Alphabet is appealing two European Union orders issued under the Digital Markets Act (DMA). The two requirements concern opening parts of its service capabilities to AI rivals and providing search data to other search engines. Alphabet argues that if the measures take effect as planned, they would weaken user privacy protections and Android device security. Alphabet filed the appeal on Monday with the EU General Court in Luxembourg. The measures were originally scheduled to take effect next year. The litigation further intensifies the dispute between Alphabet and EU regulators over the scope of the DMA.

Two orders target AI services and search data respectively

The EU antitrust regulator asked Alphabet in July this year to take measures to help competitors more easily use its platform capabilities. One requirement concerns the AI field. The EU wants Alphabet to help other search providers and AI developers use some service capabilities currently open to Gemini, meaning rivals such as OpenAI could in theory also gain broader access conditions. The other targets the search market, requiring Alphabet to open some search data to competing search engines to reduce other search providers' disadvantage in data acquisition. Both measures are part of the EU's push through the DMA to open core services of large tech platforms and lower competitive barriers.

Alphabet says search data sharing could harm user privacy

Alphabet's main objection to the search data opening requirement is user privacy. Oliver Bethell, Alphabet's senior director for competition, said people search for large numbers of highly private questions through search engines, including health conditions and intimate relationships. If companies are required to share such search histories without sufficient anonymization measures, it could cause irreversible harm to user privacy. Therefore, Alphabet argues that regulators cannot promote search market competition at the expense of weakening existing privacy protections.

Android opening requirement also raises security concerns

Alphabet's concerns about the other order focus more on device security. The company said that if Android-related capabilities are further opened to competitors to meet DMA requirements, existing security protection mechanisms could be weakened. Alphabet's core argument is that the EU hopes to lower market entry barriers by opening platform capabilities, but if the degree of openness is too high, it could also weaken the control mechanisms Alphabet currently uses to protect user data and device security.

EU says the measures already include privacy and security safeguards

The European Commission takes a different position. As the DMA's enforcement body, the European Commission said both measures already include arrangements to protect user privacy, device integrity and security, and therefore does not agree with Alphabet's claim that the requirements would necessarily weaken security safeguards. This also forms the core of the dispute between the two sides: the EU hopes to reduce the competitive advantage of large platforms by forcing the opening of some data and service capabilities; Alphabet believes that if opening obligations extend deep into search data and Android security, they may exceed reasonable regulatory boundaries.

The focus of the dispute turns to how far the DMA can require platforms to open

The significance of Alphabet's appeal is no longer limited to the two specific measures themselves. As competition in generative AI intensifies, search data, model access capabilities and mobile operating systems are becoming new competitive infrastructure. The EU is trying to use the DMA to require large platforms to open some of these capabilities to competitors, while Alphabet hopes to limit the boundaries of this opening obligation through judicial proceedings. Therefore, the core question this litigation must resolve next is how much data and how many platform capabilities the DMA can require large tech companies to open when promoting competition, and how regulatory requirements should strike a balance with privacy and security protections.