The EC's Google Search Anonymization Is a Paper Lock on a Glass Door — Researchers Reidentify Users With Low Effort

Researchers show the European Commission's anonymization measures for Google Search data under the DMA fail all three EDPB criteria. Low-effort reidentification attacks succeed on real data.

Imagine you're asked to redact a diary before sharing it — but instead of blacking out the revealing passages, you just remove the name on the cover and leave every entry intact. That's roughly what the European Commission's anonymization framework does to Google Search data under Article 6(11) of the Digital Markets Act. The EC specified how Alphabet must sanitize search query data before sharing it with competing search engines. This paper demonstrates that the specification is broken. The committed claim: the EC's anonymization measures fail all three criteria established by the European Data Protection Board — no isolation of individual records, no prevention of linkage across records, and no protection against inference of confidential attributes. The authors don't just argue this theoretically. They demonstrate it empirically on real Google Search data provided by Alphabet under the EC's own protective framework, using what they describe as 'straightforward and automatable' attack patterns. The core technical critique targets several layers. First, the characterization of residual risk is flawed — the EC's methodology underestimates how much identifying information survives in free-text search queries. Search queries are not structured database fields; they're natural language with arbitrary specificity. A query like 'dermatologist near [rare suburb] for [rare condition] appointment Thursday' is practically a fingerprint. Second, the suppression thresholds — the numeric cutoffs below which data gets removed — are based on heuristics rather than formal privacy guarantees like differential privacy. Third, the framework leans heavily on contractual safeguards (recipients promise not to reidentify), which is a legal patch over a technical hole. The authors demonstrate three categories of attack: direct reidentification (finding a specific person's queries), record linkage (connecting queries across sessions to build a profile), and confidential attribute inference (deducing sensitive personal information from query patterns). These aren't exotic cryptographic attacks requiring nation-state resources. They're low-effort, automatable, and rely on publicly available auxiliary information — the kind of thing a motivated data analyst could execute in an afternoon. What makes this paper significant beyond its immediate scope is its regulatory precedent function. The EC's methodology for this specific DMA provision is the first concrete illustration of how EU regulators operationalize anonymization under the digital rulebook. If this becomes the benchmark — and regulatory inertia suggests it will unless challenged — every future data-sharing mandate under EU digital regulation could inherit these same structural weaknesses. The authors are explicitly warning against this: don't treat this as a template. The integrity of the analysis rests on access to real data under the EC's protective measures, which is unusual for this kind of critique. Most anonymization critiques work with synthetic data or public datasets; this one attacks the actual protected dataset with the actual proposed protections in place. That said, the paper does not appear to provide code for replication, and the specific attack results cannot be independently verified without the same data access — a structural limitation of any research on restricted datasets. The broader fight here is between heuristic anonymization (suppress what looks risky, rely on contracts for the rest) and formal privacy guarantees (differential privacy, k-anonymity with provable bounds). This paper lands squarely on the side of formal guarantees, arguing that the heuristic approach fails catastrophically when applied to high-dimensional, free-text data like search queries. The practical implication is stark: regulators will need to either adopt formal privacy frameworks for DMA data sharing or accept that 'anonymized' search data isn't actually anonymous.