these open APIs global, then in a few years you may get to choose which AI answers your long-press too.

— What if Google just refuses to comply? This decision carries no fine on its own. But non-compliance opens a separate proceeding, and the DMA allows penalties of up to 10% of global annual turnover in that scenario. Google has said it's considering an appeal, and it's too early to say how much an appeal would delay the timeline.

— Is Kent Walker right that this makes phones less safe? The concern has a real basis. Screen reading, cross-app data access, background execution and always-on microphone detection are genuinely high-blast-radius permissions. That's exactly why the Commission attached a certification gate, and where that gate is set in the February 2027 draft is the thing to watch. Declaring it safe or unsafe today would be premature.

Sources

Numbers are as of announcement and may change.