On November 12, 2026, computer scientists David Sánchez, Benet Manzanares, and Josep Domingo-Ferrer released an empirical evaluation demonstrating that the European Commission’s July 2026 search-data anonymization rules under Article 6(11) of the Digital Markets Act (DMA) leave platform datasets vulnerable to low-effort reidentification, user profiling, and confidential attribute inference.
Regulatory Context: Search Data Sharing Under DMA Article 6(11)
Article 6(11) of Regulation (EU) 2022/1925 (the Digital Markets Act) requires designated search gatekeepers—specifically Alphabet—to share daily query, click, view, and ranking data with competing search engines on fair, reasonable, and non-discriminatory terms. The regulation stipulates that any personal data contained within search queries must be anonymized prior to transfer.
In July 2026, the European Commission established technical and contractual anonymization measures in Case DMA.100209. Alphabet had proposed enforcing formal k-anonymity (k=30 on query text and k=5 on entire query-and-metadata records), which the Commission rejected as overly detrimental to data utility. Instead, the Commission introduced a heuristic framework: removing user IDs and precise timestamps while retaining query strings, day-level dates, device types, NUTS3 location codes, and result URLs. To limit reidentification, the Commission applied an entity allow list (requiring terms to appear across 50 users over 13 months) and a length threshold capping queries at the 95th percentile of 2025 lengths.
Empirical Audit Demonstrates High Record Uniqueness
In their arXiv preprint, Sánchez, Manzanares, and Domingo-Ferrer evaluated six months of real Google Search data provided by Alphabet to which the Commission’s measures had been applied, analyzing 4.87 billion search records from Ireland and 34.62 million from Spain. The researchers found that suppressing individual entities in isolation fails to prevent record uniqueness when attributes are combined.
In the Irish dataset, 17.91% of modified queries remained unique over six months. Adding generalized location, device, and language metadata raised record uniqueness to 24.27% without timestamps, and to 43.82%—over 2.13 billion records—when day-level timestamps were included.
| Time Window | Total Search Records | Unique Queries (%) | Unique Records Without Timestamp (%) | Unique Records With Timestamp (%) |
|---|---|---|---|---|
| 1 Day (2026-08-01) | 25,724,013 | 35.13% | 43.78% | 43.78% |
| 1 Week (2026-08-01 to 2026-08-07) | 195,687,166 | 27.53% | 35.77% | 44.53% |
| 1 Month (2026-08-01 to 2026-08-31) | 896,671,597 | 22.58% | 29.85% | 43.90% |
| 3 Months (2026-06-01 to 2026-08-31) | 2,609,775,091 | 19.54% | 26.19% | 43.64% |
| 6 Months (2026-03-01 to 2026-08-31) | 4,871,552,575 | 17.91% | 24.27% | 43.82% |
Four Practical Attack Patterns Tested on Live Datasets
The authors developed four automatable attack patterns showing that records passing Commission filters remain vulnerable to reidentification:
- First-person self-queries: Querying Spanish terms for “me llamo” and “mi nombre” retrieved 421,314 unique records. Screening the top 100 via an automated language model reidentified approximately one dozen individuals, linking them directly to public exam registers, diplomas, and professional profiles.
- Email and password recovery: Filtering for “gmail” combined with “@” or “at” yielded 25,687 records in Spain, where users asking for password assistance exposed non-public emails, full names, and birth years.
- Residential origin routing: Regex screening identified 713,586 Irish records containing Eircodes. Tracking directions queries originating from residential Eircodes across months linked travel histories, private addresses, and family businesses.
- Minority language clustering: In Ireland, all 50 Icelandic queries issued in March 2026 occurred on a single date, allowing reconstruction of a transiting traveler’s flight path, healthcare inquiries, and banking lookups.
Failure Against European Data Protection Board Standards
The study established that the Commission’s rules fail all three anonymization criteria set by the European Data Protection Board (EDPB) in Opinion 05/2014: singling out, linkability, and inference. The authors emphasized that contractual prohibitions against reidentification cannot substitute for technical anonymization under the GDPR, particularly when datasets cover nearly 90% of the EEA search market.
Implications for Research Data Stewards and Compliance Offices
The findings provide critical guidance for research organizations handling platform datasets:
- Distinguish legal compliance from mathematical anonymity: Regulatory compliance labels do not eliminate reidentification risk. Teams evaluating anonymization versus pseudonymization must treat heuristic platform feeds as pseudonymized data.
- Classify regulatory search corpora under human-subject governance: When acquiring platform data, research compliance offices must separate de-identified versus anonymized data to prevent unauthorized internal distribution.
- Execute structured data governance: Academic teams must execute binding data sharing agreements and conduct Data Protection Impact Assessments (DPIAs) before analyzing query feeds.
- Apply formal privacy frameworks: Research initiatives require mathematical guarantees like differential privacy or verified privacy-preserving record linkage. Truly digitally anonymised data must resist multi-attribute inference across long observation windows.
Sources
- David Sánchez, Benet Manzanares, Josep Domingo-Ferrer, “Anonymous in Name Only: A Critical Review and a Reidentification Exercise on the European Commission’s Anonymization Measures for Google Search Data under Article 6(11) of the DMA,” arXiv:2611.17012v1 [cs.CR] (12 November 2026). Checked 2026-11-15.
- European Commission, Directorate-General for Competition, “Case DMA.100209: Alphabet – Article 6(11) Google Search Data Sharing” (July 2026). Checked 2026-11-15.
- Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector (Digital Markets Act). Checked 2026-11-15.
- Article 29 Data Protection Working Party, “Opinion 05/2014 on Anonymisation Techniques” (WP216, endorsed by EDPB). Checked 2026-11-15.
