Eleven Android features, two decisions, and zero user-visible change for at least six months

On July 16, 2026, the European Commission adopted two binding specification decisions addressed to Alphabet and Google under the Digital Markets Act. One covers Android. One covers Google Search data.

Compressed to a sentence: Google must open eleven named Android features to third-party AI assistant providers, and it must hand anonymised Search data to rival search engines and to AI chatbots that offer search functionality, on FRAND — fair, reasonable and non-discriminatory — terms. The end state the Commission is describing is a European Android phone where long-pressing the home button summons ChatGPT or Claude or Perplexity instead of Gemini, and that assistant can actually do things on the device rather than just talk.

Here's the deal, though, and it's the part that got lost in most of the headlines: not one user-visible change from these decisions arrives in 2026. Search data sharing starts in January 2027. Ten of the eleven Android features must ship in the next major release, Android 18, by 1 August 2027. The eleventh — concurrent always-on hotword detection, so multiple assistants can listen for their wake word at the same time — is deferred an entire generation to Android 19, by 1 August 2028. This is not an announcement that something changed. It's a document specifying deadlines by which something must change.

One more piece of framing that matters legally. These decisions do not create new obligations. A specification decision under the DMA takes an obligation that is already in force and prescribes exactly how the gatekeeper must implement it. Decision 1 rests on Article 6(7) — interoperability with operating-system hardware and software features. Decision 2 rests on Article 6(11) — access to anonymised online search data. Both already applied to Google. What the Commission did on July 16 was write the implementation spec itself, after concluding Google's own proposal wouldn't do. And the consequence of that is sharper than it sounds: from here, failure to comply is a breach that can be prosecuted directly, with no argument left about what compliance means.

The cast — two commissioners, one very unhappy company, and beneficiaries nobody named

On the Commission side, two executive vice-presidents fronted this. Teresa Ribera, EVP for Clean, Just and Competitive Transition, holds the competition portfolio. Henna Virkkunen, EVP for Tech Sovereignty, Security and Democracy, holds the digital brief. Ribera's line: "We need to keep that process fair and ensure that our citizens have choice." Virkkunen's: "We want to support innovation and diversity in the European Union, enabling fair competition in the markets of AI assistant[s]." Mild sentences, attached to a legally binding engineering specification with dated milestones.

Google's response came the same day from Kent Walker, President of Global Affairs at Google and Alphabet, under a headline that is itself the argument: "The DMA should not undercut security & privacy for Europeans." Walker wrote that "today's decisions risk undermining vital privacy and security guardrails for millions of Europeans." On the Android side specifically: "This Android ruling threatens device security by granting external apps sensitive and powerful device permissions without these safeguards." On search data: "Europeans' private searches would be exposed to unfamiliar companies, without adequate anonymisation of the data and without user knowledge or consent." He closed with "we will continue advocating for a balanced approach that protects privacy and security while supporting market goals." Google separately said it had "repeatedly offered solutions to safeguard users."

Some quick context on who Google is in this fight. Founded in 1998 by Larry Page and Sergey Brin; Alphabet created as the holding company in 2015. Android was acquired in 2005 and is now the most-used mobile OS on earth. Gemini launched in December 2023 as the flagship model family and has been progressively wired into Android as the default system assistant, displacing Google Assistant. Alphabet is a multi-trillion-dollar company whose profit engine remains search advertising — which is precisely the asset the Article 6(11) data remedy is aimed at. Google holds over 90% of EU search. The flywheel the Commission is trying to break is simple and brutally effective: share drives query volume, query volume drives ranking quality, ranking quality drives share.

Now the important nuance about who benefits. The Commission's decisions specify recipients as a category — rival online search engines, plus AI chatbots that offer search functionality. No company is named. So a sentence like "OpenAI will now get Google's search data" is not accurate as stated. OpenAI (ChatGPT), Anthropic (Claude), Perplexity, Microsoft (Bing/Copilot), and EU-based engines like Ecosia and Qwant are plausible illustrative beneficiaries, not designated recipients. Each of them would have to clear eligibility thresholds and apply.

The regulatory clock is a character here too. The Commission opened both specification proceedings on 27 January 2026, committing to issue preliminary findings within three months and conclude within six — roughly by 27 July. The July 16 decisions land just inside that window. The trigger for opening proceedings was blunt: Google's own compliance proposal was assessed as ineffective. Regulators found it stripped out "between 90 and 100 percent of unique search queries" and excluded AI chatbots from the sharing regime entirely. When the negotiated version fails that badly, the regulator writes the spec.

What the decisions actually say — four buckets, one pricing formula, and a set of thresholds

Decision 1: Android AI interoperability. Google must open eleven named Android features to third-party AI assistant providers so they can compete with Gemini on functionally equivalent terms. The eleven sort into four buckets.

Invocation (2): long-press of the home button or navigation handle; always-on hotword detection. Context (3): centralised access to apps' on-device data; context-aware intelligence; ambient data. Actions (3): structured on-device integration; screen automation; system integration. Resource access (3): system-level on-device models; on-device model implementation; background execution.

Read that list again and Google's objection becomes legible. Invocation is just a doorway. But context and actions together amount to permission to read and operate the entire device. Centralised access to apps' on-device data means one place to see messages, calendar entries, photo metadata. Screen automation means the assistant taps through your apps on your behalf. Until now that permission bundle effectively belonged to Gemini alone. The decision says: certified third parties get it too.

The Commission's own illustrative use case, verbatim: "Users will be able to use third-party AI assistants to perform actions in apps on their behalf. For instance, they will be able to delegate tasks such as booking a taxi, receive suggestions for relevant replies in chat apps, or ask the AI assistant about a recently visited place."

The process around it is unusually specific. Ten features land in Android 18 by 1 August 2027; concurrent hotword detection in Android 19 by 1 August 2028. Google must publish draft terms of an eligibility/certification programme for consultation by 1 February 2027, publish final terms by 1 May 2027, and begin accepting certification applications on 1 May 2027, with a maximum four-week assessment per application and a two-year enhanced compliance-monitoring and reporting period.

Decision 2: search data sharing. From January 2027 Google must share anonymised Search ranking, query, click and view data — covering both organic and paid results — with rival search engines and with search-capable AI chatbots, on FRAND terms.

Carve-outs are explicit: account information, precise timestamps, rare and long-tail queries that could re-identify users, exact location data, and paid-result URLs are all excluded. Anonymisation uses what the Commission describes as a "multi-layered method developed in close collaboration with privacy experts," aligned with the draft Joint Guidelines on the interplay of the DMA and GDPR.

It is not free. Pricing is a cost-recovery formula: preparation and transmission costs plus a reasonable return on capital, with that return capped at Alphabet's weighted average cost of capital. And it is not open to everyone. To be eligible a recipient must have run a genuine search service in the EU for at least two consecutive years, or be under two years old with at least €50M raised, plus a floor of 50,000 monthly average EU users.

Item Decision 1 — Android interoperability Decision 2 — Search data sharing
Legal basis DMA Article 6(7) DMA Article 6(11)
Who it's for Third-party AI assistant providers Rival search engines + search-capable AI chatbots (no company named)
Core obligation Open 11 named Android features Share anonymised ranking/query/click/view data (organic + paid)
Headline deadline 10 features → Android 18 by 2027-08-01; hotword → Android 19 by 2028-08-01 Sharing live January 2027
Interim milestones Draft certification terms 2027-02-01; final terms + applications open 2027-05-01; 4-week max assessment Eligibility forms end-Aug 2026; template agreements + test samples Sep 2026; dataset finalised Nov 2026
Terms Functional equivalence with Gemini; 2-year enhanced monitoring FRAND; cost recovery, return capped at Alphabet's WACC
Eligibility Pass Google's certification programme 2 years EU operation, or <2 years old with €50M+ raised; 50,000+ monthly avg EU users
Exclusions — Account info, precise timestamps, long-tail queries, exact location, paid-result URLs
What Google keeps — Proprietary ranking algorithms stay undisclosed

Google retains real defences inside Decision 2. It keeps a limited right to assess cyber-security and data-protection risk before sharing with a specific counterparty, annual audits apply, and recipients may use the data only to improve search quality — not for ad personalisation. Critically, Google does not have to disclose its ranking algorithms. The structure is: hand over the ingredients, keep the recipe.

What each side actually gets out of this

The Commission gets a precedent and a method. These two decisions mark the point where the DMA stops being a list of prohibitions and becomes a design specification. Traditional EU competition enforcement was ex post: don't do X, pay a fine if you do. This says which APIs, in which OS release, by which date, under which certification process. That makes the Commission something closer to a systems-review body than a competition authority — and if it holds up, it's a template that ports directly to every other designated gatekeeper.

Rival AI companies get a ticket line, not a seat. In theory, from 1 May 2027 they apply for certification, and if they pass they get near-Gemini-level device access in Android 18. That's the first time a European user setting ChatGPT or Claude as their primary system assistant becomes legally contemplated rather than technically impossible. On the search side, the prize is a way out of the oldest trap in the category: you can't fix ranking without queries, and you can't get queries with bad ranking. Injected data breaks that loop from the outside.

But look at the thresholds again. Two years of EU operation or €50M raised, plus 50,000 monthly average EU users. That is not a low bar for an actual startup. Layer on a priced data feed, and the practical effect is that the well-capitalised incumbents of the AI market benefit first — OpenAI, Microsoft, Perplexity. That's the skeptics' central charge and it deserves to be stated plainly rather than buried: mandated access does not automatically produce new entry, and it can just as easily entrench the second tier of giants as it can seed a third.

Google gets time and it keeps the gate. Reading this purely as a defeat misses half the picture. First, the runway is long: six months on search data, thirteen months to an OS release on Android, twenty-five months on hotword. Second, Google writes the certification terms itself — the Commission fixed the publication dates, not the wording. Third, it kept a security and data-protection assessment right. Fourth, the ranking algorithm stays proprietary. Fifth, the data carries a price tag. Google is opening the door while remaining the doorman.

European users get optionality, in principle. The honest caveat is that most people never change a default. Being able to swap your Android assistant and actually swapping it are different phenomena, and the 2018 Android antitrust case is the empirical proof of exactly that gap.

Two precedents — Apple's interoperability order flopped, but the courts backed the regulator

Start with the discouraging one. In March 2025 the Commission adopted Article 6(7) specification decisions against Apple covering iOS and iPadOS interoperability. Same legal instrument, same structure as the Google Android decision. The results are grim. Per FSFE's April 2026 tally, as of 22 March 2026 Apple had received 56 interoperability requests since May 2025 and closed 43. Of the 16 publicly disclosed closures, not one produced a new interoperability solution. Ten were denied on "technical grounds," two were dismissed on the basis that "existing solutions" already covered the request, three were rejected as out of scope or invalid.

That is the single most important lens for reading this week's news. A year of real-world data says a specification decision on paper does not convert into market access. A gatekeeper never has to refuse an order outright. It just answers each individual request with "technically infeasible." And the Google decisions contain the same kind of discretionary chokepoints: certification assessment, security risk review, eligibility determination. Every one of those is a case-by-case judgment call made by the regulated party.

Now the encouraging one, for the Commission. On 8 July 2026 the EU General Court dismissed all three of Apple's gatekeeper-designation challenges — appeals filed in October 2025 targeting Article 8(2) among other things. That effectively closes the route for a gatekeeper to argue it shouldn't be subject to DMA interoperability obligations at all. If Google litigates these decisions, "we aren't properly designated" is now a dead argument. What's left is narrower: proportionality, or that this particular specification exceeds what the obligation supports.

And the older precedent explains why the DMA exists. The 2018 Android antitrust case produced a €4.34 billion fine, trimmed to €4.125 billion by the General Court in 2022. Google changed its contracts. Europe got a search-engine choice screen. Android search defaults barely moved. The lesson the Commission drew was that ex-post fines rewrite contracts but don't rewrite habits, which is the entire rationale for switching to ex-ante obligations. These two decisions are the most concrete product of that switch — and the biggest live test of whether ex ante actually works better.

How rivals will play it

Move one is queueing up on 1 May 2027. OpenAI, Anthropic, Perplexity and Microsoft have every reason to file on day one. The mechanism is the four-week assessment cap per application: file early, get certified early, and you have runway to build against the Android 18 APIs before the release lands.

Move two is publicly stress-testing FRAND. "Fair, reasonable and non-discriminatory" sounds settled and is in practice the most litigated phrase in technology licensing, because it isn't a number. The moment Google publishes draft certification terms on 1 February 2027, expect rivals to go through the text line by line and argue in public that specific clauses are exclusionary in effect. That's exactly why the Commission put a three-month consultation gap between the draft and final terms — and those three months are plausibly where this decision is actually won or lost.

Move three belongs to European local players. For Ecosia and Qwant, an anonymised feed of Google ranking and click data is close to an existential opportunity. Their obstacle may be less eligibility than price: even under cost recovery, preparation and transmission costs plus a return pegged to Alphabet's WACC can be a meaningful line item for an operator with a small revenue base. Nobody knows how big that invoice is until one gets issued.

Expect counter-moves too. Google can set a high security bar inside its certification terms. That isn't automatically bad faith — Walker's point stands on the technical merits, because screen automation plus centralised on-device data access genuinely is a dangerous permission bundle if it's ever abused. But in regulatory games, "security requirements" are also a perfectly legitimate-looking source of delay. Structurally it rhymes with how Apple processed 43 requests using the phrase "technical grounds."

One separate pressure track, clearly labelled as unconfirmed. European press reporting says the Commission is preparing a record DMA non-compliance fine against Google over Article 6(5) search self-preferencing in shopping, flights and hotels — in the high-hundreds-of-millions-of-euros range, with possible daily penalties after 60 days. That is PPC Land and Handelsblatt reporting, not an adopted decision. It should not be repeated as fact.

So what actually changes

If you're a developer — nothing in your code today. Put two dates in the calendar instead: 1 February 2027, when Google publishes draft certification terms, and 1 May 2027, when final terms drop and applications open. If you build an AI assistant or a search-capable product with EU ambitions, the draft terms are your first look at the real requirements. There's also an architecture takeaway worth more than the compliance one: this eleven-feature list is effectively a regulator's formal definition of what an OS-level AI assistant must be able to do. Invocation → context → actions → resource access is a clean four-layer decomposition, and if Android 18's APIs ship in that shape, it becomes a de facto interface standard well beyond the EU.

If you're an investor — the near-term earnings impact on Alphabet is close to nil. Nothing binds before 2027, and the shared data is explicitly barred from ad personalisation, which closes the most direct path to advertising revenue cannibalisation. Two things are worth actually tracking. First, the rate at which European search queries leak away from Gemini and Google Search after 2027 — that's the real transmission mechanism, and it's slow. Second, whether the separately reported Article 6(5) fine materialises as an adopted decision; until it does, don't model it. Structurally, note that this pushes regulatory fragmentation one notch further. If Android 18 ships with an EU-only permission surface, Google carries a permanent engineering and product-consistency tax.

If you're a regular user in Europe — from late 2027 you may be able to change which assistant your phone answers to. Long-press home, get ChatGPT, have it book a taxi or draft your chat replies. The trade-off is real and worth sitting with: for an assistant to do those things, it has to see what's on your device. Until now essentially one company held that permission. Soon whichever company you pick will hold it. That's why Walker's objection isn't purely self-serving — more choice also means you now decide who to trust with a very deep hook into your phone. Outside Europe, nothing changes today, and the open question is whether Google builds these APIs as an EU-only compliance surface or ships them globally.

And the skeptical case, laid out properly. (1) Timeline. Nothing user-visible before 2027, hotword not before August 2028 — and AI product cycles move far faster than regulatory ones, so the market this remedy was designed for may not be the market that exists when it lands. (2) Enforcement gap. The Apple record shows gatekeepers can slow-walk through per-request technical denials. (3) Security critique. ECIPE's Fredrik Erixon and Dyuti Pandya call these decisions "regulatory privilege escalation," arguing they violate the cybersecurity principle of least privilege by granting third-party assistants deeper OS pathways than any specific task requires, and that they push the Commission out of competition analysis and into prescriptive systems engineering. (4) The anonymisation trilemma: the data has to be granular enough to be competitively useful, anonymised enough to prevent re-identification, and priced under FRAND — ECIPE's argument is that all three cannot hold simultaneously. (5) Access is not entry: the beneficiaries most able to use this are the ones least in need of help.

One last housekeeping note on dates, because secondary coverage is genuinely inconsistent here — "June 2027," "July 2027" and "December 31, 2026" all appear in the press. The EC Developer Portal dates are authoritative: 1 August 2027, 1 August 2028, and January 2027. Anything else is summarisation drift.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? If you're outside the EU, nothing directly — these obligations apply to the European market only. The thing to watch is whether Google walls the new Android APIs off as an EU-only compliance surface or opens them everywhere. If it's the former, European Android and the rest of the world's Android start functionally diverging.

— Why is this happening right now? The Commission opened both proceedings on 27 January 2026 and committed to finishing within six months, so July 16 lands just before its own roughly-27-July deadline. The deeper reason is that Google's voluntary compliance proposal was judged to strip out 90 to 100 percent of unique search queries and to exclude AI chatbots entirely. Negotiation failed, so the regulator wrote the spec itself.

— Does this mean Google has lost Europe? Too early to call it that. The deadlines run up to 25 months out, Google drafts the certification terms, the ranking algorithm stays private, and the data comes with an invoice. Most tellingly, a near-identical specification decision against Apple produced zero new interoperability solutions across a full year of requests. The severity of a decision and the change it produces in a market are two different things.

Sources

Numbers are as of announcement and may change.