The “user-side” search-query data remedy carved out by U.S. District Court Judge Amit Mehta in the just handed-down U.S. v Google decision appears to be animated by a similar intuition (search quality depends on large volumes of click-and-query signals) as the EU Digital Markets Act’s Article 6(11), but they also diverge in important ways. Where Judge Mehta’s approach is narrower, more tethered to proven competitive harm, and deliberately cabined by process safeguards (including a cap and technical oversight), Article 6(11) DMA is ex ante, continuous, and tied into a notoriously suboptimal process managed by the European Commission.
One key problem with the DMA process is that we still don’t know how the privacy safeguards on sharing query data are meant to be interpreted, depending on how one reads “anonymised.” I set out those differences below, using the D.C. District Court’s final remedies opinion, as well as my earlier analysis and comments on the DMA compliance workshops (2024 and 2025).
I also flag a particularly telling bridge between the two regimes: the U.S. court explicitly acknowledges that DMA-style anonymization can wipe out the overwhelming majority of queries, but nonetheless appears to treat that possibility as an acceptable feature of the privacy constraint on data sharing.
Judge Mehta’s User-Side Data-Sharing Remedy
Judge Mehta’s remedy decision adopted a narrowed version of the plaintiffs’ user-side-data proposal. He required Google to share (at marginal cost, and under safeguards) the underlying click-and-query datasets that feed two key ranking components (Glue and RankEmbed) because this data embodies the scale advantage the court found to be the fruit of Google’s unlawful default-distribution agreements. In the court’s words, “user-interaction data is the raw material” of search-quality improvements—a critical input for long-tail queries.
- Datasets Covered: The court ordered disclosure of the underlying Glue and RankEmbed data and rejected disclosure of “training data for Gemini models,” finding the evidentiary record too thin to show that any search-specific generative artificial intelligence (AI) post-training advantage was tied to the proven monopoly conduct.
- Frequency and Cap: Glue and RankEmbed data must be shared more than once (because freshness matters), but the court will impose a cap on the number of disclosures to discourage free-riding and to reflect the costs of robust privacy measures. (By contrast, a separate index-data disclosure is a one-time snapshot.) A technical committee will advise on the cap in light of the utility of the data once privacy techniques are applied.
- Privacy Architecture: The court recognized a genuine risk that click-and-query data could be reidentified through context, even absent explicit identifiers, but nonetheless held that privacy can be preserved with appropriate combinations of noise, generalization, suppression, and k-anonymity. Designing those safeguards is explicitly delegated to a technical committee; the lack of “particulars” in the decree is not fatal.
- “Mimicking” Concern: Google argued that sharing would allow rivals to train large language models (LLMs) to “mimic” its rankings. The court found that risk was overstated, emphasizing that only data (not the models, not the signals) are shared; that engineering, infrastructure, and missing inputs still matter; and that the remedy’s narrowing, plus the cap, serve to further mitigate the risk. The aim is to improve rivals, not to replicate Google.
- Qualified Recipients, Marginal Cost, and Oversight: Data will be provided to “qualified competitors” (see below for definition) at marginal cost and with privacy/security standards and other parameters set and monitored by the technical committee over the decree’s term. The court lists several concrete committee tasks: advising on privacy controls, caps, and data-security standards.
One more detail is worth underlining because it speaks directly to the decision’s interplay with the DMA. In discussing k-anonymity and related techniques, the court noted evidence that Google’s DMA-disclosure filters excluded roughly 99% of queries, illustrating how stringent anonymization can obliterate utility. The court still proceeded, choosing governance (committee-guided calibration) over categorical prohibition.
What Article 6(11) DMA Asks of Gatekeepers and How Google Implemented It
Article 6(11) of the Digital Markets Act obliges gatekeepers to give any third-party search engines access, on FRAND terms, to ranking, query, click, and view data generated on the gatekeeper’s search engine, Where those data constitute personal data, they “shall be anonymised.” This is an ex ante, sectoral duty—untethered to a finding of violation in a specific case.
I analyzed Google’s initial implementation (and the on-its-face tension with the General Data Protection Regulation’s restrictive reading of “anonymisation”) in a May 2024 Truth on the Market post. There, I explained Google’s European Search Dataset licensing program, which includes:
- Quarterly releases covering “more than one billion distinct queries” across the EEA; with
- Frequency thresholds (e.g., queries must have been entered greater than or equal to 30 times by signed-in users globally, plus per-country/device minima) to support anonymization; and
- FRAND pricing (starting around €3 per 1,000 distinct queries).
I argued that, while this reflects real effort, it still illustrates the structural tradeoff that Article 6(11) DMA creates. If you push thresholding high enough to satisfy EU anonymization doctrine, and utility collapses. But if you lower the thresholds, one invites GDPR risk.
I also warned—then and since—that the Commission’s compliance workshops revealed a troubling willingness to dismiss privacy and security concerns across the DMA, combined with a lack of concrete, shared safeguards to make these data-sharing mandates safe in practice.
Finally, recall that Article 6(10) creates a separate data-access duty toward business users (including personal data), but only where end-users opt in. It thus embeds an explicit consent gate, unlike 6(11)’s anonymization condition.
Side-by-Side: Judge Mehta and the EU DMA
Trigger and Tailoring
- Mehta: The user-side-data remedy is an ex-post remedy, justified as a “reasonable method of eliminating the consequences” of the proven unlawful default-distribution strategy. It is narrowed to two datasets (Glue and RankEmbed) that the record tied to scale-driven quality advantages, especially on the long tail. The court rejected broader AI-training disclosures for lack of proof.
- DMA: Article 6(11) DMA is ex ante and generality-biased. It applies to any gatekeeper and any third-party search engine. There is no case-specific tethering to conduct or market effects. That makes its calibration problems (privacy vs. utility, safe recipient criteria, security) both structural and evergreen.
Who Gets the Data and on What Terms?
- Mehta: Disclosure is only made to “qualified competitors,” under decree-specific definitions and marginal-cost pricing, with a cap and an oversight body that can adjust implementation to preserve both privacy and competition incentives. The decision defines a qualified competitor as:
A Competitor who meets the Plaintiffs’ approved data security standards as recommended by the Technical Committee and agrees to regular data security and privacy audits by the Technical Committee, who makes a sufficient showing to the Plaintiffs, in consultation with the Technical Committee, of a plan to invest and compete in or with the GSE and/or Search Text Ads markets, and who does not pose a risk to the national security of the United States.
- DMA: Disclosure is to be made to any third-party search engine on FRAND terms; qualification is not a competition-effects test. Absent specifications from the European Commission, the “FRAND plus anonymization” formula must do a lot of work. Google therefore constructed its own qualification and operational guardrails (e.g., track record of safeguarding data, security screens) in its licensing design. As I observed at the time, this predictably raised rivals’ complaints that privacy and security-protective measures undermine the DMA.
Privacy Theory vs Privacy Engineering
- Mehta: The court accepts that queries are often personally revealing—even without identifiers—but treats privacy as an engineering and governance problem. It requires that noise/generalization/k-anonymity be applied, a technical committee be involved, and a cap be calibrated, because strong anonymization reduces utility. The opinion cites evidence that Google’s DMA filters excluded roughly 99% of queries, but proceeds anyway—precisely because the remedy’s goal is to help rivals in a targeted way, not to allow them to replicate Google’s systems.
- DMA: Article 6(11) hinges on data being “anonymised,” but EU doctrine famously treats anonymization as a high bar (contextual-reidentification risk looms large), which pushes implementers toward heavy thresholding and suppression. In my earlier Truth on the Market post, I argued that this yields a tension with utility that the DMA itself does not square; in my EUTechReg DMA compliance workshop writeups, I criticized the Commission’s reluctance to acknowledge the safety/security side of the ledger.
Calibration of Competitive Effects
- Mehta: The court is explicit that the point is to improve rivals on long-tail quality, not to hand over “functional substitutes” for Google’s ranking. Hence, the decision calls for data-only disclosure (no models/signals), the cap, and the repeated references to the effort and infrastructure that rivals must still invest.
- DMA: Article 6(11) does not embed an internal “no mimicry” guardrail. It assumes FRAND-plus-anonymization suffices against both privacy and competitive distortions. In practice, this forces gatekeepers and recipients into workarounds (eligibility criteria, pricing tiers, usage restrictions) that either invite challenge as not-FRAND, or drain utility for challengers.
Institutional Design and Accountability
- Mehta: The technical committee is central; it is to advise on recipient qualification, privacy standards, disclosure caps, and audits. The opinion explicitly defers technical specifics to this body, as an appropriate way to handle “complex and technologically nuanced” disputes under the decree.
- DMA: There is no DMA-wide analogue to a case-specific technical committee. Article 8 allows the Commission to specify obligations but, in practice, it seems (to an external observer) that the process has so far not yielded shared privacy baselines for 6(11).
Conclusion
Both data-sharing regimes assume that user-side query data matters for competition. The DMA declares that rivals should get it (anonymized, on FRAND terms), but then leaves the hardest questions to implementers under a demanding GDPR lens. Judge Mehta arrives at a similar destination for a subset of data, but only after liability is established. He then builds in the practical machinery—a cap, marginal-cost pricing, and a technical committee—to keep the privacy/utility balance tractable over time.