Google Search data sharing under Article 6(11) DMA

Preliminary ¶ 1 to Final ¶ 1

To meet the requirements of Article 6(11) of Regulation (EU) 2022/1925, Alphabet shall engage with any third-party undertaking that appliesexpresses interest in applying for eligibility to receive the ranking, query, click and view data in relation to free and paid search generated by end users on its OSEsonline search engine (“OSE”) (“Search Data”) as specified in section 2 to determine whether it is eligible to receive themthe Search Data following the process specified in section 5.4.1.

Preliminary ¶ 2 to Final ¶ 2

Alphabet shall share the Search Data with any third-party undertaking providing online search engines (“OSEs”) in the EU and in the EEA,^{Preliminary measures note 2Final measures note 1} which meets the definition of an OSE set out in Article 2(5) of Regulation (EU) 2019/1150 and the requirements of the eligibility assessment specified in paragraphs (3) – (9) (an “eligible third-party OSE”). Alphabet shall not exclude third-party undertakings, such as undertakings providing AI chatbots with OSE functionalities, to the extent that these undertakings provide an OSE meeting the definition set out in Article 2(5) of Regulation (EU) 2019/1150, even if the OSE is provided as part of a broader service.

Preliminary — to Final ¶ 3

Alphabet shall assess: (a) Whether an undertaking applying for eligibility to receive Search Data (an “undertaking applying for eligibility”)^{Final measures note 2} is subject, directly or indirectly, to restrictive measures or other sanctions under Union law;^{Final measures note 3} and (b) Whether the undertaking applying for eligibility is subject, directly or indirectly, de jure or de facto, to the control of a third country that poses a serious and structural non-technical cyber security and/or data protection risk, taking into account the following elements: (1) The existence of laws in the third country which require entities under their jurisdiction to report information on software or hardware vulnerabilities to authorities of that third country prior to those vulnerabilities being known to have been exploited; (2) Existing practices in the third country, demonstrated by independent sources, that require entities under the jurisdiction of the third country to report information on software or hardware vulnerabilities to authorities of that third country prior to those vulnerabilities being known to have been exploited; (3) The absence of effective judicial remedies, and independent and democratic control mechanisms, that can allow individuals and companies to exercise their rights to the protection of personal data and/or to correct the identified security concerns, including about existing practices referred to in point (2); (4) Substantiated information about one or more incidents of threat actors controlled from that third country and operating out of the territory of that third country carrying out malicious cyber activities or campaigns, including phishing and theft of personal data; and (c) Whether the undertaking applying for eligibility is an established company or credible new entrant providing an OSE as a genuine economic activity in the EU. This condition shall be met only if the undertaking applying for eligibility: (1) Either: (a) Has provided OSE services in the EU for at least the last two consecutive years at the time of applying for eligibility; or (b) Was founded less than two years ago but has received more than EUR 50 million in capital investments; and (2) Has had at least 50 000 monthly average users of its OSE services in the EU in the past year.

Preliminary — to Final ¶ 4

Alphabet shall conduct this assessment within the time limit specified in section 5.4.1 and in a strictly FRAND and proportionate manner. As far as practicable, Alphabet shall base its assessment on publicly available information. Alphabet may only request strictly necessary additional information from undertakings applying for eligibility to the extent that such information is not publicly available and shall justify why this information is necessary. Alphabet should not require the provision of business secrets of the undertaking applying for eligibility.

Preliminary — to Final ¶ 5

To this end, in accordance with section 5.4.1, Alphabet shall prepare a list of fair, reasonable and non-discriminatory (“FRAND”) and strictly necessary questions for assessing whether an undertaking applying for eligibility meets the eligibility criteria specified in this section. Alphabet may reject an undertaking as ineligible to receive Search Data if: it identifies clear and objective evidence that the undertaking is subject, directly or indirectly, to restrictive measures or other sanctions under Union law; if the undertaking is subject, de jure or de facto, to the control of a third country that poses a serious and structural non-technical cyber security and/or data protection risk as described in recital (3)(b); or if the undertaking does not meet the above specified quantitative thresholds demonstrating that the undertaking is an established company or credible new entrant providing OSE services as a genuine economic activity in the Union.

Preliminary — to Final ¶ 6

As part of its eligibility assessment, Alphabet shall also inquire whether the undertaking applying for eligibility plans to process and maintain the Search Data within the EEA or whether it plans to request access via: (a) International transfer of the Search Data to a non-EEA country on the basis of an adequacy decision of the Commission;^{Final measures note 4} or (b) International transfers of the Search Data on the basis of one of the relevant transfer tools foreseen in Article 46 of Regulation (EU) 2016/679 towards a non-EEA third country that is not covered by any adequacy decision.

Preliminary — to Final ¶ 7

If Alphabet finds that it, as the controller and exporter of the Search Data (as specified in section 3.2.1), is unable to ensure a level of protection essentially equivalent to that guaranteed within the EEA, it shall conclude that the undertaking applying for eligibility is not eligible to access the Search Data.

Preliminary — to Final ¶ 8

Irrespective of the eligibility criteria in paragraph (3), where there are credible indications that the communication of the Search Data to such undertakings may undermine the public security of the EU or its Member States, Alphabet may submit a reasoned request asking to be exempted from its obligations under Article 6(11) of Regulation (EU) 2022/1925 with respect to individual undertakings applying for eligibility. The Commission will assess this request pursuant to the exemption procedure set out at Article 10 of Regulation (EU) 2022/1925. This is without prejudice to the Commission’s power to initiate the exemption procedure under Article 10 of Regulation (EU) 2022/1925 based on public security grounds on its own initiative.

Preliminary — to Final ¶ 9

Neither the eligibility assessment nor the transfer impact assessment (if applicable) nor any potential reasoned request on grounds of public security may replace the condition specified in section 5.4.1 that all undertakings applying for eligibility shall procure a Level 1 reasonable assurance report before Alphabet may grant them access to Search Data. Alphabet shall not seek to substitute its eligibility assessment or transfer impact assessment (if applicable) or potential reasoned request on grounds of public security for the assessment of the independent assurance practitioner specified in section 3.2.4.

Preliminary ¶ 3 to Final —

To meet the requirements of Article 6(11) of Regulation (EU) 2022/1925, Alphabet shall give any third-party undertakings providing OSEs access to all the Search Data on par with the data collected by Alphabet for the purpose of optimising its OSE services subject to anonymisation requirements. This parity principle shall determine, for example, the scope of data sharing and the conditions of sharing data with third-party OSEs.

Preliminary ¶ 4 to Final ¶ 10

Subject to anonymisation requirements, Alphabet shall share with eligible third-party OSEs any query input entered by end users into Google Search on any access point, any modifications made by end users and Alphabet to this initial query, and any other metadata about the user and query, on par with the data collected by Alphabet for the purpose of optimising its OSE services.

Preliminary ¶ 5 to Final ¶ 11

It follows that Alphabet shall share with eligible third-party OSEs at least the following query data for each access point (e.g., Google Search website and browser omnibox on Chrome and third-party browsers, Google Search widget, Google Search application, Text Search on Android, Google Assistant, Google Lens and Circle to Search): (a) Query input and modification data: (1) Query input as entered by end users (the “initial query”); (2) Query as modified by end users and Alphabet (the “modified query”), including the modifications made through query shortcut chips, autocomplete function, entity results, query suggestions, “see results about” feature, autocorrect function, and advanced searchautocorrect filtersfunction; (3) Content of query modifiers; (4) Identifier of the type of query modification.; (b) Query metadata: (1) Query time stamp; (2) User location; (32) Query language identifier; and (43) User device identifier, including mobile handsetsmobiles, desktops and tablets; (5) Indication of the user’s access point to Google Search, including for the following access points: browser omnibox on Chrome and third-party browsers, Google Search website, Google Search widget, Google Search application, Google Assistant, Gemini, Google Lens, Circle to Search and Text Search on Android; and (6) Indication of the method of query input, including text, voice and photo requests.

Preliminary ¶ 6 to Final ¶ 12

Subject to anonymisation requirements, Alphabet shall share with eligible third-party OSEs any URLs and the description of visual contentelements which are displayed on search engine results pages (“SERPSERPs”), served to end users in response to their queries and are viewed by them (i.e., they generate an impression), no matter their type, format, structure or tab in which they are included, on par with the data collected by Alphabet for the purpose of optimising its OSE services.

Preliminary ¶ 7 to Final ¶ 13

It follows that Alphabet shall share with eligible third-party OSEs at least the following view data: (a) Uniform resource locators (“URLs”): (1) All URLs, regardless of theirthe format of search result (e.g., photos, videos, text); (2) All URLs, regardless of their structure (e.g., main URLs, associated URLs); (3) All URLs, regardless of their type (e.g.,for organic search resultresults URLs,and paidadvanced search result URLs at the main domain levelresults, including top ad URLs and in-stream URLs,placeholders andfor advancedpaid search resultresults, URLswhich are displayed in various search modules); and (4) All URLs, including from the following tabs: “Videos”, “Short Videos”, “News”, “Forums”, “Web”, “Books” and “Images”.; (b) LinkURL identifiers: (1) Identifier of the type of result format, including text, video and photo; (2) Identifier of the place of result in the SERP’s structure, including main and associated URLs; (3) Identifier of the type of tab, including, for example “Web”, “Images”, “Videos”, “News”; and (4) Identifier of the result type, including organic search results, identifier of paid search results, identifier of advanced search results, the latter including the identifier of sub-type, for example, “ShortDirect Answer”, “Knowledge Panel”; (c) Description of visual elements: (1) The fact of displaying and the text included in query input areas in query shortcut chips, entity results, query suggestions, “see results about” feature and similar, which are displayed on SERPs; (2) The fact of displaying tabs on SERPs and their type; and (3) The fact of displaying paid search modules and advanced search modules and their types, irrespective of whether such elements are displayed with or without an URL.

Preliminary ¶ 8 to Final ¶ 14

Subject to anonymisation requirements, Alphabet shall share with eligible third-party OSEs any data on user interaction with the SERP as displayed on the user’s device, with any visual elements displayed on it, including blocks and any URLs and with the pages linked by these URLs, including the type, timing, order and duration (where relevant) of user actions, or lack thereof, on par with the data collected by Alphabet for the purpose of optimising its OSE services.

Preliminary ¶ 9 to Final ¶ 15

It follows that Alphabet shall share with eligible third-party OSEs at least the following click data, (i) for each URL served onor thevisual SERPelement inshared responsepursuant to a user input, only excluding individual paid search resultsparagraphs URLs,(12) and (ii13) for each block of paid search results presentedthese onmeasures the(together: “SERP Element”): (a) Timing, orderOrder and duration, or the absence of, clicks and clicks back (i.e. clicks indicating the user’s return to the SERP following an earlier click) on the URL/blockSERP Element; (b) The duration a user viewed the given URL/block or the dataSERP allowingElement; to(c) inferThe itduration, i.e. at leastor the height and sizeabsence of the URL/block, its distance from the tophovering ofon the SERP, the share it occupies of the user’s viewportElement; (i.e.d) theThe areanumber, ofor the webpage whichabsence isof, visiblescrolls on the user’sSERP; device(e) andThe theoccurrence, durationor the userabsence stayedof, onswipes within a givenswipeable screenSERP viewElement; and (cf) Timing, order andThe durationoccurrence, or the absence of, hovering, scrolling, swipes and expansionsexpansion of/on the URL/block or thea SERP as displayed on the user’s device;Element.

Preliminary ¶ 10 to Final ¶ 16

ForSubject to anonymisation requirements, for each URLSERP Element shared underpursuant viewto dataparagraphs (12) and (13) of these measures, Alphabet shall share with eligible third-party OSEs (i) the URL’sSERP Element’s absolute, whole page position on the SERP as displayed on the user’s device, (ii) the URL’sSERP Element’s relative ordinal position, in relation to other URLsSERP Elements presented within the same area on the SERP and (iii) any other information on the URL’sSERP Element’s relative and absolute position, prominence and visibility on the SERP, as displayed on the user’s device, on par with the data collected by Alphabet for the purpose of optimising its OSE services.

Preliminary ¶ 11 to Final ¶ 17

It follows that Alphabet mustshall share with eligible third-party OSEs at least the following ranking data (i) for each URL shared under view data,SERP onlyelement excludingshared paidpursuant searchto resultparagraphs URLs,(12) and (ii13) for each block of paid search results presented on thethese SERPmeasures: (a) Identifier of the absolute, whole page position on the SERP in which the URL/blockSERP element is displayed (e.g., top area, main column, right side column); (b) The relative ordinal position of the URL/blockSERP Element in relation to other URLs/blocksSERP Elements displayed in the same SERP area and the identification of all other URLsSERP Elements displayed in the same area; and (c) Information about the page on which the URL/blockSERP Element was displayed on the user’s device.

Preliminary ¶ 12 to Final —

Alphabet shall share the search session data on par with the data which it itself collects and uses.

Preliminary ¶ 13 to Final —

It follows that Alphabet shall at least group query, click view and ranking data from the same user in the chronological order

Preliminary ¶ 14 to Final ¶ 18

Alphabet shall exclude invalid traffic, i.e., query, view, click and ranking data, that does not originate from a human user or a genuine user interest, from the Search Data shared with beneficiarieseligible third-party OSEs. To exclude invalid traffic, to the extent technically possible, Alphabet shall use the same methods and process it uses itself in its ordinary course of business and shall not give rise to incremental costs attributable to making the data available.

Preliminary — to Final ¶ 19

Alphabet shall provide, upon request of eligible third-party OSE information enabling the third party to understand how invalid traffic is excluded and how the exclusion of invalid traffic impacts the dataset, without revealing Alphabet’s business secrets.

Preliminary ¶ 15 to Final ¶ 20

Alphabet shall share the Search Data with eligible third-party partiesOSEs on par with Alphabet’s own frequencylatency of accessaccessing the same data for the purpose of optimising its OSE services to the samegreatest extent that is technically feasible. The sharing of Search Data shall be carried out within a timeframe of no less than 7 days, which reflects [Business secret - Description of Google’s internal systems], and some additional days to anonymise and share the data with third-party OSEs. The final latency of Search Data sharing shall be communicated by Alphabet within the time limit specified in section 5 to the Commission, along with a detailed technical description and justification why it is the lowest latency that can be technically achieved (including meaningful and comprehensive information that can be shared and tested with interested third parties without revealing business secrets, and subsequently notified to them).

Preliminary — to Final ¶ 21

No matter the final latency, Alphabet shall share the Search Data in daily batches and with daily time stamps.

Preliminary ¶ 16 to Final ¶ 22

Alphabet shall use the method of sharing that it uses itself internally for sharing the Search Data with eligible third-party partiesOSEs to the greatest extent that is technically feasible, avoiding unnecessary cost or operational friction, and in any case the method of sharing needs to enable effective sharing of Search Data. Alphabet should provide technical support to third-party OSEs accessing the Search Data.

Preliminary ¶ 17 to Final —

It follows that Alphabet must share the Search Data via an API. The API sharing method must enable third parties to access only new data, rather than the complete updated dataset every time they use the API.

Preliminary ¶ 18 to Final ¶ 23

The access-period wording changes here. The final sentence of preliminary paragraph 18 is retained separately in final paragraph 25.

Alphabet shall offershare the Search Data towith anyeligible third-party undertakings providing OSEs for athe durationperiod thatof cantheir reasonablychoice enableand itup to optimise its OSE services, which must be at least five years starting from the moment when the Search Data becomes effectively accessible to that specific third party. This is without prejudice to Alphabet being obliged to continue offering the Search Data to any third-party OSE for the entire duration of Google Search’s designation as a core platform service.

Preliminary — to Final ¶ 24

Notwithstanding, the Commission reserves the right to reassess and potentially revise the specification of this duration if it determines that the maximum five-year period of Search Data sharing is not sufficient to achieve the objectives set out in Article 6(11) of Regulation (EU) 2022/1925, in accordance with Article 8(9) thereof.

Preliminary — to Final ¶ 25

Relocated from the final sentence of preliminary paragraph 18; the continuing offer obligation is not new.

This is without prejudice to Alphabet being obliged to continue offering the Search Data to eligible third-party OSEs for the entire duration of Google Search’s designation as a core platform service.

Preliminary ¶ 19 to Final ¶ 26

The Commission’s preliminary measures to ensure anonymisation of end users’ personal data in the Search Data consistby mitigating the risks of twoend componentsusers’ re-identification to an insignificant level through: (a) Technical measures: these measures alter the Search Data and play a prominent role to mitigate the risk of re-identification of end users towithout asubstantially residualdegrading levelthe data quality and usefulness (the Search Data after the application of technical measures are referred to as the “Search Dataset”). These measures are outlined in section 3.1. (b) Contractual measures: the contractual measures complement the technical measures and further mitigate the residual risks of re-identification of end users to an insignificant level. These measures are outlined in section 3.2.

Preliminary ¶ 20 to Final ¶ 27

Alphabet shall share the Search Data daily and at record- level in random order. Each input record shall contain a query text with metadata and shall successfully meet the Commission’s technical measures to be included in the Search Data. The technical measures consist of the following steps:

Preliminary ¶ 21 to Final ¶ 28

Attribute suppression. For each record, Alphabetthe following attributes shall removebe removed ((a) to (ek)) orand replacereplaced ((f) and (gl)) the following attributes:. (a) Any end user identifier, i.e., any direct identifier assigned to a user or user session, such as Google account identifiers (e.g., account IDs, usernames), whether the user was signed in, and other associated direct identifiers (e.g., IP addresses, device IDs). (b) The precise timestamp of the query. For the avoidance of doubt, the day of the query shall remain available. (c) Information about the size (height and sizewidth) of modules and results. (d) Information about the distance from each module or result to the top of the SERP. (e) Information about the share each module or result occupies of the user's viewport. (f) QueriesThe inaccess point. (g) The input format. (h) Ad URLs. For the formavoidance of imagesdoubt, the existence of an ad and interaction data related to that ad shall be replacedmaintained. with(i) aAdvanced placeholderfilters applied to a query. For(j) queriesResults that combineare imagesGoogle andservices textwhich directly include personal information saved in an end user Google account (e.g., onlyGoogle Maps results with directions to or from home) or the imageend shalluser’s beexact replacedlocation (e.g., Google Maps result with directions). Alphabet shall submit a placeholderlist queryof such result types to the Commission for approval within the time limit specified in section 5.2. The(k) textWithin shallsessions notin AI Mode, any queries after the initial query (only the initial query of an AI Mode session shall be suppressedprovided). (gl) ClickQueries backin timethe form of images shall be binnedreplaced intowith thea followingplaceholder timequery. intervals:For 0-10queries seconds;that 10-25combine seconds;images 25and secondstext, –only 1the minute;image 1shall –be 3replaced minutes;with 3a –placeholder 20query. minutes;The andtext moreshall thannot 20be minutessuppressed.

Preliminary ¶ 22 to Final ¶ 29

Allowlist creation: Alphabet shall generate and update weeklymonthly an allowlist of words appearing in search queries from signed-in end users using the past 13 months of EEA search data employing the following procedure: (a) Alphabet shall split the original query text of each search record into entities: (1) Alphabet shall use personal data detectors to detect addresses, names, phone numbers, location coordinates, IBAN numbers, credit card numbers and other forms of well-known identifiers and resolve them to standard formats. (2) Alphabet shall split the rest of the query, which has not been detected as personal data, into words based on whitespace, not counting whitespaces between two digits. For example, the query “john doe 200 wetstraat brussel 04 12 34 56 78 communications department” could be split into “john doe” (flagged by the full name detector), “200 wetstraat brussel” (flagged by the address detector), “04 12 34 56 78” (flagged by a phone number detector), “communications”, and “department” (single words). (b) For each entity, Alphabet shall count the number of unique signed-in end users who submitted queries containing the entity in the past 13 months in the EEA. (c) Alphabet shall add an entity to an allowlist for five years if the entity is included in queries issued by more than 50 (w) signed-in end users.

Preliminary ¶ 23 to Final ¶ 30

Length-based thresholds determination: Every week, usingBased dataon forqueries thatissued pastin week2025 fromby both signed-in and signed-out users in the EEA, Alphabet shall compute a length-based character threshold (c) as follows: (a) For each inferred language in which a query text has been issued, find the value of threshold c so that 95% of unique queries with that inferred language in the week concerned have fewer than c characters.

Preliminary ¶ 24 to Final ¶ 31

Query suppression: Every day, Alphabet shall apply the following procedure on each search record generated by signed-in and signed-out end users in the past 24 hours in the EEA: Alphabet shall remove the entire search record from the Search Data if the modified query (see definition in paragraph (511)(a)(2)) does not meet either of two conditions: (a) Entity-based threshold: Alphabet shall split the query text into entities (as described in paragraph (22)(a29)) and determine whether all entities are in the allowlist. (b) Length-based threshold: Alphabet shall check whether the query text is shorter than the length threshold of c characters (see paragraph (2330)) for the query’s associated inferred language.

Preliminary ¶ 25 to Final —

If the query contains free-text search filters whose contents are not included in the modified query, Alphabet shall check whether the contents of each filter meet the two thresholds. If the two thresholds are not met, the entire record is removed from the search dataset. If the free-text search filters meet the thresholds, Alphabet shall add the relevant free-text search filters as data fields to the corresponding search record.

Preliminary ¶ 26 to Final ¶ 32

If the initial query text (see definition in paragraph (511)(a)(1)) is different from the modified query text, Alphabet shall check whether the initial query text meets the two thresholds. If the initial query text does not meet the two thresholds, the initial query text is removed from the search record; otherwise, Alphabet shall add the initial query text as a data field to the corresponding search record.

Preliminary ¶ 27 to Final ¶ 33

If the SERP contains query refinermodifier text, Alphabet shall check whether the query refinermodifier text meets the two thresholds. If the query refinermodifier text does not meet the two thresholds, the query refinermodifier text is removed from the search record; otherwise, Alphabet shall add the query refinermodifier text as a data field to the corresponding search record.

Preliminary ¶ 28 to Final ¶ 34

Metadata generalisation: For queries that pass query suppression, Alphabet shall apply metadata generalisation to each search record. The attributesattribute subject to generalisation areis the location,. inferredThe language,timeframe devicefor typemetadata andgeneralisation accessis pointthat typesof (seethe paragraphdata (5)(b)(5))release, i.e. 24 hours.

Preliminary ¶ 29 to Final ¶ 35

Alphabet shall share the location data of the end user as an <country, s2_cell> pair; where country isusing the country from which a query originates, and s2_cell is a bounding box which includes at least 1third 000level signed-inof usersthe andEU withNomenclature aof surfaceterritorial areaunits offor atstatistics least(NUTS 3km²3).^{Preliminary measures note 3Final measures note 5}

Preliminary ¶ 30 to Final —

The S2-cell fallback is replaced by the different country-level fallback in final paragraph 36.

Whenever the below metadata generalisation procedure refers to generalising the location, Alphabet shall perform the following procedure on a location pair (<country, s2_cell>) to generalise the location by one level: (a) If s2_cell is not null, then i be its hierarchy level, and let bigger_s2_cell be the S2 cell that contains s2_cell and whose hierarchy level is i - 1. (1) If i is 7 or fewer, return <country, null>.^{Preliminary measures note 4} (2) If the centre of bigger_s2_cell is not in country, then return <country, null>. (3) Otherwise, return <country, bigger_s2_cell>. (b) If s2_cell is null, then return <null, null>. The location can no longer be generalised; it corresponds to the full EEA.

Preliminary ¶ 31 to Final ¶ 36

Alphabet shall check whether at least 501,000 (r) signed-in end users have issued a query with the same metadata attribute values for inferred language, location information, and device type. If such condition is not met, Alphabet shall generalise the metadata attributes in the following sequence until the r-threshold of 50 is met: (a) First, Alphabet shall generalise location by one level at a time, at most twice. (b) Second, Alphabet shall supress the device information and the access point information. (c) Third, Alphabet shall generalise the locationto onecountry level at a time, until it can no longer be generalised. If the r-threshold is still not met at any of the three steps above, meaning that fewer than 501,000 (r) end users submitted queries with the same inferred language valueand device type in thea EEAgiven country, Alphabet shall remove the query and its corresponding searchresults recordsand metadata from the Search Data.

Preliminary — to Final ¶ 37

Replaces the fixed click-back bins in preliminary paragraph 21(g), while also addressing other interaction durations.

Within each metadata group, click back time and interaction durations (e.g., hovering and viewing) shall be binned into time intervals expressed in milliseconds and corresponding to the: 20th, 40th, 60th and 80th percentile of their respective duration distributions within the metadata group.

Preliminary ¶ 32 to Final ¶ 38

Mini-sessionisation: Alphabet shall group records by ordering all records from the same end user chronologically and adding each search record to the previous group if the following conditions are met: (a) The current search record was generated by one of the following ways: (1) The user clicked on a query refinermodifier (e.g., "Did you mean…" spelling suggestions, autocomplete suggestions, query suggestions, query shortcut chips, entity results, etc.) in the previous record's SERP. (2) The user selected the search barentered anda selectednew onequery ofinto the autocompletesearch suggestionsbox on the previous record's SERP, withoutand manuallythe enteringprevious additionalrecord's information.query (3)text Theis usera enteredsubstring aof newthe current search record's query intotext. theThe searchmaximum boxlength onof thea previousmini-session record'sshall SERP,be andthree thequeries, previousand record'sa query textcan isonly abe substringpart of theone currentmini-session search(i.e., record'smini sessions shall not overlap). Clicked modifiers from the last query textin a mini-session shall be suppressed.

Preliminary ¶ 33 to Final ¶ 39

Alphabet shall tag each search record associated with a group with the same unique random numberidentifier and provide them in chronological order. The location and device metadata of all records in a mini-session isare overridden with the location and device metadata of the last record of this mini-session.

Preliminary ¶ 34 to Final ¶ 40

Alphabet shall include the search records after the five steps in the Search Data. Alphabet shall include all other data (as defined in section 2.1) unaltered, without applying any additional measures.

Preliminary — to Final ¶ 41

Within the time limit set out in section 5.2, Alphabet shall communicate for the Commission’s review: (a) Which personal data detectors and which entity types Alphabet intends to use to recognise entities as part of query suppression, including the parameters such as the likelihood threshold (confidence) of each detector. Alphabet shall explain why it has identified its proposal as the best performing option and why alternatives identified are less suitable. (b) A list of result types that link to Google services which directly include personal information saved in an end user Google account (e.g., Google Maps results with directions to or from home) or the end user’s exact location (e.g., Google Maps result with directions) which shall be suppressed (see paragraph (28)(j)). (c) The computing resource cost for each of the steps that are part of the technical anonymisation measures, including a detailed explanation of what factors drive the computing cost of each step.

Preliminary — to Final ¶ 42

If Alphabet includes any attributes in the dataset that are not explicitly mentioned in section 2.1, it shall determine whether any anonymisation measures are required in relation to that attribute. If so, Alphabet shall propose to the Commission an appropriate anonymisation measure in relation to that attribute, which does not unnecessarily degrade the quality or usefulness of the data. As part of its proposal, Alphabet shall provide a quantitative estimate of the proportion of data altered and suppressed by the proposed measure.

Preliminary — to Final ¶ 43

Alphabet shall provide to eligible recipients the following information in relation to the technical anonymisation measures on a quarterly basis: (a) Which personal data detectors and which entity types Alphabet used to recognise entities as part of query suppression, including the parameters used such as the likelihood threshold (confidence) of each detector and detection performance statistics. Alphabet shall use publicly available personal data detectors (e.g., Google Sensitive Data Protection). (b) The proportion of unique queries and query volume suppressed and altered for each anonymisation measure and each personal data detector separately, computed over the full quarter.

Preliminary — to Final ¶ 44

Alphabet shall update the Commission on relevant technological developments.

Preliminary ¶ 35 to Final ¶ 45

Alphabet shall ensure, through contractual arrangements with third-party OSEs accessing the Search Dataset, that Alphabet and the third-party OSE are recognised as independent controllers within the meaning of Article 4(7) of Regulation (EU) 2016/679.

Preliminary ¶ 36 to Final ¶ 46

Alphabet shall ensure, through contractual arrangements with third-party OSEs accessing the Search Dataset, the following allocation of responsibilities: (a) Alphabet is controller for the processing of end users’ personal data carried out to implement the technical measures set out in section 3.1 prior to the sharing or granting access to the Search Dataset; (b) Alphabet ensures that the sharing or granting access to the Search Dataset is carried out in a secure manner, in accordance with Articles 5(1)(f) and 32 of Regulation (EU) 2016/679 and, where applicable, in compliance with the requirements of Chapter V of that Regulation; (c) The third-party OSE accessing the Search Dataset is responsible and liable for ensuring the lawful and compliant processing of personal data of individuals other than end users forming part of the Search Dataset under Regulation (EU) 2016/679, including any processing performed by third parties with whom it has contracted to process the Search Dataset on its behalf acting as processors or authorised sub-processors (i.e. subcontractors); (d) The third-party OSE accessing the Search Dataset is responsible to ensure that any processors or authorised sub-processorssubcontractors involved in the processing of the Search Dataset are contractually bound to implement all relevant contractual measures set out in sections 3.2.2 and 3.2.3, and that contractual arrangements with such processors or sub-processorssubcontractors explicitly provide independent auditor(s) with the right to verify compliance with these contractual measures in line with the measures in section 3.2.4; (e) The third-party OSE is responsible and liable under Regulation (EU) 2016/679 for any personal data processing resulting from a breach or circumvention of the contractual measures imposed by Alphabet to ensure anonymisation of end users’ personal data, including any processing performed by its processors or authorised sub-processorssubcontractors, without prejudice to the allocation of responsibility and liability under that Regulation, in particular Article 82 and 83 thereof.

Preliminary ¶ 37 to Final ¶ 47

Alphabet shall ensure, through contractual arrangements with third-party OSEs accessing the Search Dataset, that it imposes only the contractual measures complementing the technical measures necessary to ensure anonymisation of the Search Dataset set out in sections 3.2.2, 3.2.3 and 3.2.4, without extending control over the third-party OSE’s independent processing activities.

Preliminary — to Final ¶ 48

Effective control: Alphabet shall require the third-party OSE to maintain the Search Dataset within a processing environment under its effective control. Any processing of the Search Dataset by the third-party OSE’s subcontractors shall take place within that processing environment.

Preliminary ¶ 39 to Final ¶ 49

The earlier separation duty is recast as a broader segregated-processing requirement.

Access control separation with auxiliary advertising andSegregated analyticsprocessing datasetsenvironment: Alphabet shall require the third-party OSE to implementprocess technicalthe Search Dataset exclusively within a logically and organisationaltechnically measuressegregated atprocessing environment so as to prevent linking between the infrastructureSearch levelDataset suchand thatany accessother auxiliary dataset accessible to the third-party OSE or its subcontractors. The segregated processing environment shall ensure that: (a) the Search Dataset iscannot separatebe fromqueried accessjointly towith auxiliary advertisingdatasets; and(b) analyticsthe Search Dataset cannot be copied, merged, synchronised across the third-party OSE’s systems with auxiliary datasets; where(c) applicableprocessing of the Search Dataset by the third-party OSE and its subcontractors is confined to that segregated environment.

Preliminary ¶ 38 to Final ¶ 50

Prohibitions against linking, re-identification, linking and augmentation: Alphabet shall prohibit the third-party OSE from: (a) Attempting to link the Search Dataset with any auxiliary datasets at record level; (b) ReAttempting to re-identifyingidentify directly or indirectly end users, including by attempting to determine, learn or annotate which records relate to the same end users (i.e. “re-sessionisation”) in any way, such as semantic similarity, behavioural fingerprinting or other techniques, beyond any mini-sessionisationsessions provided as part of the Search Dataset; (c) Augmenting, enhancing, or processing the Search Dataset in a manner that reverses, weakens, or circumvents applied technical anonymisation measures, including attempts to infer or reconstruct truncated, generalised, or removed attributes.

Preliminary ¶ 40 to Final ¶ 51

PurposePermitted limitationpurposes of use: Alphabet shall require the third-party OSE to use the Search Dataset solely for the permitted purpose of optimising or improving OSE services, regardless of whether these services serve results directly to end users or are usedincluding for grounding AI chatbot servicesinstance, including butsearch notfunctionalities limitedsuch to,as refining retrieval and ranking systems, web crawling and index building, and functionalities such as query analysis, spell-checking, auto-suggestion, and auto-completion, and, shallwhere prohibitapplicable, for the third-partypurpose OSEof fromoptimising usingand itimproving grounding systems and search capabilities for unrelatedAI purposeschatbots insofar as such AI chatbots rely on search retrieval functionalities.^{Final measures note 6}

Preliminary — to Final ¶ 52

The prohibition of unrelated purposes was part of preliminary paragraph 40; it is now a separate paragraph.

Alphabet shall prohibit the third-party OSE from using the Search Dataset for other unrelated purposes.

Preliminary — to Final ¶ 53

Alphabet may prohibit third-party OSEs from looking up and serving results directly to end users from the Search Dataset.

Preliminary — to Final ¶ 54

Testing safeguard: where the permitted purpose under paragraph (51) involves the training or fine-tuning of machine learning models, including models supporting ranking, retrieval, or AI chatbot functionalities, Alphabet shall require the third-party OSE to conduct pre-deployment evaluation of the model to ensure that it does not, under reasonably foreseeable inputs, reproduce data from the Search Dataset in a manner exposing end users to risks of re-identification.

Preliminary ¶ 41 to Final ¶ 55

Retention duration: Alphabet shall require the third-party OSE to retain the Search Dataset for a period of maximum 13 months.

Preliminary ¶ 42 to Final ¶ 56

Prohibition of onward sharing and disclosure: Alphabet shall prohibit the third-party OSE from disclosing, sharing, sublicensing, or otherwise making available any ranking, query, click, or view data forming part of the Search Dataset received pursuant to Article 6(11) of Regulation (EU) 2022/1925 to any third party^{Preliminary measures note 5Final measures note 7}.

Preliminary ¶ 43 to Final ¶ 57

Governance and traceability: Alphabet shall require the third-party OSE to implement appropriate and proportionate data governance measuresand enablingtraceability themmeasures toenabling identifyverification andthat documentthe automatedabove processesprohibitions accessingare thecomplied Searchwith Dataset,and asthat wellprocessing asaligns relevantwith downstreamthe datasetspermitted orpurpose. modelsSuch thata aremeasure materiallyshall derivedinclude from,the oridentification demonstrablyand influenceddocumentation by the Searchthird-party Dataset,OSE inof: (a manner) sufficientAutomated tosystems enableand verificationprocesses thataccessing the above prohibitions are compliedSearch withDataset; and(b) thatMaterial processing alignsoperations withinvolving the permitted purpose. Such a measure shall notSearch extendDataset; to(c) processingModels wheretrained theor contributionfine-tuned ofusing the Search Dataset is negligible,that indirect,are orsubject noto longerthe reasonablytesting traceable,safeguard provided thatfor appropriatein safeguardsparagraph are(54), inand placeresults of this testing.

Preliminary ¶ 44 to Final ¶ 58

Alphabet shall require the third-party OSE to implement and maintain the following organisational, administrative and contractual measures, which constitute essential safeguards necessary to protect the integrity and confidentiality of the Search Dataset, including protection against unauthorised or unlawful access, disclosure, alteration or loss, taking into account the risks arising from its processing and recognised industry standards for protection of sensitive datasets:

Preliminary ¶ 45 to Final ¶ 59

Technical protection of the Search Dataset: Alphabet shall require the third-party OSE to ensure that the Search Dataset is encrypted when stored in any system or environment under the third-party OSE’s control and is encrypted during transmission between systems and environments, using state-of-the-art encryption appropriate for the sensitivity of the Search Dataset and the risks it is intended to mitigate, including unauthorised access resulting from physical loss or theft of storage media, together with appropriate cryptographic key management measures, including secure storage, access restriction, rotation and revocation of encryption keys.

Preliminary ¶ 46 to Final ¶ 60

Access control and access governance measures: Alphabet shall require the third-party OSE to: (a) restrict access to the Search Dataset to personnel authorised by the third-party OSE, as well as to systems, strictly necessary for the permitted purposepurposes of use (see paragraph (4051)) (b) to assign access rights to such authorised personnel in accordance with the principles of least privilege^{Preliminary measures note 6Final measures note 8} and need-to-know^{Preliminary measures note 7Final measures note 9} and to periodically review and revoke access rights to the Search Dataset where such access is no longer necessary; (c) to subject authorised personnel with access to the Search Dataset to phishing-resistant multi-factor authentication; (d) ensure that authorised personnel with access to the Search Dataset are subject to enforceable confidentiality obligations and receive yearly training regarding access restrictions, secure handling and authorised and prohibited uses of the Search Dataset as well as on applicable governance and traceability documentation obligations.

Preliminary ¶ 47 to Final ¶ 61

Data handling and other protection measures: Alphabet shall require the third-party OSE to prohibit the copying, downloading or local storage of any data from the Search Dataset on any other device, including authorised personnel-managed devices or workstations.

Preliminary ¶ 48 to Final ¶ 62

Physical security measures: Alphabet shall require the third-party OSE to implement appropriate physical security measures to protect systems and storage media used to store or process the Search Dataset against unauthorised physical access, removal, or tampering.

Preliminary ¶ 49 to Final ¶ 63

Logging, monitoring and accountability measures: Alphabet shall require the third-party OSE to: (a) ensure that all access to the Search Dataset is logged, including attribution to individual users or systems, and that such logs are protected against unauthorised access, alteration, or tampering, including through appropriate separation of duties; (b) to retain access logs for a period of one year, in order to align with the audit requirement set out in section 5.4.45.

Preliminary ¶ 50 to Final ¶ 64

Data life cycle management: Alphabet shall require the third-party OSE to ensure that the Search Dataset is securely erased or rendered irrecoverable upon expiry of the 13 months retention period in accordance with recognised industry standards.

Preliminary — to Final ¶ 65

System security maintenance and vulnerability management: Alphabet shall require the third-party OSE to implement and maintain appropriate measures within the segregated processing environment to identify, assess, document, prioritise and timely remediate vulnerabilities and security weaknesses affecting systems, applications, and authorised interfaces used to store, process, or access the Search Dataset, with a view to preventing unauthorised access, disclosure, alteration, or loss of the Search Dataset and maintaining the ongoing confidentiality, integrity, and resilience of the segregated processing environment.

Preliminary ¶ 51 to Final ¶ 66

Data breach reporting: Alphabet shall require the third-party OSE to implement processes to detect, report, and respond to any actual data breach affecting the integrity or confidentiality of the Search Dataset in accordance with Articles 33 and 34 of Regulation (EU) 2016/679.^{Preliminary measures note 8}

Preliminary — to Final ¶ 67

Alphabet may provide recommendations to the third-party OSE on the suitable technical, organisational and human controls to protect the integrity and confidentiality of the Search Dataset in line with the measures set out in this section.

Preliminary ¶ 52 to Final ¶ 68

Alphabet shall require third-party OSE seeking access to the Search Dataset to provide an independent reasonable assurance report based on the audit scope and assurance objectives defined throughout this section.

Preliminary ¶ 53 to Final ¶ 69

Alphabet shall require a third-party OSE seeking access to the Search Dataset, as a condition for obtaining and maintaining such access, to provide Alphabet with an independent assurance report providing reasonable assurance on the suitability and effectiveness of the controls implemented by the third-party OSE (also referred below as “reasonable assurance report”)^{Preliminary measures note 9Final measures note 10} to demonstrate compliance with the assurance objectives defined by the Commission in section 3.2.4.3 below (first, second, third and fourththird assurance objectives).

Preliminary ¶ 54 to Final ¶ 70

The assurance reports shall be prepared in accordance with ISAE 3000 or an equivalent internationally recognised assurance framework, and shall cover the organisational, technical, and governance measures implemented by the third-party OSE in relation to the access, storage, processing, use, and protection of the Search Dataset received pursuant to Article 6(11) of Regulation (EU) 2022/1925, within the scope and in accordance with the fourthree assurance objectives defined by the Commission in this section.

Preliminary ¶ 55 to Final ¶ 71

The assurance reports shall be issued by an independent assurance practitioner and shall include a written signed declaration confirming the practitioner’s independence, qualifications, experience, and compliance with the ethical requirements applicable under ISAE 3000 or, where applicable, under an equivalent assurance framework, including requirements equivalent to those set out in the International Code of Ethics for Professional Accountants (including International Independence Standards) issued by the International Ethics Standards Board for Accountants (IESBA).

Preliminary ¶ 56 to Final ¶ 72

As a condition for being granted initial access to the Search Dataset, Alphabet mustshall require the third-party OSE to submit to Alphabet, in accordance with the conditions set out in section 5.4.1, a Level 1 assurance report prepared in accordance with ISAE 3000 or an equivalent internationally recognised assurance framework, providing reasonable assurance on the first and second Commission-defined assurance objectivesobjective as well as on the design and suitability of the controls put in place to meet the thirdsecond and fourththird Commission-defined assurance objectives.

Preliminary ¶ 57 to Final ¶ 73

As a condition for maintaining access to the Search Dataset, Alphabet mustshall require the third-party OSE to submit to Alphabet, on an annual basis and in accordance with the conditions set out in section 5.4.23, a Level 2 assurance report prepared in accordance with ISAE 3000 or an equivalent internationally recognised assurance framework, providing reasonable assurance on the first and second Commission-defined assurance objectivesobjective as well as on the operating effectiveness of those controls and covering the Commission-defined assurance objectives. For the purposes of the Level 2 assurance report, the independent assurance practitioner shall assess the operating effectiveness of the controls based on audit testing and sampling drawn from a continuous operating period of not less than 12 months within the reporting period, during which the controls were implemented and operational, with the exception of the first Level 2 assurance report which must be submitted on audit testing and sampling drawn from a continuous operating period of 3 months.

Preliminary ¶ 58 to Final ¶ 74

Where the third-party OSE has obtained existing independent assurance reports, certifications, or audit reports (for example, ISAE 3000, ISAE 3402, SOC 2, ISO/IEC 27001, or equivalent), the auditor conducting the Level 1 or Level 2 engagement shall take such reports into account, in whole or in part, when performing the engagement. In doing so, the auditor shall ensure that: (a) The scope, period, and assurance criteria of the existing reports demonstrably cover the Commission-defined assurance objectives; (b) The reports cover the systems, environments, and organisational units within scope pursuant to section 3.2.4.2; and (c) Any material gaps between the existing reports and the applicable assurance objectives are addressed through a targeted supplemental reasonable assurance engagement^{Preliminary measures note 10Final measures note 11}.

Preliminary ¶ 59 to Final ¶ 75

The measures Alphabet shall take regarding the submission of Level 1 and Level 2 assurance reports, the formal evaluation of those reports, and any resulting actions (including suspension of access, restoration of access or termination) in cases where the third-party OSE fails to provide a reasonable assurance report are set out in section 5.

Preliminary ¶ 60 to Final ¶ 76

Data scope: the scope of the assurance engagement shall be limited exclusively to the click, query, ranking and view data made available to the third-party OSE pursuant to Article 6(11) of Regulation (EU) 2022/1925 (the “Search Dataset”), including any datasets, models or outputs directly derived from such the Search Dataset within the segregated processing environment. The assurance engagement shall assess the implementation and effectiveness of measures protecting the Search Dataset, as required under the contractual obligations in sections 3.2.2 and 3.2.3.

Preliminary ¶ 61 to Final ¶ 77

Organisational scope: the assurance engagement shall cover only those parts of the third-party OSE’s organisation that process, access, store, or otherwise handle the Search Dataset, including: (a) the relevant business units, teams, and personnel with authorised access; (b) internal governance, compliance, and oversight functions responsible for ensuring compliance with contractual obligations relating to the use, security, and anonymisation of the Search Dataset; (c) any processors or internal service providers involved in processing the Search Dataset on behalf of the third-party OSE; and (d) where necessary to achieve the assurance objectives organisational units and personnel responsible for planning, budgeting, and allocating resources or financial commitments directly associated with the development, improvement, or optimisation of the search engine using the Search Dataset.

Preliminary ¶ 62 to Final ¶ 78

Organisational units, systems, or personnel that do not have physical, logical, or administrative access to the Search Dataset or whose financial or resource activities are unrelated to the Search Dataset processing shall be excluded, provided that effective segregation is demonstrably implemented and maintained.

Preliminary ¶ 63 to Final ¶ 79

Technical scope: the assurance engagement shall cover all technical systems, environments, and controls used to: (a) access or receive the Search Dataset from Alphabet; (b) store, process, or otherwise handle the Search Dataset, including backup and recovery systems; (c) analyse the Search Dataset or generate outputs, models, or derived datasets based on the Search Dataset; and (d) manage, monitor, and log access to the Search Dataset.

Preliminary ¶ 64 to Final ¶ 80

This includes, where applicable, cloud-based and on-premises environments, development, testing, and production systems in which the Search Dataset is present, as well as identity and access management systems, network security controls, and monitoring and logging systems relevant to the enforcement of contractual obligations for integrity, confidentiality, and continued anonymisation of the Search Dataset.

Preliminary ¶ 65 to Final ¶ 81

Where reliance is placed on existing assurance reports, the assurance engagement may be limited to a mapping and gap assessment demonstrating how the controls and findings in such reports apply to the Search Dataset and any directly derived datasets or models.

Preliminary ¶ 66 to Final ¶ 82

The assurance engagement shall evaluate whether the third-party OSE satisfies the conditions applicable to the provision and use of the Search Dataset. In particular, the auditor shall assess whether: (a) the third-party OSE is not subject to restrictive measures or other relevant regulatory or judicial decisions that would call into question whether the Search Dataset will be used for the genuine development, improvement, or optimisation of its own OSE services and thus prohibit or materially restrict the provision of the Search Dataset (First assurance objective); (b) the third-party OSE has established credible and documented plans demonstrating that the Search Dataset will be used for the genuine development, improvement, or optimisation of its own OSE services (SecondFirst assurance objective); (cb) the third-party OSE has implemented effective technical, organisational, and contractual measures to ensure that the Search Dataset is processed in compliance with the contractual obligations set out in section 3.2.2 (ThirdSecond assurance objective); and (dc) the third-party OSE has implemented effective technical, organisational, and contractual measures to protect the integrity and confidentiality of the Search Dataset in compliance with the contractual obligations set out in 3.2.3 (FourthThird assurance objective).

Preliminary ¶ 67 to Final —

The audit objective is removed; sanctions and security screening is recast in final section 1, paragraphs 3–9.

First, the auditor shall verify whether the third-party OSE is subject to any regulatory or judicial decisions that would prohibit or materially restrict the provision of the Search Dataset. In particular, the auditor shall consider the following: (a) Sanctions and restrictive measures decisions: the auditor shall not provide an assurance report to any third-party OSE which is subject, directly or indirectly, to any restrictive measures or economic sanctions under Union law. This includes: (1) Designation of the third-party OSE or related persons (including any person or entity controlling the third-party OSE) as a sanctioned entity under the restrictive measures and economic sanctions laws of the Union; or (2) The existence of sanctions or restrictive measures which otherwise prohibit the provision of the Search Dataset or related goods and services to the third-party OSE. (b) Other relevant regulatory and judicial decisions: the auditor may also take into account regulatory or judicial decisions of the Union or its Member States which indicate that the third-party OSE constitutes a threat to cybersecurity, public security or public order. Such decisions may include: (1) Acts made under the investment screening laws of the Union or its Member States, including under Regulation (EU) 2019/452; (2) Any act designating the third-party OSE in question a high-risk supplier under Union law; or (3) Acts made under any other relevant laws for the protection of cybersecurity, public security or public order.

Preliminary ¶ 68 to Final ¶ 83

SecondFirst, the auditor shall verify whether the third-party OSE has established and maintains credible and documented plans, governance arrangements, and resource commitments demonstrating that the Search Dataset accessed pursuant to Article 6(11) of Regulation (EU) 2022/1925 will be and/or is used for the genuine development, improvement, or optimisation of its own OSE services, in line with the permitted purposepurposes of use and without undermining anonymisation measures. This objective is assessed by verifying: (a) documented investment planning and financial commitments, including the existence of formal investment plans, budgets, or strategic programmes approved by senior management that allocate dedicated resources to the development or improvement of the third-party OSE’s own search technology, and that clearly identify how, and for which development activities, the Search Dataset accessed pursuant to Article 6(11) of Regulation (EU) 2022/1925 is intended to be used for optimising OSE services. (b) credibility of investment plans, including evidence that planned investments, budgets, or strategic programmes are genuine and realistic in scale, timeframe, and scope relative to the stated development objectives. (c) adequacy of resourcing for implementing or preserving anonymisation-of the Search Dataset. (d) that the third-party OSE only serves search results generated by its own search algorithms and technologies and does not merely copy search results directly from the Search Dataset.

Preliminary ¶ 69 to Final ¶ 84

ThirdSecond, the auditor shall verify that the third-party OSE has implemented effective measures contributing to ensuring anonymisation of the Search Dataset overtimeover time. This objective is assessed by verifying the suitability and effectiveness of technical, organisational, and human controls in the following areas: (a) Ensuring that the Search Dataset is maintained within a processing environment under the effective control of the third-party OSE and that any processing of the Search Dataset by the third-party OSE or its subcontractors take place only within that processing environment. (b) Ensuring that the Search Dataset is maintained exclusively within a logically and technically segregated processing environment and that processing of the Search Dataset by the third-party OSE and its subcontractors is confined to that environment, such that the Search Dataset cannot be linked with any auxiliary dataset accessible to the third-party OSE or its subcontractors. In particular, technical and organisational controls must effectively prevent the Search Dataset from: (1) being queried jointly with auxiliary datasets; (2) being copied, merged, synchronised across the third party OSE’s systems with auxiliary datasets; (c) Ensuring that the Search Dataset is used solely for the permitted purposepurposes of use of optimising or improving OSE services as specified in paragraph (4051) and is not processed for unrelated or secondary purposes. (bd) Preventing, detecting and responding to any attempts, whether intentional or incidental, to: (1) link the Search Dataset with auxiliary datasets at record level; (2) re-identify end users, including by attempting to determine, learn or annotate which records relate to the same end user (i.e. “re-sessionisation”) in any way, such as semantic similarity, behavioural fingerprinting or other techniques beyond any mini-sessionisation provided as part of the Search Dataset; or (3) augment, enhance, or process the Search Dataset in a manner that reverses, weakens, or circumvents applied technical anonymisation measures, including attempts to infer or reconstruct generalised, truncated, or removed attributes.^{Preliminary measures note 11Final measures note 12} (ce) Ensuring that accessthe tothird-party OSE conducts and documents pre-deployment evaluation of the machine learning models, including models supporting ranking, retrieval, or AI chatbot functionalities that were trained with the Search Dataset ismodel to verify that it does not, whereunder applicablereasonably foreseeable inputs, effectivelyreproduce separateddata atfrom the infrastructureSearch levelDataset fromin accessa tomanner auxiliaryexposing advertisingend andusers analyticsto datasetsrisks of re-identification. (df) Preventing, detecting and responding to any unauthorised disclosure, sharing, sublicensing, or other making available of the Search Dataset to third parties. (eg) Identifying,Maintains documenting,accurate and justifyingup-to-date documentation of automated systems and processes, systemsaccessing the Search Dataset, material processing operations involving the Search Dataset and downstreammodels datasetstrained or modelsfine-tuned using the Search Dataset that are materiallysubject derivedto from,the ortesting aresafeguard demonstrablyprovided influencedfor byin theparagraph Search(54) Dataset,and testing results in a manner that enables verification that the processing complies with the contractual prohibitions and remains aligned with the permitted purpose. Processing where the contribution of the Search Dataset is negligible, indirect, or no longer reasonably traceable may be excluded, provided that appropriate safeguards are in placeuses.

Preliminary ¶ 70 to Final ¶ 85

FourthThird, the auditor shall verify that the measures implemented by the third-party OSE are designed to protect the integrity and confidentiality of the Search Dataset against unauthorised access, disclosure, alteration, or loss, including in the event of internal misuse or external compromise. This objective is assessed by verifying the suitability and effectiveness of technical, organisational, and human controls in the following areas: (a) Ensuring that the Search Dataset is encrypted when stored or transmitted between systems or environments under the third-party OSE’s control, using state-of-the-art encryption appropriate to the sensitivity of the data and the risks it is intended to mitigate, including unauthorised access resulting from physical loss or theft of storage media, and that appropriate cryptographic key management measures are implemented, including secure storage, access restriction, rotation and revocation of encryption keys. (b) Restricting access to the Search Dataset to authorised personnel and systems strictly necessary for the permitted purpose and assigning access rights in accordance with the principles of least privilege and need-to-know, with periodic review and revocation of access rights where access is no longer necessary. (c) Requiring authorised personnel with access to use phishing-resistant multi-factor authentication. (d) Ensuring that authorised personnel with access to the Search Dataset are subject to enforceable confidentiality obligations and receive yearly training regarding access restrictions, secure handling requirements, authorised and prohibited uses of the Search Dataset, and applicable governance and traceability obligations. (e) Prohibiting the copying, downloading, or local storage of the Search Dataset on any other device, including personnel-managed devices or workstations. (ef) Implementing appropriate physical security measures to protect systems and storage media used to store or process the Search Dataset against unauthorised physical access, removal, or tampering. (fg) Logging, monitoring, andEnsuring auditingthat all access to the Search Dataset is logged and monitored, including attribution to individual users or systems, and ensuring that such logs are protected against unauthorised access, alteration, or tampering, including through appropriate separation of duties, and retained for a period of one year enabling independent audit. (gh) Ensuring that appropriate measures are implemented and maintained to identify, assess, document, prioritise and timely remediate vulnerabilities and security weaknesses affecting systems, applications and authorised interfaces used to store, process or access the Search Dataset, with a view to preventing unauthorised access, disclosure, alteration or loss of the Search Dataset and maintaining the confidentiality, integrity and resilience of the segregated processing environment. (i) Ensuring that the Search Dataset is securely erased or rendered irrecoverable upon expiry of the 13 months applicable retention period, in accordance with recognised industry standards. (hj) Ensuring that robust, documented and auditable processes are implemented to detect, assess, report, and respond to actual or suspected data breaches affecting the integrity or confidentiality of the Search Dataset in accordance with Articles 33 and 34 of Regulation (EU) 2016/679. The auditor shall verify that: (1) Appropriate policies, procedures, and controls are established and implemented to ensure the timely detection, escalation, assessment, notification and where required, communication of data breaches within the applicable deadlines; (2) All data breaches are systematically recorded in a breach register, including the facts relating to the breach, its effects, and the remedial actions taken; (3) Sufficient and traceable evidence (including logs, incident reports, communications, and post-incident reviews) is retained to allow ex post verification of compliance.

Preliminary — to Final ¶ 86

The auditor can take into account Alphabet’s recommendations regarding the technical, organisational and human controls to protect the integrity and confidentiality of the Search Dataset when assessing the suitability and effectiveness of the third-party OSE’s controls.

Preliminary ¶ 71 to Final ¶ 87

Alphabet shall provide the Search Data to eligible beneficiaries against a fair, reasonable, and non-discriminatory compensation that strictly reflects the incremental costs incurred by Alphabet for the purpose of making such Search Data available plus a reasonable return, corresponding to a return on the capital employed for that purpose, that shall not exceed Alphabet’s weighted average cost of capital (“WACC”).

Preliminary ¶ 72 to Final ¶ 88

By way of exception to paragraph (87), Alphabet shall not be constrained to a compensation reflectingstrictly onlyreflecting incremental costcosts incurred for the purpose of making such Search Data available and a reasonable return (which correspondscorresponding to a return on the capital employed for the purpose of the provision of access to Search Data that shall not exceed Alphabet’s weighted average cost of capital)WACC in the event that, (i) Alphabet could demonstratedemonstrates that it would not be able to cover the costs efficiently incurred for collecting the relevant data, including a reasonable return, from its own commercial use of that data,^{Preliminary measures note 12Final measures note 13} or (ii) when an eligible beneficiary operates at a very large scale.^{Preliminary measures note 13Final measures note 14} In these circumstances, Alphabet shall also be entitled also to a margin, which however cannot exceed Alphabet’sthe operating margin, in percentage terms, of itsAlphabet’s Google Search business, and provided that any resulting terms, taking into account the relevant circumstances, remain FRAND within the meaning of Article 6(11) of Regulation (EU) 2022/1925.

Preliminary ¶ 74 to Final ¶ 89

The SME rule is retained here; the cost-allocation protection in the remainder of preliminary paragraph 74 appears in final paragraph 90.

MicroNotwithstanding paragraph (88), andmicro, small and medium-sized enterprises (SMEs), as defined by Article 2 of the Annex to Commission Recommendation 2003/361/EC,^{Preliminary measures note 14Final measures note 15} mustshall be exempted from paying more than the incremental costs incurred by Alphabet for the purpose of making Search Data available and a reasonable return on the capital employed for that purpose that shall not exceed Alphabet’s weighted average cost of capitalWACC, irrespective of whether Alphabet demonstrates its inability to cover the efficiently incurred costs as set out under paragraph (71), above. Whether Alphabet negotiates the compensation with certain eligible beneficiaries in line with paragraphs (72) and (73) above shall be without prejudice to the application of the cost-based calculation methodology in line with paragraph (71), and cost-allocation principles for all other eligible beneficiaries. In particular, the fact that Alphabet negotiates the compensation with certain eligible beneficiaries in line with paragraphs (72) and (7388) above shall not affect the cost base or the pro rata allocation parameters applicable to other eligible beneficiaries, which shall be calculated as if all eligible beneficiaries were subject to the incremental cost-based methodology specifying a compensation, which shall reflect the incremental cost incurred for the provision of access to Search Data and a reasonable return on the capital employed for that purpose.

Preliminary — to Final ¶ 90

Separated from preliminary paragraph 74; the general protection for other beneficiaries is not wholly new.

Whether Alphabet negotiates the compensation with certain eligible beneficiaries in line with paragraph (100) shall be without prejudice to the application of the cost-based calculation methodology in line with paragraph (87), and cost-allocation principles, for all other eligible beneficiaries. In particular, the fact that Alphabet negotiates the compensation with certain eligible beneficiaries in line with paragraph (100) shall not affect the cost base or the pro rata allocation parameters applicable to other eligible beneficiaries, which shall be calculated as if all eligible beneficiaries were subject to the incremental cost-based methodology specifying a compensation as laid out in paragraph (87).

Preliminary ¶ 75 to Final —

The measures specifying FRAND pricing under these proceedings shall apply for a period of five years from the date on which the sharing was initiated, for each distinct beneficiary. After this period, Alphabet may deviate from the FRAND pricing specified in relation to each beneficiary. In that case, Alphabet shall be entitled to negotiate, in good faith, and within the limits set out in Article 6(11) of Regulation (EU) 2022/1925, the applicable compensation with the relevant eligible beneficiary, provided that any resulting terms, taking into account the relevant circumstances, remain FRAND within the meaning of Article 6(11) of Regulation (EU) 2022/1925.^{Preliminary measures note 15}

Preliminary ¶ 76 to Final ¶ 91

Cost items that qualify as beingstrictly incremental toand incurred by Alphabet for the purpose of making the dataSearch Data available to eligible beneficiaries shall include all costs (irrespective of whether they could be otherwise categorised as fixed andor variable costs) pertaining to the following activities^{Preliminary measures note 16Final measures note 16}: (a) Preparing and formatting the dataset with a view to makemaking the datasetSearch Data available, that is, all costs directly attributable to the data-sharing-specific further processing of data already stored in Alphabet’s databases, in the absence of the data-sharing provision, including any data-format adaptations, sub-setting or transformations performed with the objective of protecting data subjects, such as anonymisation. (b) Storage, that is, storage costs linked to making the dataSearch Data available to dataeligible recipientsbeneficiaries. Storage costs should only be part of the cost calculation to the extent that the storage environment is used for storing data with a view to making it available to dataeligible recipientsbeneficiaries. (c) Dissemination, that is, costs incurred in the process of electronically transmitting data to eligible beneficiaries, as wellincluding astechnical theonboarding costs pertaining toand the verification and identificationcosts of beneficiariesoperating eligiblethe toSearch accessData theaccess datatools.

Preliminary — to Final ¶ 92

The above incremental costs can be classified along two dimensions depending on (i) whether they are recurrent or one-off and (ii) whether they are beneficiary-specific or common across beneficiaries. This results in four categories of incremental costs: one-off beneficiary-specific costs, such as beneficiary-specific technical onboarding costs; one-off common costs, such as the development and set-up of the data sharing service; recurrent beneficiary-specific costs, such as transmission costs attributable to a specific beneficiary; and recurrent common costs, such as overhead costs common across beneficiaries.

Preliminary ¶ 77 to Final ¶ 93

ForThe reasonable return on the capital employed for the purpose of determiningmaking the compensationSearch Data available, that Alphabet may also include a reasonableas returnpart onof the capitalcompensation, may not exceed Alphabet’s WACC. Capital employed for the purpose of making the dataSearch availableData thatavailable shall notbe exceedunderstood Alphabet’sas weightedthe averageincremental costcapital ofstrictly capitalnecessary for making the Search Data available.

Preliminary ¶ 82 to Final ¶ 94

The general payment-arrangements duty is replaced by a specified two-part tariff.

Alphabet shall setimplement upa per-beneficiary payment arrangementsscheme inwhich contains a mannerfixed thatand allowsvariable forcomponent effective(two-part recoverytariff). The fixed component (“fixed fee”) shall be determined independently of allthe duration of access, the volume of data consumed and the timing at which the beneficiary obtains access. The fixed fee covers, in addition to one-off beneficiary-specific costs, incurreda byshare Alphabetof the one-off common costs, which shall be allocated on the basis of the allocation key referred to in paragraph (97)(a). Alphabet shall offer beneficiaries the possibility to pay their fixed fee over the duration of the contract, without prejudice to Alphabet's right to obtain full payment of the fixed fee should a beneficiary decide to discontinue its access to the Search Data before the last invoicing period.^{Final measures note 17} The variable component covers the beneficiary-specific recurrent costs of making the data available in a given year, whileas ensuringwell predictabilityas forthe beneficiariesrecurring common costs during that year, which shall be allocated on the basis of the allocation key referred to in paragraph (97)(c).^{Final measures note 18}

Preliminary ¶ 78 to Final ¶ 95

Only incremental costs that are clearly attributable to making the dataSearch Data available shall qualify for the purpose of determining the compensation. Costs shall not qualify merely because they arise in connection with the obligation. Alphabet shall be able to demonstrate that all incremental cost items are objective, measurable, verifiable and proportionate to the purpose of making the data available. Overhead, sunk costs, or investments in data collection, processing and storage not attributable to making the dataSearch Data available, speculative risks or, ordinary business and general compliance expenses, or dispute-related legal costs do not qualify for inclusion in the cost base to identify the incremental fixed and variable cost incurred by Alphabet in the process of making the dataSearch Data available to eligible beneficiaries.

Preliminary — to Final ¶ 96

Incremental costs related to the development, set-up and scaling of the data sharing mechanism, shall be considered as capital employed for the purpose of making the Search Data available to the extent that they reflect expenditures for the development of assets, systems or capabilities that are expected to be used over multiple years.

Preliminary ¶ 79 to Final ¶ 97

IncrementalOne-off and recurrent incremental cost items that are common to different recipientsbeneficiaries (suchshall asbe upfrontallocated in a reasonable, transparent and overheadpredictable costs)manner, shallhaving beregard appropriatelyto allocatedthe innature aof reasonablethe relevant cost item and transparentthe mannerpoint acrossin recipientstime at which it is incurred. The volume of access requests cannot be known in advance and may vary over time. The allocation methodology shall not result in unjustified differences in treatment between beneficiaries obtaining access at different points in time. To this effect, Alphabet shall: (a) definedetermine reasonablethe amortisationinitial cyclesper-beneficiary thatshare spreadof the one-off access-mechanism costs overbased on a reasonable number ofand years,justified correspondingestimate toof the expected periodnumber beforeof beneficiaries at the time the access systemmechanism wouldis normallyfirst requiremade majoravailable, technicalas ordetermined compliancefollowing updatesthe (iprocess described in section 5.e4.2, usefulwith life)those costs to be shared equally among all such expected beneficiaries; (b) determineapply the per-recipientsame sharefixed basedcomponent, onas adescribed conservativeunder andparagraph justified(94) estimateand ofestablished thefollowing expectedthe numbermethodology oflaid eligibleout accessin recipients;point (ca), periodicallyto reviewall andactual adjustbeneficiaries theirrespective allocationof parametersthe totime reflectthey actualstart uptakehaving access, sosubject asonly to ensuredifferences proportionateobjectively costjustified sharingby andbeneficiary-specific avoidone-off systematiccosts;^{Final measures note 19} over-(c) orrecurrent under-recoverycommon costs shall be shared equally among the beneficiaries receiving access during a given year.

Preliminary ¶ 80 to Final —

The allocation rules are rebuilt in final paragraphs 92, 94 and 97, including the prohibition of unjustified differences between early and later beneficiaries.

Any such adjustments shall be implemented in a consistent, verifiable and transparent manner. The allocation method shall avoid placing a disproportionate burden on early recipients compared to later recipients and should not result in discriminatory pricing over time.

Preliminary ¶ 81 to Final —

WACC methodology is now expressly required in final paragraph 133(b)(1); the reasonable-return ceiling also survives in final paragraphs 87 and 93.

Alphabet shall also calculate its weighted average cost of capital for the concerned period that will serve for the computation of the reasonable return on the capital employed for the purpose of making the data available.

Preliminary ¶ 83 to Final ¶ 98

UponIn line with section 5.4.2, upon request, Alphabet shall provide information to eligible beneficiaries setting out the basis for the calculation of the compensation in sufficient detail so that eligible beneficiaries are able tocan assess whether the above-stated requirements are met. Alphabet shall regularlymaintain, producefor each year, storeinformation supporting the calculation of the compensation and, upon request of eligiblethe beneficiaries, provide thisthem informationwith a non-confidential version thereof, at the appropriate level of granularity, to ensure both a sufficient degree of transparency as well as the protection of confidential information. AConfidential and non-confidential versionversions of thisthe information shallsetting beout storedthe andbasis for the calculation of the compensation shall also be provided to the Commission upon request.

Preliminary ¶ 84 to Final ¶ 99

Alphabet shall attempt to resolve any disagreement on the application of the above-specified calculation methodology directly with beneficiaries in good faith. Should a disagreement on any elements of the compensation persist, Alphabet shall not prevent beneficiaries tofrom raiseraising such disagreement with the Commission. The Commission, wherereserves appropriate,the willright thento take anyaction appropriatein measureaccordance with its powers under Regulation (EU) 2022/1925 to verify Alphabet’s compliance with the above terms, including auditing Alphabet’s costs to ensure that they are reasonable and proportionate to the claimed expenses. This provision is without prejudice to the partiesbeneficiaries'’ right to seekinitiate judiciallegal recourseproceedings before the competent courts.

Preliminary ¶ 73 to Final ¶ 100

Reordered within the pricing section.

With regard toRegarding eligible beneficiaries that are also designated gatekeepers under Article 3(4) Regulation (EU) 2022/1925 in relation to an online search engine core platform service, Alphabet may deviate from the FRAND compensation specified in this Decision. In that case, Alphabet shall still negotiate, in good faith, and within the limits set out in Article 6(11) of Regulation (EU) 2022/1925, the applicable compensation provided that any resulting terms, taking into accountconsidering the relevant circumstances and position of the two parties, remain FRAND within the meaning of Article 6(11) of Regulation (EU) 2022/1925 and otherwise comply with that provision.

Preliminary ¶ 85 to Final ¶ 101

Alphabet shall give third-party OSEs the opportunity to conduct technical testing on test data samples before they agree to acquire the Search Dataset.

Preliminary ¶ 86 to Final ¶ 102

Alphabet shall provide three different test data samples to any eligible third-party OSE requestingapplying accessfor eligibility to test data samples or the Search Dataset (“requesting third parties”). Each test data sample shall have a different scope in terms of content as well as means and conditions of access. These are: (a) Sample A: Alphabet shall continue to provide a small sample of 1 000 rows (i.e., 58 unique queries) from the Search Dataset; (b) Sample B: Alphabet shall provide a synthetic dataset that requestingeligible third-party partiesOSEs may download onto their own servers to conduct technical testing; and (c) Sample C: Alphabet shall provide a large representative sample dataset that requestingeligible third-party partiesOSEs may download onto their own servers to conduct technical testing.

Preliminary ¶ 87 to Final ¶ 103

Alphabet shall continue to provide a 1 000-row sample (i.e., 58 unique queries) of the Search Dataset free of charge (“Sample A”). Alphabet mustshall continue to allow third-party OSEs to download Sample A onto their own servers free of charge.

Preliminary ¶ 88 to Final ¶ 104

Alphabet may impose a contractual restriction preventing the third-party OSE from sharing Sample A with any other person or undertaking. Alphabet mustshall otherwise make Sample A available under the same conditions it makes the small Alphabet sample available.

Preliminary ¶ 89 to Final ¶ 105

Alphabet shall prepare a synthetic dataset of 10 million individual representative artificially generated unique queries (also often called “synthetic” queries) and metadata (“Sample B”) and provide this to any third-party OSE that requests it. Alphabet shall comply with any request from a third-party OSE that the copy of Sample B it receives contain a particular number of queries and associated metadata, up to a maximum of 10 million individual queries.

Preliminary ¶ 90 to Final ¶ 106

Alphabet shall allow third-party OSEs to download Sample B onto their own servers. Alphabet may impose a contractual restriction preventing the third-party OSE from sharing Sample B with any other person or undertaking. Alphabet shall only provide Sample B to third-party OSEs that are eligible to receive the Search Dataset.

Preliminary ¶ 91 to Final ¶ 107

Alphabet shall not make access to Sample B conditional on the third-party OSE in question providing any assurance report specified in section 3.2.4 or undergoing an audit associated with this assurance report. Alphabet may only grant Sample B to a third-party OSE that it has deemed a third-party OSE eligible to receive the Search Dataset in accordance with section 01.

Preliminary ¶ 92 to Final ¶ 108

Alphabet shall explain, in a clear and transparent manner, the method by which it produced Sample B. Alphabet shall ensure that Sample B is a faithful representation of the real Search Dataset to which technical measures specified in section 3.1(26) have been applied. This means, among other things, that Sample B shall: (a) Accurately resemble the real Search Dataset in content and form; (b) Faithfully reflect the relationship between queries and metadata; (c) Include all the data fields specified in section 2; and (d) Have the technical measures specified in section 3.1 applied in the same way they would be applied to the real Search Dataset.

Preliminary ¶ 93 to Final ¶ 109

Alphabet may limit the time during which requesting third -party OSEs may retain Sample B. This retention period mustshall be a period of at least three months from the date on which Sample B was first made available to that requesting third -party OSE.

Preliminary ¶ 94 to Final ¶ 110

Alphabet may charge requesting third-party partiesOSEs a fee for accessing Sample B. This fee shall be calculated using the method specified in section 4.

Preliminary ¶ 95 to Final ¶ 111

Alphabet shall provide a sample of 5% of the final Search Dataset selected from queries occurring in no less than one month and no more than one year (“Sample C”) (with the exact period to be specified by the third-party OSE requesting Sample C).

Preliminary ¶ 96 to Final ¶ 112

Alphabet shall provide Sample C once the Search Dataset is finalised in accordance with section 5.2 and all applicable conditions for the sharing of the Search Dataset set out in sections 0, 3.2have andbeen 5.4.1met andby havethe beenthird-party metOSE. Alphabet shall require third-party OSEs to apply the retention period specified in section 3.2.2 to Sample C.

Preliminary ¶ 97 to Final ¶ 113

Alphabet may charge third-party OSEs a fee for accessing Sample C. This fee shall be calculated using the method specified in section 4.

Preliminary ¶ 98 to Final ¶ 114

Alphabet shall comply with any requests from any third-party OSE that all queries in the Sample C dataset it accesses: (a) Come from a particular Member State or Member States of the UnionEU; (b) Be in a particular language or languages; or (c) Take place within a particular period of no less than one month.

Preliminary ¶ 99 to Final ¶ 115

Alphabet shall finalise the Search Dataset as soon as possible and no later than threefour months after the Commission’s adoption of an implementing act under Article 8(2) of Regulation (EU) 2022/1925 in these specification proceedingsmeasures. Alphabet shall notify the Commission as soon as it has finalised the Search Dataset. This notification shall describe the actions Alphabet has taken to implement the measures specified in sections 2.1, 2.2 and 3.1.

Preliminary — to Final ¶ 116

Within four months of the adoption of these measures, Alphabet shall share a document with the Commission setting out: (a) The final latency of Search Data sharing along with the technical description and justification, as specified in section 2.2.2; and (b) The information on personal data detectors and list of result types specified at section 3.1, paragraph (41).

Preliminary ¶ 100 to Final ¶ 117

Alphabet shall prepare a template licence agreement for the sharing of the Search Dataset with third-party OSEs, implementing all applicable provisions of the measures specified, within two months of the Commission’s adoption of an implementing act under Article 8(2) of Regulation (EU) 2022/1925 in these specification proceedingsmeasures.

Preliminary ¶ 101 to Final ¶ 118

Alphabet shall also prepare template licence agreements for sharing Sample A, Sample B and Sample C within two months of the Commission’s adoption of an implementing act under Article 8(2) of Regulation (EU) 2022/1925 in these specification proceedingsmeasures.

Preliminary ¶ 102 to Final ¶ 119

Within one working day of finalising the template licence agreements, Alphabet shall also share a copy of each template licence agreement with any requestingundertaking thirdapplying for eligibility, eligible third-party OSE and the Commission.

Preliminary ¶ 103 to Final ¶ 120

The Search Dataset and Sample C template licence agreements shall allow a third-party OSE to specify that all queries forming part of the Search Dataset or Sample C dataset it receives come from a particular Union Member State or Member States, be in a particular language or take place within a period of no less than one month.

Preliminary ¶ 104 to Final ¶ 121

Alphabet may only impose conditions for sharing the Search Dataset or test data samples that are FRAND and strictly proportionate. These conditions shall not impede in any way the effectiveness of the measures specified in an implementing act adopted under Articlethese 8(2)Measures ofor Regulationthe (EU)Commission’s 2022/1925Decision in these specificationthis proceedingscase.

Preliminary ¶ 105 to Final ¶ 122

Alphabet shall engage with any requestingundertaking thirdapplying partyfor eligibility to determine whether it is eligible to receive the Search Dataset.

Preliminary ¶ 106 to Final ¶ 123

Alphabet shall put in place a structured, adequately documented process setting out how it will receive, acknowledge, assess and respond to applications for eligibility and requests for the Search Dataset and test data samples.

Preliminary ¶ 107 to Final ¶ 124

To this end, within 45 days of the adoption of these measures, Alphabet shall provide a publicly accessible webpage containing up-to-date information including: (a) A clear explanation of Alphabet’s obligations under Article 6(11) of Regulation (EU) 2022/1925 specified in an implementing act adopted under Article 8(2) of that Regulation in these specification proceedingsMeasures; and (b) Clear and detailed information on how to contact Alphabet with a view to submitting a request for the Search Dataset.

Preliminary ¶ 108 to Final ¶ 125

Alphabet shall reply to any expressions of interest in acquiring the Search Dataset within one week. This reply shall contain at least the following information: (a) AAn requestapplication form with clear and detailed information the requestingundertaking thirdapplying partyfor eligibility is to provide in order to enable Alphabet to assess whethermake the requestingeligibility thirdassessment partyunder qualifiessection as1, aparagraphs third(3) -party OSE(7); eligible(b) toA receivedescription of the Search Dataset, test data samples and the process and basis under sectionwhich 0;FRAND (b)prices Awill descriptionbe ofcalculated thein Searchaccordance Datasetwith andsections test4 dataand samples5.4.2; (c) Clear and detailed information regarding: (1) Process for assessing eligibility; (2) The requirement to submit the Level 1 reasonable assurance report as a condition for being granted initial access to the Search Dataset, and the requirement to submit the Level 2 reasonable assurance report as a condition for maintaining access to the Search Dataset in accordance with the conditions specified in section 5.4.23; and (3) Processes for granting access to, ensuring continuity of access to, refusing access to, suspending access to and terminating access to the Search Dataset; and (d) Copies of the template licence agreements in respect of the Search Dataset, Sample A, Sample B and Sample C; and (e) An e-mail address (to be communicated by the Commission to Alphabet) at which the undertaking applying for eligibility may contact the Commission to provide information or submit questions regarding Alphabet’s sharing of the Search Dataset.

Preliminary — to Final ¶ 126

Alphabet shall present a draft of this application form (including eligibility questionnaire) to the Commission within 45 days of the Commission’s adoption of these measures.

Preliminary ¶ 109 to Final —

Information-request protections are relocated and revised in final paragraph 4; the analysis explains the changed confidentiality wording.

Information Alphabet requests under point (a) shall be strictly necessary to assess whether the requesting third party qualifies as a third-party OSE eligible to receive the Search Dataset under section 0. Alphabet’s requests for information shall be reasonable and not unduly onerous. Alphabet shall not request any information that could qualify as business secrets or be competitively sensitive information.

Preliminary ¶ 110 to Final ¶ 127

Alphabet shall require the submission of a Level 1 assurance report consisting solely of a non-confidential version containing the assurance conclusions of the qualified independent assurance practitioner and confirming that reasonable assurance has been obtained for each of the fourthree assurance objectives defined in section 3.2.4.3.

Preliminary — to Final ¶ 128

Alphabet shall require all eligible third-party OSEs to notify Alphabet as soon as they have entered into a contract with an auditor for the purposes of preparing a Level 1 assurance report.

Preliminary ¶ 111 to Final ¶ 129

Alphabet shall limit its verification of the Level 1 assurance report to confirming the submission of the report and its formal completeness, meaning that the report is issued by a qualified independent assurance practitioner and contains the assurance conclusions for each of the fourthree assurance objectives defined in section 3.2.4.3 in the prescribed non-confidential format. Alphabet shall not reassess the substance or scope of the assurance conclusions expressed by the qualified independent assurance practitioner. Within two weeks of receiving the Level 1 reasonable assurance report (in the case of the Search Dataset and Sample C) and signed licence agreement (in respect of the Search Dataset and all test data samples), Alphabet shall either: (a) Provide the Search Dataset or test data sample in question to the requestingundertaking thirdapplying partyfor eligibility; or (b) Send the requestingundertaking thirdapplying partyfor eligibility a decision rejecting the report in accordance with section 5.5.1.

Preliminary ¶ 112 to Final ¶ 130

Alphabet shall inform the Commission of any request it receives without delay. Alphabet shall conclude its eligibility assessment within one week fromof receipt of a completed application form (including eligibility questionnaire) and transfer impact assessment, if applicable).

Preliminary — to Final ¶ 131

Alphabet shall grant access to the Search Dataset to each eligible third-party OSE within 10 days after it has entered into a licence agreement and accepted the price offer, which is to be finalised within six months of the adoption of these measures in accordance with section 5.4.2.

Preliminary — to Final ¶ 132

The Commission specifies the following process for finalising Alphabet’s pricing terms and communicating them to third-party OSEs applying for eligibility and, ultimately, to eligible beneficiaries.

Preliminary — to Final ¶ 133

Without prejudice to the obligation outlined in paragraph (98), within two months of the adoption of these measures, Alphabet shall submit the following elements: (a) An exhaustive list of cost items and estimates, as well as a description of the nature of the respective items (e.g., WACC , one-off or recurring cost, fixed or variable cost, beneficiary-specific or common, whether the cost items scale with the volume or frequency of data to be shared and to what cost category among the ones listed in (91) it relates to). (b) A detailed description of the methodology underlying the pricing calculations it has prepared in accordance with section 4, including, but not restricted to: (1) A description of the methodology used to calculate the WACC, which the reasonable return on the capital employed for the purpose of making the Search Data available cannot exceed. (2) A description of the methodology used to calculate the margin as used in the pricing scenario laid out in paragraph (88). (3) Any element that remains contingent on the number of eligible beneficiaries, including the allocation of one-off common costs, the applicable formulas, calculation steps and assumptions.^{Final measures note 20}

Preliminary — to Final ¶ 134

In line with paragraph (98), Alphabet shall provide confidential and non-confidential versions of the information outlined in paragraph (133) to the Commission. Alphabet shall share non-confidential versions of such information, at the appropriate level of granularity to ensure both a sufficient degree of transparency as well as the protection of confidential information, with third-party OSEs applying for eligibility.^{Final measures note 21}

Preliminary — to Final ¶ 135

Within six months of the adoption of these measures, Alphabet shall provide the Commission with, and communicate to all third-party OSEs that have either (i) applied for eligibility and entered into a contract with an auditor for the purposes of preparing a Level 1 assurance report, or (ii) have been assessed as eligible to receive the Search Data following the criteria laid out in section 1: (a) The number of third-party OSEs that have either applied for eligibility and informed Alphabet that they have entered into a contract with an auditor for the purposes of preparing a Level 1 assurance report, or have been assessed as eligible to receive the Search Data; and (b) The resulting pricing offers, including an allocation of one-off common costs divided equally among third-party OSEs applying for eligibility that have entered into such a contract with an auditor or that have been assessed as eligible to receive the Search Data, following the allocation key laid out in paragraph (133)(b)(3).

Preliminary — to Final ¶ 136

The Commission may prolong the six-month period where the proposed methodology in paragraph (87) is not deemed appropriate, or where technical or procedural issues have delayed the effective preparation, assessment or implementation of the pricing offer.

Preliminary — to Final ¶ 137

The communication of the pricing offers pursuant to paragraph (135) shall be without prejudice to the Commission’s assessment of whether Alphabet’s methodology complies with these measures and with Article 6(11) of Regulation (EU) 2022/1925.

Preliminary — to Final ¶ 138

If the Commission is of the opinion that Alphabet’s calculations are not compliant with these measures or with Article 6(11) of Regulation (EU) 2022/1925, Alphabet shall comply with any directions from the Commission to submit new calculations or other information necessary to calculate FRAND pricing offers within any time limit stipulated by the Commission.

Preliminary ¶ 113 to Final ¶ 139

As a condition for maintaining access to the Search Dataset, Alphabet shall require the third-party OSE to submit to Alphabet, on an annual basis, the Level 2 assurance report in accordance with the conditions specified in section 3.2.4: (a) For the first Level 2 assurance report, within 15six months of the date the third-party OSE first received access to the Search Dataset; (b) For all subsequent Level 2 assurance reports, within 12 months of the date on which the previous Level 2 assurance report was submitted.

Preliminary — to Final ¶ 140

In addition, Alphabet shall require the third-party OSE to submit to Alphabet, on an ad hoc basis, a Level 2 report where it receives a written notification from the Commission confirming that the Commission is of the opinion that such a report is required in the circumstances. Alphabet shall not require any third-party OSE to submit an ad hoc Level 2 report unless it has received such written notification from the Commission. Alphabet shall also require the third-party OSE to submit this ad hoc Level 2 report by a time limit stipulated by the Commission in the Commission’s written notification to Alphabet. The decision on whether an ad hoc Level 2 report is required, and the time limit for submitting this report, shall be solely for the Commission in each instance. If a third-party OSE submits an ad hoc Level 2 report concluding reasonable assurance, Alphabet shall not require the third-party OSE to submit any further Level 2 report in the period of less than 12 months from the date of submission of the ad hoc Level 2 report.

Preliminary ¶ 114 to Final ¶ 141

The Level 2 assurance report shall consist solely of a non-confidential version containing the assurance conclusions of the qualified independent assurance practitioner confirming that reasonable assurance has been obtained in relation to each of the fourthree assurance objectives defined in section 3.2.4.3.

Preliminary ¶ 115 to Final ¶ 142

Alphabet shall limit its verification to confirming the submission of the report and its formal completeness, meaning that the report is issued by a qualified independent assurance practitioner and contains the assurance conclusions for each of the fourthree assurance objectives defined in section 3.2.4.3 in the prescribed non-confidential format. Alphabet shall not reassess the substance or scope of the assurance conclusions expressed by the qualified independent assurance practitioner.

Preliminary ¶ 116 to Final ¶ 143

Failure to submit a Level 2 assurance report within the applicable time limits, or failure of the submitted report to confirm that reasonable assurance has been obtained (where the independent assurance practitioner issues a “limited assurance” conclusion), shall lead to a suspension decision and/or a termination or expedited decision in accordance with sections 5.5.2.1 and 5.5.3. For the avoidance of doubt, this provision shall also extend to the submission of ad hoc Level 2 reports.

Preliminary ¶ 117 to Final ¶ 144

Alphabet shall require written notification from the third-party OSE of any intended change of control over the third-party OSE (including acquisitions of joint control or sole control or changes in the quality of control) within 10 days after it becomes public or at least 30 days prior to the change taking effect, whichever is earlier. Alphabet shall transmit the notification to the Commission upon receipt.

Preliminary ¶ 118 to Final ¶ 145

Alphabet shall require the notification to identify the natural or legal person(s) acquiring control of the third-party OSE. If this information is not publicly available and is commercially sensitive, Alphabet shall require the third-party OSE to notify the Commission directly and share a non-confidential version of the notification with Alphabet.

Preliminary — to Final ¶ 146

Alphabet may conduct a new eligibility assessment in accordance with sections 1 and 5.4.1 if it believes based on credible, objective evidence that the change in control could impact on the third-party OSE’s eligibility to receive the Search Dataset. Alphabet shall conclude this eligibility assessment within one week of receipt of a completed due diligence questionnaire and transfer impact assessment, if applicable.

Preliminary ¶ 119 to Final ¶ 147

Final paragraph 147 combines and revises preliminary paragraphs 119 and 120.

FollowingSubject to this eligibility assessment, following a change of control of the third-party OSE, Alphabet shall ensure that the third-party OSE continues to receive access to the Search Dataset immediately after the third-party OSE and the person or persons acquiring control (together the “merging parties”) submit a new Level 1 reasonable assurance report that takes the change of control into account. Alphabet may only terminate access to the Search Dataset following a change of control of a third-party OSE in accordance with the conditions set out in sections 5.5.2, 5.5.3 and 5.5.4.

Preliminary ¶ 120 to Final —

The restriction on action following a change of control is revised and consolidated into final paragraph 147.

Alphabet may only suspend access to the Search Dataset following a change of control of a third-party OSE in accordance with the conditions set out in section 5.5.2.1.

Preliminary ¶ 121 to Final ¶ 148

Alphabet shall require written notification from the third-party OSE of any insolvency proceedings initiated against it within one week of the initiation of those proceedings. Alphabet shall transmit the notification to the Commission upon receipt.

Preliminary ¶ 122 to Final ¶ 149

Alphabet shall require theThe notification toshall identify the jurisdiction and court in which proceedings were brought and briefly describe the circumstances precipitating the proceedings. If this information is not publicly available and is commercially sensitive, Alphabet shall require the third-party OSE to notify the Commission directly and share a non-confidential version of the notification with Alphabet.

Preliminary ¶ 123 to Final ¶ 150

Following the initiation of insolvency proceedings, Alphabet shall ensure that the third-party OSE continues to receive access to the Search Dataset immediately after the third-party OSE submits a Level 2 reasonable assurance report that takes the insolvency proceedings into account.

Preliminary ¶ 124 to Final ¶ 151

Alphabet may only suspend access to the Search Dataset following initiation of insolvency proceedings in accordance with the conditions set out in section 5.5.2.1.

Preliminary ¶ 125 to Final ¶ 152

If Alphabet decides either: (a) To deny aan requestingundertaking thirdapplying partyfor accesseligibility tofrom accessing the Search Dataset; or (b) To deny aan requestingundertaking thirdapplying partyfor accesseligibility tofrom accessing a test data sample, it shall send the requestingundertaking thirdapplying partyfor eligibility a written notification refusing access to the Search Dataset (the “refusal decision”) by the applicable deadline set out in section 5.4.1.

Preliminary ¶ 126 to Final ¶ 153

The refusal decision shall include at least the following: (a) Reasoning: an explanation of the grounds for the refusal decision; (b) Rebutting evidence: an explanation of the evidence the requestingundertaking thirdapplying partyfor eligibility shall provide to rebut the refusal decision; and (c) Contact: who the requestingundertaking thirdapplying partyfor eligibility can contact and how if it has any questions on the refusal decision.

Preliminary ¶ 127 to Final ¶ 154

Alphabet shall suspend an individual third-party OSE’s access to the Search Dataset in the following circumstances: (a) Failure to submit a Level 12 reasonable assurance report in the case of a change ofon controltime: the mergingthird-party partiesOSE faildoes tonot submit a Level 12 reasonable assurance report before the change of control takes effect; (b) Failure to notify a change of control: the merging parties fail to notify a change of control within 10 days after it becomes public or at least 30 days prior to the change taking effect (whichevertime islimit earlier)specified in accordance with section 5.4.3. (c) Failure to submit a Level 2 reasonable assuranceor reportas onspecified time:by the third-party OSE does not submit a Level 2 reasonable assurance reportCommission withinin the time limitcase specifiedof inad sectionhoc 5.4.2audits), (or submits a Level 2 report concluding limited assurance); or (db) Insolvency: insolvency proceedings in respect of the third-party OSE are opened.

Preliminary ¶ 128 to Final ¶ 155

Alphabet shall notify the third-party OSE in writing no more than three days after the suspension (“suspension decision”). The suspension decision shall contain at least the following: (a) Reasoning: a clear and detailed explanation of the grounds for the suspension; (b) Effects: a description of the legal and operational consequences of the suspension; (c) Remediation: a clear and detailed explanation of the evidence the third-party OSE shall provide to restore its access to the Search Dataset; and (d) Alphabet’s obligation to terminate: the conditions under which Alphabet shall terminate access to the Search Dataset specified in section 5.5.3.

Preliminary ¶ 129 to Final ¶ 156

Alphabet shall reverse a suspension and restore the third-party OSE’s access to the Search Dataset as soon as technically possible once the third-party OSE has remedied the circumstances that triggered the suspension or has otherwise demonstrated that those circumstances no longer apply, in accordance with the conditions set out below.

Preliminary ¶ 130 to Final ¶ 157

In particular, Alphabet shall restore access to the Search Dataset in the following circumstances: (a) Failure to submit a Level 1 reasonable assurance report in the case of a change of control: where the merging parties submit a Level 1 assurance report concluding reasonable assurance; (b) Failure to notify a change of control: where the merging parties notify the change of control to Alphabet; (c) Failure to submit a Level 2 reasonable assurance report on time: where the third-party OSE submits to Alphabet a Level 2 reasonable assurance report in accordance with section 5.4.1; (db) Submission of a Level 2 assurance report concluding limited assurance: where the third-party OSE submits to Alphabet a supplemental reasonable assurance report confirming that reasonable assurance has now been obtained for the assurance objectives previously assessed as limited; and (ec) Insolvency: where the third-party OSE provides an updated Level 2 reasonable assurance report which takes any relevant changes to the third-party OSE’s business that relate to the insolvency proceedings into account.

Preliminary ¶ 131 to Final —

The introductory termination rule is consolidated into final paragraph 158.

Alphabet shall decide to permanently terminate an individual third-party OSE’s access to the Search Dataset (“termination measure”) in the below specified circumstances.

Preliminary ¶ 132 to Final ¶ 158

Alphabet shall issuedecide ato terminationpermanently measureterminate ifan aindividual third-party OSEOSE’s (oraccess to the mergingSearch parties,Dataset if(“termination applicablemeasure”) in the below specified circumstances where a third-party OSE fails to provide the evidence of remediation specified in section 5.5.2.2 within three months of receiving the suspension decision specified in section 5.5.2.1.

Preliminary ¶ 133 to Final ¶ 159

Within five working days after it has terminated access, Alphabet shall send the third-party OSE a decision which includes at least the following: (a) Reasoning: a detailed explanation of the grounds for the termination decision; and (b) Effects: a detailed explanation of the legal consequences of the termination decision.

Preliminary ¶ 134 to Final ¶ 160

Upon issuing thea termination decision, and unless a supervisory authority has opened an investigation or taken formal investigative steps under Regulation (EU) 2016/679 against the third-party OSE that require the retention of the Search Dataset as evidence, Alphabet shall take all necessary contractual measures to ensure: (a) That the party subject to the termination decision: (1) Erases all of the Search Dataset under its control; and (2) Does not further process or share the Search Dataset; and (b) That any other third party to whom the party subject to the termination decision disclosed (whether intentionally or not) the Search Dataset: (1) Erases all of the Search Dataset under its control; and (2) Does not further process or share the Search Dataset.

Preliminary ¶ 135 to Final ¶ 161

Alphabet shall take all necessary steps to ensure these contractual measures are enforced (including appropriate audit measures to verify erasure, at Alphabet’s own expense).

Preliminary ¶ 136 to Final ¶ 162

Alphabet shall allow third-party OSEs that have been subject to a termination or expedited termination measure to re-apply for access to the Search Dataset. Alphabet shall treat any such subsequent application for the Search Dataset as if it were an application from a new requestingundertaking applying for eligibility. Where a terminated third-party OSE successfully reapplies for the Search Dataset, Alphabet shall take into account any past payments of that third-party OSE towards the fixed fee specified in section 4.

Preliminary ¶ 137 to Final ¶ 163

Alphabet may decide to issue termination decisions in exceptional circumstances without following the procedures and time limits specified in sections 5.5.2 and 5.5.3 (“expedited termination decisions”).

Preliminary ¶ 138 to Final ¶ 164

The anonymisation-emergency ground is recast and supplemented by change-of-control triggers previously addressed in the suspension regime.

Alphabet may only issue an expedited termination decision in the following three circumstances: (a) Integrity and confidentiality of the Search Dataset: where itAlphabet becomes aware of ansubstantiated urgentevidence riskdemonstrating ofthat seriousthe integrity and irreparableconfidentiality damageof the Search Dataset has been compromised; (b) Failure to submit a Level 1 reasonable assurance report in the anonymisationcase of enda users’change personalof datacontrol: the merging parties fail to submit a Level 1 reasonable assurance report before the change of control takes effect; (c) Failure to notify a change of control: the merging parties fail to notify a change of control within 10 days after it becomes public or at least 30 days prior to the change taking effect (whichever is earlier) in accordance with section 5.4.4.

Preliminary ¶ 139 to Final ¶ 165

The expedited termination decision shall include at least the following: (a) Reasoning: a detailed explanation of the grounds for the expedited termination decision including all substantiated evidence demonstrating an urgent riskthat ofthe seriousintegrity and irreparable damageconfidentiality toof the anonymisation ofSearch endDataset users’has personalbeen datacompromised; and (b) Effects: a detailed explanation of the legal consequences of the termination decision or expedited termination decision.

Preliminary — to Final ¶ 166

To enable supervisory authorities to exercise their functions under Regulation (EU) 2016/679 in the event of expedited termination, Alphabet shall take all necessary contractual measures to ensure that the third-party OSE retains the Search Dataset for a period of four weeks following the third-party OSE’s receipt of a termination decision.

Preliminary — to Final ¶ 167

Upon the expiry of this four-week period, and unless a supervisory authority has opened an investigation or taken investigative steps under Regulation (EU) 2016/679 against the third-party OSE that require the retention of the Search Dataset as evidence, Alphabet shall take all necessary contractual measures to ensure: (a) That the party subject to the termination decision: (1) Erases all of the Search Dataset under its control; and (2) Does not further process or share the Search Dataset; and (b) That any other third party to whom the party subject to the termination decision disclosed (whether intentionally or not) the Search Dataset: (1) Erases all of the Search Dataset under its control; and (2) Does not further process or share the Search Dataset.

Preliminary — to Final ¶ 168

Alphabet shall take all necessary steps to ensure these contractual measures are enforced (including appropriate audit measures to verify erasure, at Alphabet’s own expense).

Preliminary ¶ 140 to Final ¶ 169

Alphabet shall impose strictly necessary and proportionate financial penalties on a third-party OSE in the following instances: (a) A third-party OSE fails to notify a change of control in accordance with section 5.4.34; (b) A third-party OSE fails to notify the commencement of insolvency proceedings against it in accordance with section 5.4.45; (c) A third-party OSE fails to notify Alphabet that it has received a limited assurance report; (d) A third-party OSE fails to comply with the necessary contractual measures imposing erasure of the Search Dataset as per section 5.5.3 and 5.5.4; or (e) A third-party OSE provides materially false information to Alphabet in connection with the independent verification mechanism specified at Sectionsection 3.2.4.

Preliminary ¶ 141 to Final ¶ 170

Alphabet shall not impose financial penalties on third-party OSEs in relation to their processing of the Search Dataset.

Preliminary — to Final ¶ 171

The Commission may require Alphabet to amend the documents that it shall produce to implement the present specification within a deadline to be set by the Commission if the Commission finds that these documents do not effectively comply with Article 6(11) of Regulation (EU) 2022/1925 and the measures in the present specification. This includes the documents referred to in paragraphs (117), (125)(a), (133) and (135).

Preliminary ¶ 142 to Final ¶ 172

Alphabet shall share a copy of any refusal, suspension or termination decision with the Commission at the same time it shares any such refusal, suspension or termination decision with the third-party OSE in question.

Preliminary ¶ 143 to Final ¶ 173

Alphabet shall also share a copy of any suspension or termination decision with the lead supervisory authority at the same time it shares any such suspension or termination decision with the third-party OSE in question. Throughout these Measures, “Leadlead supervisory authority” means the lead supervisory authority offor the processing carried out by the third-party OSE asin definedline inwith Article 56(1) of Regulation (EU) 2016/679.

Preliminary ¶ 144 to Final ¶ 174

Alphabet shall inform the Commission and the lead supervisory authority within five working days of any restoration of access to the Search Dataset following a suspension. It shall also provide the reasons for which it has restored access to the Search Dataset.

Preliminary ¶ 145 to Final ¶ 175

Alphabet shall notify the Commission and the Leadlead supervisory authority of the third-party OSE of its intention to issue an expedited termination decision at least three working days before it intends to issue such expedited termination decision to the third-party OSE in question. In its notification, Alphabet shall clearly explain the reasons for its expedited termination decision and provide supporting evidence.

Preliminary — to Final ¶ 176

Alphabet shall maintain on its website a page listing all third-party OSEs that have received access to the Search Dataset. Alphabet shall display on this page a notice in respect of each eligible third-party OSE publicising that Level 1 and Level 2 assurance has been obtained as well as a notice publicising the fact of any termination and expedited termination decisions, as well as a short description of the reasons for such termination or expedited termination decisions. These notices shall not contain any information which is confidential information or business secrets of the third-party OSE.