I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and have brought over 40 of them to successful exits. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.

Google's search business is under pressure from several directions at once. The DOJ's antitrust remedy, the EU's Digital Markets Act, the UK's Competition and Markets Authority, and the proposed US SEARCH Act all impose requirements that Google share its search data with rivals. And every one of those efforts runs into the same wall. Sharing the data means grappling with privacy law, and privacy law keeps tripping over a single word.

I recently sat down with Alissa Cooper, Executive Director of the Knight-Georgetown Institute, for the Monopoly Report podcast to work through some of these concepts. What follows draws from that conversation.

I’m not going to provide a deep analysis of each of the competition laws that would require that Google turn over this data. Rather, my goal here is to analyze Google’s arguments for why turning over the data will create issues. I offer this for two reasons:

Of course, most rival search engines want access to Google’s data. I don’t think there’s much debate when it comes to how much larger Google’s search business is when compared to any of its competitors. Even with that in mind, a few data points shared by Alissa jump out:

That's the case for sharing in a nutshell. A rival can't build a quality search engine without seeing what people search for and how they react to the results. Google sees almost everything. Nobody else sees much. As Cooper put it, the smaller competitors live and die on whether the first result feels good enough that a user doesn't switch straight back to Google.

Google's response to these requests focuses heavily on core tenets of privacy, such as anonymization and re-identification. Google’s security team told WIRED it could re-identify supposedly anonymized search users in under two hours, and argued that if data can be re-identified, it was never anonymous to begin with. In fairness to Google, the company isn’t pulling all this out from the ether; it is merely pointing to the law.

Article 6(11) of the Digital Markets Act (DMA) requires that Google share ranking, query, click, and view data with its rivals. But it also requires that any “such query, click, and view data that constitutes personal data shall be anonymised.”

The anonymization requirements work at cross-purposes to the data-sharing requirements.

Just last month, an influential group of EU data protection regulators (the EDPB) issued guidance on anonymization. I’ll admit, the EDPB tends to take the most privacy-protective positions. Moreover, its view is seemingly at odds with recent CJEU decisions and the EU Digital Omnibus. But this view (which effectively hasn’t changed since 2014) makes clear that anonymization is all but impossible and that the ability to single out a user effectively trumps anonymity.

And all this provides Google with a pretty solid perch from which to make its argument in connection with anonymity.

Alissa and her colleagues at KGI note that there are provisions in place designed to address privacy concerns. For example, rivals receiving the search data would be subject to audits and governed by robust contractual provisions. If you frame the privacy and data-sharing questions around practical incentives rather than theoretical capability, then Google's focus on anonymity starts to look less compelling.

That said, if you feel like you’ve heard this argument before, it’s because you have. (Hence, the Freaky Friday reference.)

The argument Alissa is making is very similar to the harms argument that “the ads industry” (including Google!) has made for the better part of two decades. The idea being that contractual provisions, audits, and a robust analysis of data flows can sufficiently address the privacy issues that might arise here.

I’m not saying I disagree with that view. But as someone who’s attempted to make a very similar argument in EU privacy circles before, I can tell you that argument does not tend to hold much water over there.

Unfortunately, this turns the debate into an arcane fight over which European institution used which word, when it should be about people's actual privacy.

I see two broad possibilities:

Which do you think is more likely?

If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.

Be in the rooms defining the future of advertising and brand building.

There’s no better place to discuss where advertising is headed than the city that helped lay its foundations. This fall, Marketecture Live is setting its clocks to Central Time and convening in the heart of brand building: Chicago.

The Windy City has long been a hub for world-class brand work, commerce, and innovation. Now, it serves as the backdrop for conversations shaping AI, retail media, connected TV, creator marketing, and the future of consumer engagement.

There’s no better place for brand and agency professionals to revamp their strategies for an AI- and creator-led future of brand building.

Tickets are going fast. Secure your seat at chicago.marketecturelive.com.

*Tickets are complimentary for qualified agency and brand attendees.