Google scientist warns EU data sharing plan exposes users to privacy risk in under 2 hours

Google's Privacy Expert Challenges EU Data Sharing Mandate

Sergei Vassilvitskii, a distinguished scientist at Google since 2012 and a leading researcher in differential privacy, has issued a stark warning to the European Commission about its proposed data sharing requirements. In exclusive written comments to Reuters, Vassilvitskii revealed that Google's AI red team managed to re-identify users in less than two hours when testing the EU's anonymisation method 1

1

2

2

. The privacy risk stems from the European Commission's approach to forced search-data sharing under the Digital Markets Act, which requires Google to share search engine data with rivals such as OpenAI on fair, reasonable and non-discriminatory terms.

Digital Markets Act Creates Unprecedented Privacy Challenges

The proceeding sits within the Digital Markets Act, the EU's flagship competition framework for gatekeeper platforms. On January 27, 2026, the European Commission opened formal specification proceedings against Google under Article 6(11) of the DMA, which obliges gatekeeper search engines to grant third-party rivals access to anonymised ranking, query, click and view data 1

1

. The compliance deadline is July 27, 2026, and failure to meet it could result in fines up to 10% of Google's global annual revenue 2

2

3

3

. EU antitrust regulators are finalizing the proposal in the coming weeks following feedback from interested parties.

AI Red Team Exposes Significant Privacy Concerns

The issue centers on whether modern AI tools can pierce through anonymisation safeguards to identify individual users. Google's AI red team, a group of hackers that simulate realistic adversary activities to highlight potential vulnerabilities, demonstrated that the Commission's proposed method fails to protect user data adequately 2

2

. Vassilvitskii's research career has focused specifically on differential privacy, the mathematical framework for measuring and bounding re-identification risk in released datasets 1

1

. The vulnerability is not theoretical—in 2006, an anonymised release of AOL search data led to multiple users being identified by name within days, demonstrating that anonymisation techniques combining pseudonymisation, aggregation, and noise injection remain vulnerable to linkage attacks when queries are sufficiently distinctive 1

1

.

Big Tech Faces Growing Tension Between Competition and Privacy

Vassilvitskii met with EU antitrust officials on Wednesday to voice his concerns and propose a broader approach with better guardrails to protect Europeans from privacy harm 2

2

3

3

. The proposal has triggered concerns beyond Google—the Information Technology and Innovation Foundation flagged that forcing a search engine to share search engine data with rivals expands the surface area on which user-search data can be exploited, while the Chamber of Progress and CyberInsider warned the proposal could enable large-scale surveillance if anonymisation methods proved insufficient 1

1

. The European Commission has cracked down on Big Tech via a slew of legislation to ensure users have more choices and smaller rivals room to compete, though this has triggered concerns from the US government 2

2

. Google has accumulated roughly €9.71 billion in European antitrust fines since 2017, making the financial calculus on this proceeding material even by Google's standards 1

1

.