A list of features that would allow third-party AI systems background access to your microphone, camera, screen contents, location, notifications, contacts, SMS, Gmail, Calendar, Drive, Maps, and Phone.
If this were granted, the expectation is that we would act surprised when it is fast-followed by requirements to use EU-controlled systems that can monitor this content.
The other option is nobody has this access, since it is only required because Google have built this access for themselves and the DMA simply requires they do not have privileged access because it is not competitive. This is a problem that only exists because Google wants that access for their own benefits.
It is required to facilitate the AI features Google wants for its product. What you're advocating is not having those features. That's fine, but it is also not going to happen. If this is what the EU wanted they'd be asking for these features to be disabled, not to have access.
The EU as a whole is walking a tightrope. Its largest economies still depend heavily on the US market. If the current US regime perceives that US companies are being targeted by EU "taxes", regardless of whether those laws are legitimate, there is a real danger of US retaliation.
Key sectors could take the hit, including automotive manufacturing, industrial equipment, chemicals, electronics, fashion, textiles, and luxury food and wine.
Given that these nations are already managing high debt loads while funding generous social welfare programs and expanding their defense budgets, trade sanctions could cause serious damage...
So yeah...EU is performing a delicate balancing act here.
Yes. But what this discussion so often misses is.. So is the US.
The US needs military bases, it needs general market access, it wants to sell military equipment and so on and so on.
The US is already being reckless with the relationship and diversification is underway, but how deep the split will be is in large part determined by how the US wants to behave going forward.
It's like a divorce, there aren't really any winners here (in terms of wealth, assets, ...). So it's a tightrope both need to walk, balancing each other's interests.
US tariffs on EU automotive manufacturing, industrial equipment, chemicals, electronics, fashion, textiles, and luxury food and wine, would be only slap on wrist.
The real danger of US retaliation for EU are: export tariffs on US LNG, loosing arms exports for Ukraine. This the real EU delicate balancing act.
This would make some sense under normal circumstances. However the Trump administration isn't "retaliating" except in the same sense you saw ICE "retaliating" by murdering unarmed protesters.
Violent bullies respect strength to the extent they respect anything at all.
I think that's the point; much like how Canada isn't blinkimg every time the US jacks up whatever nonsense tariffs.
They know it's going to hurt and they can't just order their own country -- or in the case of the EU; countries -- to fully decouple and so they're using the pain to encourage the creation and growth of alternatives.
Nobody says it isn't painful or that it isn't going to suck but it's viewed as inevitable rather than something to be avoided.
I looked it up, and it seems that one issue is that Google, as a DMA gatekeeper, is supposed to provide anonymous data to other search services, but in practice, important parts of the actual data have been removed. The other issue is that competing AI services (not just Gemini) should also be allowed to run integrated app search.
And supposedly, "steering must be free". Or at least that's what they told Apple when fining €500M, I think today they both charge up to about 20% commission if apps use third party payments.
These fines go toward the EU's general budget as "other income" which reduces the amount that member states must contribute annually for the budget to balance. So the EU partially funds itself by leveraging fines like this on AliExpress, Google, Meta, Apple, etc. and the trickle-down savings to member states is then (presumably) used to fund public works and social services locally.
The lengthy legal battle against these fines is going to be extremely interesting, especially on the Shopping/Hotels/Flights side since it is an extremely competitive market. I wonder if the lower EU court will keep its overly proactive approach despite the CJEU's reversals.
Interesting to see how Google solves this in their UI because this isn’t a new problem: In 2017, they were fined for a similar problem with Shopping and the auction house concept to compete for placement was heavily scrutinized.
The goal of the regulation is to get the operators to comply, which they usually do after fines (EDIT: and litigations and whining, of course), because the costs of infractions are increased if they don't comply.
The issue is they usually comply with the specific law being broken, and then immediately stop complying with a different law
The goal should be to incentivise them to comply with the law as a whole, not to keep deliberately breaking different sections of the law to make profit above the level of fines
That's why people want the level of the fines to go up, to disincentivise the more broad lawbreaking
Imagine regular laws worked that way, where a prior conviction is only relevant if it was for the exact same crime, and you can go around committing dozens of crimes and be treated like a first offender every time because this time you chose robbery and last time it was theft.
Not really, next time they just make a calculated risk decision, if the revenue from non-compliance is quite significant than the fine they have to pay later (if they have to, because I can imagine so many other cases which went unnoticed or didn't result in a fine) there is no reason for them to comply next time. It's not like they will be prohibited from doing a business after n number of compliance violations or fines
Except they did comply for all the cases where they were fined. They're not fined for one-off behaviors, but for how their services are structured. That's GPs point.
If the cost of penalties doesn't exceed the cost of the offence then it's a winning move to offend.
The correct solution to this is to have fines scaled to the value of a company and an exponential doubling of fines for every re-offence that falls under the same category of crime with a cooling off period after a few years.
The fines do scale with noncompliance, if Google were to continue to offend they would get a daily fine that is retroactively applied to the full duration.
Because the goal isn’t to punish, it’s to get them to do what the law wants them to do. The fine is supposed to be a slap on the wrist - the actual desired behaviour is compliance
The big corporations don't really fix their evil behaviour. That's why fines keep on re-emerging.
> because the costs of infractions are increased if they don't comply.
See above. If the fines were to work, it would not become a repeating issue.
I think mandatory jailtimes are the only solution. When the CEOs are suddenly for 10 years in a small room, slowly they will begin to stop their mafia-strategy.
You appear to be arguing with the assumption that "get the operators to comply" is false.
These companies do, in fact, change behaviour in response to such actions; they may hire lawyers to find and exploit as many loopholes as they can, but they do ultimately comply. Even X ultimately complied in response to Brazil, and the EU is a much more important market for Google than Brazil ever was for X.
(Why would you expect to get dollars from an EU settlement?)
> I've never received a dollar from the EU as a victim.
There's this standard assumption that HN users are well educated.
Budgets don't work like that. It's not like the US federal government collects taxes and then deposits bags of gold coins on people's doorsteps.
Taxes, fines, etc are all collected and then they mostly go to a general, undifferentiated budget which is then divided by the various ministries (departments, whatever).
So yes, if you're a EU citizen you did get the money back. As roads, hospitals, research funding, etc.
It‘s nice to have such revenue to fund EU programs on digital sovereignty. European institutions give plenty of money to startups. You need an entry to the program, but when you are in, it can account for 50-70% or more in your early stage funding. And that‘s nice, because you keep more equity.
I find it more interesting that US Americans think letting their companies do whatever they want everywhere (as they currently do) is the better "strategy".
I don't think that's a sustainable model. Also most of those fines goes into filling the gaps in budgets related to recurring costs of maintaining the bureaucratic behemoth rather than funding research or innovation.
The maximum fine the EU can impose with the DMA is "10 % of its total worldwide turnover in the preceding financial year". I think this would hurt even Google. And I think a billion dollars is not nothing.
The same principle evoked in the rest of this thread, if the penalties match exactly or are under the profits you can generate by injuring (in the legal sense) EU citizens it's not really a penalty but rather a cost of business. Plus markets are very interconnected, especially the digital ones.
EU competition law is not framed around valuing Europeans more than others, it is framed around protecting competition and market functioning inside the EU.
No need to moralize it and pretend anyone is using this "value" European humans more than other humans.
Because they decided that way. Any other country in the world can decide the same thing but they don't have the same leverage as the EU. Google makes a lot of money in the EU.
Why a year, when they've often been breaking the rules for much longer than that?
Why not 20% (30%), given that's the share of world GDP (PPP) due to the EU?
Why revenue rather than profit?
The answer is: big round number that's roughly justifiable as a big stick for, and I want to emphasise this, a punishment to make sure they don't break the rules.
This fine is more of a warning shot. The DMA allows for fines of up to 10% of global revenue or 20% in the case of repeat offenders.
These 890M are a first warning. Now Google has some time to react, but if they don't implement what is required of them, another, higher, fine will be issued.
20% of global revenue is not just cost of doing business, to any business.
'a billion here, a billion there, pretty soon you're talking real money'
...but this is a private(ish) business, it doesn't have a printer in the back yard, a billion is a lot no matter how you look at it, especially if they're now facing a tough choice between cannibalizing their results with AI summaries or having AI competitors eating their lunch.
Yep. If a train ticket costs 100 euro and the fine for freeloading is 5 euro, you'd be a fool to buy a ticket.
Don't blame Google for pushing boundaries. That's what people (and corpos) do in any competitive activity. Do blame our politicians for being incompetent and ill-meaning.
I lived in a city where police can fine you for biking in the night without the lights on, but police catches people so rarely that, per ride, the mathematical expectation of a fine was lower than the cost of batteries.
You really shouldn't apply statistics this way. Expected value is useful if you're an insurance company because you can price insurance products slightly above the expected value, but if the fine is $100, batteries are $90, and you get fined after going on 10 bike rides the fine doesn't magically become $10 it's still $100 and you still could've saved $10 by spending $90 before getting on your bike. That is, unless you put $10 in a piggy bank every time you get on your bicycle, and then at that point why not put $90 down and then pay yourself back $9 per ride with $1 of interest?
I mean that if fine / E[N_f] < battery_cost / E[N_b], where E[N_] is an expected number of rides before a fine / battery expire, then I save money per ride. In your example, you just pick the values such that the relation becomes '>'.
Today? Wow. You must have very weirdly expensive batteries and/or electricity. Around here, a complete replacement of non-rechargeable bike light batteries would cost €1.25, and they'd still last more than one ride each. Rechargeable batteries may cost more, but last thousands.
That was quite a while ago. I can't recall exactly anymore, but the yearly battery cost was probably indeed quite low, ~20 euro maybe? They just didn't fine people often enough.
You're leaving out the tiny detail that Google, like all tech giants (and like all big companies) is pouring tons of money into politics, and that's just talking about spending out in the open. How much money do you think Google and it's investors have collectively spent to influence politics?
So no, Google shouldn't get a pass for pushing boundaries. Thinking like this only protects the capital class and the politicians responsible for this mess.
That's an interesting comment. I noticed already years before
AI emerged that Google ruined its search engine. I am not sure
AI per se kills search engines, but interestingly the other
search engines also suck immensely. Even from the User Interface,
which is strange to me. Qwant just copy/pasted Google's horrible
UI. DuckDuckGo is praised for reasons I don't understand - it
also produces really low quality results. It seems nobody is able
to come up with really good search engines anymore - they always
end up being absolute horrid jokes in this or that area.
Yes you are correct, most are horrible. I built my own as a hobby because I wanted to go back to the "ten blue links" model of the early Internet, but freely admit that model is now dead with the majority of end-users asking their AI assistants instead. Gemini is vital to Google as a result.
EU regulatory apparatus is maybe only part of the EU which is operates without obsequiousness to the US; on the one hand, this is necessary assertion of sovereignty, on the other you fear for the wider collateral damage which will inevitably ensue. Trump gonna respond to this with an escalation for sure
This is the fine after it got influenced by the political branch. It is a sign towards the companies that the law still bites and has to be adhered but reduced in this case to a level where it can be accepted by Google without major escalation in trade politics.
to be fair to Trump, he does respond to corporate lobby - Pichai just got to make a phone call and an EO will be rolling out in short order. This is not because Gogole controls Trump, it is simply that Trump is a nationalist and will defend US companies, he just needs to be reminded to do so
The current government has defied the supreme court many times. It can do this because the police force is controlled by the government, not by the supreme court, so it won't arrest the government.
The private sector often complies in advance. Large logistics companies collected obviously illegal taxes long before they were challenged in court. It's not easy and the cost of doing business is already high, and not only in the US.
That's one read. For me it feels like practically (ASML, ARM, SAP not withstanding) their only "contribution" to tech is fines and exporting regulation. Sometimes this works out well (usb-c on iPhone), but most of the time it feels like if they want software, hardware, or the web to operate the way they want, perhaps they should try to actually produce some of it instead of being wholly reliant on others while also trying to dictate the terms. I also don't really feel like Trump will do anything, mainly because neither he, nor anyone else before him has any track record of attempting to block or slow EU overreach into US tech interests. Or maybe I'm just cranky and pessimistic.
Google, Apple and co are free not to do business in the EU. There is no "overreach". It's a 450M pop market with a high median per-capita income. There are many reasons why the EU has a rather small tech industry of its own, high up among them that the EU does comparatively little to protect its market compared to China where most US tech companies don't even bother to enter anymore. In China, if a fine like this hits you, you are not allowed to do business anymore until it's either paid or revoked in court. So yeah, the EU is very lenient on all accounts.
Isn't the median income per capita higher in the US. European companies are likewise free to pay tariffs or not do business.
EU does much more to protect its market compared to US.
EU was never a developing country like China. Most countries in EU benefited from centuries of exploitation of Asia, Africa and the Americas. They don't need protectionism.
Yes, it's only one company out of the whole market. If ASML makes EU count as a good tech market then everywhere is a good tech market because it has at least one important tech company.
"anti-trust" in many EU countries, is made of "competition authorities", namely dominant corporations on some significant "markets" get strong rules forced upon them that to allow to exist any reasonable real-life alternatives.
Here, Big Tech must interop with Small Tech. A common malicious behavior from Big Tech is to inflate by tons the required complexity and size of their 'tech' in order to make it out of reach by small competitors. This is one of the roles of market regulation. It seems they are now using 'security' (something which is only best-effort, it actually does not exist) to scare people to go to alternatives (how deep the rabbit hole goes here... mmmmh...)
In my EU country, we have a very good internet, thanks to _HARDCORE_ regulation which allowed small alternatives to be bootstrapped and to exist and grow. It is a bit different for gogol which is trying to create a 'very walled garden' like the "rotten fruit" company with this 101 malicious behavior on the long run: strong interop with 'Small Tech' at the beginning, slowly (~decade+) but surely this interop is broken to favor the 'Big Tech' from their cartel.
It is really complex: devil hides in the 'technical' details, it is case by case over some kind of continous spectrum. Here, it boiles down to the complexity/size of protocols, file formats with their stability in time: if you regulate here, "Small Tech" becomes a real-life alternative.
And don't be a fool at believing they are not talking to each other and play fair...
EU just killed all hardware startups with Cyber Resilience Act. It killed all the SMEs <50 employees in hardware area too. The lost income from European companies will be replaced with fines for US companies. That’s a strategy! Visionaries at work.
So basically you need 3 persons writing compliance documentation and taking care of cybersecurity. Basically another 200000€ personal cost year in low cost area. 250000€ or more in bigger cities. You have a microprocessor in your product and it’s done deal.
No big deal for corporations though. Buddy’s workplace hired new compliance department for this topic with 30 persons. That’s competition european way.
The thing is not that the product will be somehow secure. It will have properly filled compliance papers. That’s the same story with functional safety. For example car electronic components break all the time, but they have well done paperwork.
> The thing is not that the product will be somehow secure.
I don't believe that is true. Cars do break but they have to meet safety standards. That doesn't make them perfect but it's much better than not having them. You can't make perfect safety standards in an ever changing world but you can define minimum standards.
I understand that documentation is a pain in the butt, but it's necessary to have some oversight. It's part of the enforcement. Everyone has to do it so we know the documentation should exist. That means we can fine companies that don't do it. If you mad the documentation and lied on it and it comes out you will probably fined even more. It's a deterrent and a way to enforce the rules.
It forces Europeans wanting to build hardware startups to go overseas, so there's even fewer new European hardware companies and Europe becomes even more dependent on the US and China.
Just like everyone left when the GDPR went into place? Having safety standards in place (and yes that also means documenting them) can even be a selling point. To have demonstrably secure hardware according to a standard can be highly desirable.
I think losing the companies that don't have security as a main priority isn't too bad. I assume that the EU will create import restrictions if there is a meaningful shift to avoid EU rules.
You know that when a regulation mandates a role like this, it isn't the person's entire job, right? When GDPR says you need a data protection officer, it doesn't mean you need to hire someone to be your data protection officer. In a very small startup, it could mean the CEO is also the data protection officer.
You don't need a whole full timer for that either. When we had to deal with the usual iso stuff it was one guy hired through the agency working on Thursdays
From what I gather, the cyber resilience act applies to all products placed on the EU market, regardless of whether the manufacturer is based inside or outside of the EU. So European hardware vendors will be competing on the same terms as American and Chinese ones when it comes to the CRA.
Google Search decision: https://ec.europa.eu/competition/digital_markets_act/cases/2...
Android decision: https://ec.europa.eu/competition/digital_markets_act/cases/2...