The Digital Markets Act Security Dilemma
The security debate around the Digital Markets Act is about whether forcing dominant mobile platforms to open up their data and operating systems to rivals meaningfully boosts competition without creating new, easier paths for fraudsters and hackers to exploit sensitive user information at massive scale. The Digital Markets Act is meant to curb the power of large “gatekeepers” by requiring them to open parts of their ecosystems to competitors, including search and mobile operating systems. For Google and Apple, that means exposing data and interfaces that were once tightly controlled, from app stores to virtual assistants and search rankings.
Google is now fighting a fresh round of proposals, warning that rules designed to loosen its grip on Search and Android could expose millions of people to higher privacy and security risks in the name of competition. The European Commission is preparing final decisions on separate cases covering Google Search and Android interoperability by July 27, so this is no longer an abstract policy debate; it is a live negotiation over how far EU mobile platform regulation should go in prying open tightly integrated ecosystems.
Android Openness Requirements: A New Attack Surface
Under the Digital Markets Act, Google must both open more search data to rivals and grant third‑party AI services deeper access to Android. EU regulators want competing AI assistants to be integrated at the system level, with support for wake words and the ability to interact with apps and user data. On paper, this fulfills the dream of device owners choosing any assistant they like. In practice, it means new code from new companies will sit closer to your microphone, camera, on‑screen content, sensors, and installed apps than ever before.
Virtual assistants already occupy a privileged place in the mobile stack: they stay resident, change settings, and submit information into almost any app a user requests. For Google, that even extends to search history tied to a user account. By forcing this door wider open, regulators risk turning Digital Markets Act security into Digital Markets Act exposure. According to data from Forrester’s Security Survey, 2026, only about 40% of environments use mobile antivirus and 35% use mobile threat defense, which means most endpoints are not ready for a sharp spike in sophisticated mobile malware.
Data Sharing Risks: Search Histories as Hacker Bait
The most explosive part of the current proposals is not just Android openness requirements but the order to hand over search data. Regulators want Google to share anonymized search queries, click data, and ranking information with rival search engines so smaller providers and AI‑powered tools can improve their products and compete with Google’s roughly 90% share of the global search market. This is the heart of EU mobile platform regulation: forcing incumbents to give newcomers the data fuel they can’t gather on their own.
Google’s security leadership argues that once sensitive search data leaves its infrastructure, it cannot guarantee protection. Those datasets could make smaller organizations prime targets for hackers, even if they pass independent security audits and sign strict agreements not to reidentify users. Heather Adkins warns that fraudsters are likely to exploit the new system within weeks if outside AI services get wider permissions over device sensors and on‑screen content. She also points to a more subtle risk: sophisticated AI models could make it easier to de‑anonymize large datasets when attackers combine them with other leaks.
Fairness vs. Fraud: Are Regulators Playing With Fire?
Regulators have a defensible goal: stop mobile gatekeepers from blocking rivals and give users genuine choice over services like virtual assistants and search. The Digital Markets Act’s Article 6(7) demands that any third‑party assistant get the same level of access as native ones, effectively banning self‑preferencing in this layer. Consumer advocates argue this is essential to break lock‑in. Yet, as one analyst put it, by prying open the area where assistants interact with apps, sensors, system configurations, and account‑level search history, “the EU Commissioners are playing with fire”.
This is the regulatory paradox: the same openness that energizes competition can gift scammers fresh attack vectors. People already download random AI‑powered assistants; if those tools get first‑class OS privileges, the chance of identity theft and account compromise jumps. Even if the EU bakes in security audits, many environments lack basic protections such as mobile threat defense, so the burden shifts onto users who rarely understand the risks. Fairness and control over devices are valid aspirations, but regulators must be honest that “more choice” in critical system layers also means more ways to be tricked, phished, or surveilled.
Can Openness and Security Coexist?
Not everyone buys Google’s doom‑laden scenario. A privacy‑focused search rival says the Commission’s plan already pushes reidentification risk down to an insignificant level, and researchers at a major policy institute argue that the proposed safeguards look strong enough to support greater competition without catastrophic privacy failures. Other academics acknowledge the privacy risks but insist they must be weighed alongside the technical protections on the table, not used as dealbreakers. In other words, Digital Markets Act security is not inherently impossible; it is unfinished engineering.
The real debate is whether regulators can enforce high security standards while enforcing openness. Platform leaders say transparency mandates hand over their best defenses to less prepared rivals and expose users by design. Critics respond that dominant platforms have every incentive to exaggerate data sharing risks to preserve their data monopolies. The likely outcome sits somewhere in between: more interoperable mobile platforms, more competition, and a sharper cybercrime learning curve. The conclusion should be uncomfortable but clear: openness is worth pursuing only if security enforcement is treated as a first‑order requirement, not an afterthought bolted on once hackers have already proven Google right.
