Google warns Europe’s Digital Markets Act implementation could weaken Android security and privacy

Google’s government affairs leadership in Europe is urging EU policymakers not to undermine what it calls “privacy and security guardrails” as the Digital Markets Act (DMA) is implemented. The argument, laid out in a July 16 blog post, says recent decisions risk causing user harm for “millions of Europeans,” even as the company says it has offered solutions intended to meet DMA objectives.

The post centers on what Google describes as an Android-related outcome in which external apps would gain sensitive and powerful device permissions without the same vetting safeguards that, in Google’s view, protect users today. Google says AI assistants already access Android capabilities safely, and it places responsibility for vetting on phone makers that must approve assistant integrations.

Google also frames the dispute as part of a broader security debate, pointing to warnings from the EU’s own cybersecurity authority that, in the age of AI, “security fundamentals matter more than ever.” In the post’s view, pushing DMA implementation toward broader third-party access to device functions could elevate risk by changing the permission and approval model.

A second concern raised by Google is privacy in search. The post says Europeans’ private searches could be exposed to “unfamiliar companies” if implementation measures require sharing certain search-related access in a way that lacks adequate anonymization. Google adds that it worries users would not be sufficiently informed or able to provide informed consent.

Google’s executive says the stakes include not only individual privacy, but also commercial confidentiality and national security. The post asserts that revealing private search data without strong anonymization could expose business trade secrets and endanger national security, arguing that the costs outweigh the intended market benefits if safeguards are weakened.

The policy letter-style post also argues against a one-size-fits-all approach. Google calls for “a flexible and evidence-based implementation process” that can account for both harms and benefits, then adjust measures accordingly. It says it will continue advocating for a balance that protects privacy and security while still supporting the DMA’s market-structure goals.

Separately from the regulatory dispute, the blog post includes a corporate philanthropy update., Google’s charitable arm, is providing a $5 million grant to scale Obrii, which the company describes as Ukraine’s national AI job platform. Google frames the grant as part of sustained investment meant to increase Ukraine’s adoption of AI.

Obrii is presented in the post as an effort to help connect people with AI-related work and to accelerate AI use in Ukraine. In that sense, Google’s position on DMA compliance and its Ukraine initiative both reflect a broader company theme: expanding AI capabilities while trying to keep guardrails around data flows and device access.

Even as the post makes clear assertions about possible user and security impacts, it does not provide granular details on the specific DMA measures or the exact technical changes it believes would occur on Android. It also does not spell out how anonymization would be handled under the EU’s approach, beyond arguing that current protections may be weakened without the right conditions and user consent. As a result, readers are left with Google’s perspective on potential consequences rather than a complete implementation blueprint.

Going forward, the key variable to watch is how the EU operationalizes DMA compliance in areas touching Android permissions and private data access, including what safeguards are required and how user consent is handled. Google’s request for a process that can “adjust measures accordingly” suggests the company expects ongoing negotiations and revisions, rather than a fixed rule set that cannot respond to evidence of harm.