The most useful thing about this story is how easily it goes wrong in retelling. Four distinct legal objects — a standing statutory obligation, two specification decisions, two non-compliance decisions carrying €890m, and two court actions — collapse into "the EU order" in almost every headline. And the single most consequential fact is the quietest: the appeal changes nothing about January 2027.
What the EU actually did on 16 July 2026 was unusually concrete. It named eleven Android features, sorted them into invocation, context, actions and resources, attached two hard dates (Android 18 by August 2027, concurrent hotword detection by August 2028), and then did something no regulator should do lightly: put five of the eleven — the ones that matter most — behind a certification programme that Google itself administers. Independent legal analysis reads that as the Commission quietly conceding gatekeeper discretion it had expressly denied Apple a year and a half earlier. That is the sharpest technical-legal fault line in the whole episode, and it is the one that will decide the case.
The search-data decision is the bolder move. Anonymised query, click and view data at Google's scale, with a 7-day latency floor, a five-year access window, a purpose limitation that forbids training general-purpose models, and a price capped at Alphabet's WACC. The design is genuinely careful — and it is careful in a specific way: it commits the Commission to being provable. Independent audits before and during access, annual re-verification, biennial reviews, and the express power to reopen proceedings if independent evaluation shows the anonymisation fails. The regulator wrote the test that could prove it wrong. Very few enforcers do that.
Google's counter-argument deserves a hearing rather than a dismissal. Query logs really are among the most revealing data people generate, and long-tail medical or relationship queries can identify someone even with identifiers stripped. Deep system-level access for third-party assistants really does widen the attack surface of a phone holding banking and health data. Both claims are arguments about design, and the right place to settle them is the anonymisation threshold and the certification criteria — with evidence, not adjectives. "Irreversible harm" is the standard a party invokes when it wants a pause, and it is also the standard the court should demand to see measured rather than asserted.
The strategic lesson for anyone building AI is not legal, it is distribution. On the dominant mobile OS, a rival assistant can be installed but not summoned, cannot act, and cannot be the default — and none of that is fixable by better engineering. That is the structural point the DMA is trying to move, and this case is the first serious attempt to move it. It lands in August 2027 and 2028 at the earliest, it is under appeal, and the Commission's own study of earlier DMA remedies found it had shifted roughly six million EU users to alternative browsers. Movement is measurable. Whether it is fast enough is the open question.
For readers: build to the deadline and litigate in parallel — that is Google's implied strategy and, on the current calendar, it is the rational one. For rivals: prepare the eligibility evidence pack now, because the four-week assessment clock does not negotiate. And for everyone: notice that the EU has decided something narrow and checkable — can a user in Frankfurt set a different assistant as their default and summon it out loud? — and that narrow, checkable questions are the ones that actually move markets.
