DMAはヨーロッパ人のセキュリティとプライバシーを損なうべきではないThe DMA should not undercut security & privacy for Europeans

Google has publicly cautioned that some compliance obligations under the European Union's Digital Markets Act (DMA) could weaken the security and privacy safeguards that protect people in Europe. The argument matters because it highlights a growing tension at the heart of digital regulation: how to open dominant platforms to competition without inadvertently exposing users to new risks. Google's position, laid out in company blog commentary, is that regulators should pursue market fairness in ways that do not force users to accept trade-offs on safety.

The DMA is a landmark EU law designed to curb the power of large online platforms. It designates certain companies as "gatekeepers," a category that includes Alphabet's Google, Apple, Meta, Amazon, Microsoft and ByteDance. Gatekeepers face a set of obligations meant to increase competition and user choice, such as allowing alternative app stores, permitting third-party access to certain services, refraining from self-preferencing their own products in search results, and enabling greater data portability and interoperability. The regulation began applying to designated companies in 2024 and complements the broader EU framework that also includes the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA).

Google's concerns appear to focus on several specific requirements. One is the pressure to share data with third parties, including rival services and business users, which the company suggests could increase the risk of sensitive information being exposed or misused if adequate safeguards are not in place. Another is the mandate to make search results and other features more open to competitors, which Google has argued may sometimes surface lower-quality or less trustworthy sources. The company has also raised questions about how interoperability and alternative distribution channels are implemented, warning that loosening controls over how apps and data flow could create openings for bad actors.

These arguments are not unique to Google. Apple has made broadly similar claims about the DMA's requirement to allow app sideloading and alternative app marketplaces on iPhones, contending that bypassing its own App Store review process could expose users to malware, fraud and privacy-invasive software. Critics of both companies counter that such warnings can also serve commercial interests, since the same security-centered gatekeeping helps preserve the platform control and revenue that the DMA is intended to loosen. Regulators and consumer advocates have argued that openness and security are not inherently in conflict, and that well-designed technical measures can achieve both.

The debate over messaging interoperability illustrates the underlying technical complexity. The DMA requires gatekeepers to make their messaging services interoperable with those of competitors upon request. Security researchers have noted that connecting end-to-end encrypted systems built on different protocols is difficult, because encryption guarantees can be hard to preserve when messages cross between platforms that handle keys and metadata differently. Implementing interoperability without weakening encryption is technically possible but demanding, and the outcome is likely to depend heavily on the standards and safeguards that companies and regulators agree on.

For the European Commission, the challenge is to enforce the DMA's pro-competition goals while responding to legitimate security considerations and distinguishing them from arguments that primarily protect incumbents. The Commission has the power to investigate non-compliance and levy substantial fines, and it has already opened proceedings and issued preliminary findings against several gatekeepers, signaling that it intends to enforce the rules assertively. It has generally maintained that companies remain responsible for protecting users and that compliance can be designed in privacy-preserving ways.

The broader context is a shift in how governments approach large technology firms. The EU has positioned itself as a global leader in digital regulation, and rules like the DMA are being watched closely by policymakers elsewhere considering similar measures. How the security-versus-openness question is resolved in Europe could therefore influence regulatory approaches well beyond the bloc. For now, Google's message is essentially a call for careful implementation: it says it supports the DMA's aims but wants the technical details worked out so that compliance does not come at the expense of the protections users rely on. Whether that framing reflects genuine risk, competitive self-interest, or both is likely to remain contested as enforcement continues.