UK Regulator Forces Google to Disclose Ranking Criteria and Allows Search Data Portability
CMA utilized the DMCC Act to impose objective criteria for organic ranking, including AI Overviews, and grant users the right to port search data to third parties. Google has six and three months to comply.
The UK's Competition and Markets Authority (CMA) imposed two new conduct requirements on Google's search division on Wednesday (17th), based on the powers of the Digital Markets, Competition and Consumers Act 2024. Under the first order, the company has six months to ensure that objective and non-discriminatory criteria govern the ranking of organic search results, including AI Overviews (excluding sponsored results). Under the second order, within three months, it must allow users in the UK to port search data to authorized third parties, such as cashback platforms and comparison websites.
This action is the second round of the CMA against Google that began in June. On June 3rd, the same regulator required the company to give publishers control over the use of their content in AI Overviews, AI Mode, Gemini, and Vertex AI, and to publish engagement metrics. Together, these two decisions address two fronts in the search economy: the relationship with publishers in the first round, and the relationship with retailers and developers that depend on organic traffic in the second.
What Changes in Google's Operations
Two requirements of the conduct requirement published today have a clear operational implication. First, Google will have to provide advance notice of significant algorithm changes, a practice that currently only occurs in so-called "core updates" and even then in a generic manner. Second, it will have to offer formal channels for British companies to contest ranking downgrades, akin to what the European Union already demands under the Digital Services Act for large platforms. The explicit inclusion of AI Overviews within the ranking perimeter is the most sensitive point: for the CMA, AI-generated summaries are treated as search products, subject to the same transparency criteria.
The portability requirement turns what Google currently operates as a courtesy into a legal obligation. The company already offers a Data Portability API in the UK, but access is predicated on discretionary contractual terms. Under the conduct requirement, the regulator can hold Google accountable if an authorized third party is unable to access the data in a reasonable timeframe. For comparison companies like Honey, Quidco, and TopCashback, as well as for platforms using search history to build personalized offers, the effect is direct: the user’s connection to Google is no longer designed to be sticky.
The Broader Implications Beyond the UK
The CMA's decision carries precedent weight beyond the British market. For the European Commission, which has been applying the Digital Markets Act since 2024 against Apple, Meta, Microsoft, and Google itself, the inclusion of AI Overviews as search products is a point that has not yet been formally decided in Brussels. The CMA's interpretation is likely to be cited in upcoming European processes, particularly in ongoing cases against Alphabet for self-preferencing.
In the United States, the regulatory landscape is the opposite. The Trump administration, in January 2025, overturned Biden's executive order on AI, and in 2026, the Department of Justice remains focused on the remedy phase of the antitrust search case opened in 2024. The CMA effectively provides an operational blueprint that plaintiff lawyers in the U.S. have already begun to cite in memoranda to Judge Amit Mehta regarding ranking transparency, according to coverage by Press Gazette.
In Brazil, the Administrative Council for Economic Defense (CADE) has an open case against Google for price comparison preference since 2021, with no final decision. The National Data Protection Authority (ANPD) has yet to regulate portability in the search context. The British order offers a concrete model that could accelerate public consultations in the second half, particularly regarding search data as a portable category under the LGPD.
What Google Might Say
Google indicated in a statement that it will cooperate with the regulator but has argued throughout the public consultation that the inclusion of AI Overviews in the ranking perimeter forces the company to disclose parameters it claims are trade secrets. In terms of timelines: six months (thus, until December 2026) for the ranking requirement; three months (September) for portability. The maximum fine under the DMCC Act reaches 10% of global annual revenue, a ceiling that, in Alphabet's case, corresponds to around $35 billion based on 2025 revenue.
The regulator left the door open for new rounds. In parallel, the CMA continues investigating mobile search under Google's Strategic Market Status, with a decision expected in early 2027. Thus, today's order is the lowest ceiling, not the highest: British companies that depend on organic traffic now have a legal framework to complain, and the rest of the regulatory world has a practical test to emulate.