A Google-funded audit found that privacy safeguards in the European Commission’s search data-sharing plan can leave individual searches distinguishable and allow separate queries to be pieced together.
Cybersecurity and privacy researcher Lukasz Olejnik found that reconstructed search histories could reveal sensitive details about health, religion, and political views.
Olejnik published the findings on November 12 after testing real Google Search records prepared under the Commission’s rules. Google commissioned and paid for the audit after Olejnik raised privacy concerns about an earlier draft in April. He says Google gave him full independence and could review the text only for personal data.
The Commission’s July 16 decision implements a Digital Markets Act requirement for Google to give eligible competitors access to search queries, rankings, clicks, and views. Eligible services include AI chatbots that offer online search. The Commission says access will help rivals improve their services and compete with Google, which it says has held more than 90% of the European search market for decades. Personal data must be anonymized before sharing.
A language setting can make a search stand out
Under the plan, a search keeps its district-level location only if at least 1,000 signed-in users searched there that day in the same language and on the same device type. Smaller groups are widened to the country level, and records are dropped if that still falls below the threshold.
The rule accounts for the query language. The dataset also retains labels from the search results page that reflect the language in which Google is displayed. In one group of 92,990 records from Belgium’s Liège district, a mobile search in English stood out because its results page was displayed in Filipino.
The audit counted more than 520,000 search records that stood out based on a single tab label in August across Belgium, France, Germany, Ireland, and Poland. In a separate test, tab labels still singled out 85,553 records after Olejnik widened the comparison to the country level.
The three-search cap can be bypassed
The plan assigns separate identifiers to short sessions of up to three searches. In Germany alone, Olejnik’s August analysis yielded nearly 230,000 groups that exceeded that cap. He used comparison tests to estimate how often queries might match by chance. In the samples analyzed for sensitive content, linked sets contained information about protected topics three to five times as often as individual sessions did.
Olejnik also flagged national security risks. Searches near US and NATO installations suggested links between military households and sensitive personal circumstances. In a separate case involving recruitment at an EU intelligence agency, search details and public information narrowed the possible searcher to three people.
Google challenged the order in September, arguing that it could expose private search histories. The Commission said at the time that it had considered users’ data protection and would defend its decision in court.
Leave a Reply