The Tiger Awakes? The CMA's Attempt To Regulate Google's Conduct In Search And Search Advertising

Abstract

The UK Competition and Markets Authority (CMA) has imposed its first ever 'conduct requirements' under the new Digital Markets, Competition and Consumers Act 2024 (DMCCA) on Google, after designating the search behemoth with 'strategic market status' in search and search advertising last fall. These focus on three elements: protecting publishers in AI generated responses, ensuring fair ranking of businesses in search results and enabling data portability. 

This is a highly significant move that goes beyond obligations Google is already subject to under the European Commission's Digital Markets Act (DMA) and distinguishes the CMA's approach in other markets. Conduct requirements, unlike voluntary commitments, are legally enforceable by companies impacted by any alleged non-compliance. This raises the specter of publishers and the many companies reliant on Google taking the company to Court.

This article summarises the journey here, the significance and immediate impact of these conduct requirements and how businesses have responded to the proposals. It considers these interventions in the context of ongoing antitrust investigations into Google by authorities across the globe, including how they match up to the UK's closest neighbor, the EU's Digital Markets Act. Finally, it considers what further steps the CMA may take to regulate Google in future.

The Journey Here

The Competition and Markets Authority gained new powers under the DMCCA in January 2025 to regulate very large companies providing digital services in the UK under the so-called 'Digital Markets Competition Regime' (or DMCR) administered by the Digital Markets Unit (DMU) within the CMA. Designation of a company as having 'strategic market status' (SMS), which is only possible if the company has £1 billion revenue in the UK or £25 billion globally, unlocks a wide array of potential interventions (known as 'conduct requirements' or 'CRs') that the CMA can tailor to individual companies and product and service lines with a view to regulating – with some granularity – how that company conducts its business vis-à-vis other businesses and consumers.

One of the key tenets of the new DMCCA and the DMCR was that – in the absence of any pesky legal threshold for intervention (for example, a requirement to find dominance, abuse of that dominance and anti-competitive effect or, in the context of the CMA's Markets Regime, an 'adverse effect on competition') it would be able to move markedly faster than a traditional antitrust investigation from SMS to intervention. 

In this respect, it has not disappointed.

The Last 18 Months

Briefly, since the inception of the regime in January 2025:

(i) On 14 January 2025, the CMA launched SMS investigations into Google and Google Search and, shortly thereafter, on 26 January into Apple's mobile platform (including App Store) and Google's mobile platform (including Play Store).

(ii) On 24 June 2025, the CMA published a roadmap of potential actions it could take under the DMCR to rein in Google in Search and Search Advertising.

(iii) On 23 July 2025, the CMA published roadmaps setting out potential approaches to tackling Apple and Google's mobile platforms.

(iv) On 10 October 2025, the CMA designated Google with SMS in general search and search advertising, and Apple and Google with SMS in mobile platforms.

(v) On 10 February 2026, the CMA accepted voluntary commitments from Apple and Google, giving businesses greater transparency over how their apps are reviewed and ranked, how their data is used and a method for developers to request interoperable access to functionality within Apple's iOS and iPadOS.

(vi) On 3 June 2026, following roundtables with relevant stakeholders, the CMA imposed a formal publisher conduct requirement on Google (its first ever CR under the new regime) focused on AI search, attribution, transparency, metrics and publisher controls.

(vii) On 17 June 2026, following further roundtables, the CMA imposed a fair ranking conduct requirement and a data portability conduct requirement on Google.

Taking the three conduct requirements imposed on Google in turn:

1. The Publisher CR

This CR requires Google to provide publishers with effective controls over the use of their search content in Google's generative AI features. It must publish clear and user-friendly information explaining how publisher content is used in Google's generative AI. It must provide clear and detailed metrics on user engagement with publisher content in generative AI search features. It must also take reasonable steps to ensure clear and accurate attribution in general search, together with a clear means for users to access the underlying publisher content.

The CMA's press release described this as a "world-first" and indeed this requirement goes beyond those mandated by the EU's DMA. It seeks to address a fundamental problem generated by the new economics of AI search. While there is a degree of quid-pro-quo in traditional search (publishers allow crawling and indexing because Google sends users back to their sites) 'AI Overviews' and 'AI Mode' are more of a one-way street: if the AI response addresses the user query, there may be no click-through to the underlying publisher's website. The CR is intended to give publishers back some leverage, allowing them to refuse use of their content in generative AI search (including for fine-tuning of AI models) without being penalized in ordinary search.

The Publishers Association welcomed the requirement for consent and the restriction on Google manipulating search rankings to punish publishers who opt out. The News Media Association described the requirements as a significant step towards a fairer digital economy where premium content is properly respected and fairly compensated.

However, while the requirement gives control, transparency, attribution and metrics – critically – it does not impose a payment mechanism, which limits its practical impact. It also stopped short of mandating separation or real‑time auction transparency – measures some believe would have had a more immediate impact on revenue distribution. Finally, it lacks granularity. The PPA has welcomed the publisher requirement but criticized the absence of per-feature and per-purpose controls. Publishers may have to make broad choices across AI Overviews, AI Mode and other AI-powered search features, rather than manage participation on a product-by-product or purpose-by-purpose basis.

2. The Fair Ranking CR

This CR is more orthodox than the Publisher CR. Google must rank organic search results using objective and non-discriminatory criteria, including in search generative AI features. It must provide greater transparency about how rankings work, give notice of material changes that could affect publishers, and provide an effective route for businesses to raise concerns about actions or changes that may distort or adversely affect UK markets.

Two limitations are worth noting. First, the requirement applies to organic search results, not sponsored results. Second, it does not prescribe a particular ranking algorithm or outcome, leaving Google to determine a method that is fair and transparent.

3. The Data Portability CR

This CR is narrower than many wanted. Google must provide third parties (like rewards platforms, personalized offer providers and other services that can innovate using user-authorized search data) with free tools to facilitate effective portability of a user's search data (with their consent), putting the existing voluntary 'Data Portability API' process on a legal footing.

However, this is not the same as the EU's Digital Markets Act obligation requiring access to ranking, query, click and view data for rival search engines on fair, reasonable and non-discriminatory terms.

How this Compares to the EU…

In the EU, the Commission imposed a €2.95 billion ad tech fine on Google on September 5, 2025, finding that Google had abused its dominance in online display advertising technology by favoring its own ad tech services. Google has proposed compliance measures, but the Commission has signaled that structural remedies may remain on the table if Google does not adequately address the conflicts of interest in its ad tech stack.

Separately under the EU's Digital Markets Act, Google – as a designated gatekeeper for a number of core platform services, including Google Search, Google Play, Google Maps, Google Shopping, YouTube, Android, Chrome and online advertising services – must comply with a standardised set of obligations across the Union. These include bans on self‑preferencing and requirements for data portability and interoperability. So far, the Commission has pursued Alphabet in relation to Google Search self-preferencing and Google Play steering, opened proceedings concerning Google's site reputation abuse policy and the demotion of publisher content in Search, and begun specification proceedings on Google Search data sharing and Android interoperability.

In December 2025, it opened an investigation into Google's use of web publisher content and YouTube content for AI purposes. The concern is whether Google may be imposing unfair terms on publishers and content creators, using content without appropriate compensation or meaningful opt-out, and giving itself privileged access in a way that disadvantages rival AI developers.

And Elsewhere…

In the United States, the Department of Justice and plaintiff States have already obtained significant remedies in the Google Search monopolisation case. The final judgment restricts certain exclusive and default distribution arrangements, requires Google to make certain search index and user-side data available to qualified competitors, and requires Google to offer search and search text ads syndication services to certain competitors. The remedies also extend in relevant respects to GenAI products and companies. Appeals and cross-appeals are ongoing.

Canada's Competition Bureau has brought proceedings in relation to Google's online advertising technology.

Japan's Fair Trade Commission issued a cease and desist order on Google in April 2025 concerning restrictive terms linked to Android smartphones, Google Search and Chrome, including preinstallation/default requirements and restrictions on rival search functionality.

The Competition Commission of India (CCI) has pursued cases concerning Google's app store and advertising practices, with several appeals pending.

The Australian Competition and Consumer Commission (ACCC) continues its Digital Platform Services Inquiry, recommending new powers similar to the DMCCA.

Direct Enforcement

It is important to note that CRs (unlike voluntary commitments) establish legally enforceable obligations. A company affected by Google's failure to comply with a CMA CR could bring a direct private enforcement claim under section 101 of the DMCCA. Section 101 treats a "relevant requirement" — including a CR imposed under section 19 — as a statutory duty owed by Google to any person who may be affected by a breach.

If that breach causes loss or damage, the affected company may bring civil proceedings in the High Court, or in the CAT, seeking damages, an injunction or other appropriate relief. This could apply to the CMA's Google Search CR, including most likely the publisher CR; for example, where the company believes that Google is continuing to penalize it for non-participation in its generative AI search features.

Outlook

The CRs imposed by the CMA on Google are an important moment for the UK DCMR. For publishers and advertisers, the new rules promise greater transparency and potentially more competitive auction outcomes. For the CMA, the challenge will be effective enforcement. It is likely that publishers will continue to push for additional measures trailed in the roadmap, including on user choice, search choice screens, default settings and mandatory fair payment for material. A formal review is expected within two years and, should existing obligations prove ineffective, the CMA retains the option to impose further CRs or escalate to structural or access remedies. It will also be interesting to see whether companies will take direct legal action in the event of suspected non-compliance.

By imposing CRs on Google, the CMA has demonstrated its willingness to tackle big tech and the flexibility of its new digital markets powers. The publisher CR, in particular, marks a distinct UK contribution to global debates on platform fairness.