EU fined Google €890M under the DMA for favoring its own services and restricting Play Store competition, with AI search features also under scrutiny.

The European Commission hit Google with two fines totalling €890 million on Thursday for violating the Digital Markets Act, one for giving its own services preferential placement in Google Search and one for blocking app developers from directing users to cheaper alternatives outside the Play Store. These are Google’s first DMA fines, but the fifth and sixth competition penalties against the company overall, bringing the cumulative total to €10.38 billion over nearly two decades. At this pace, Google is basically funding a small member state.

“Today, the European Commission took two decisions finding non-compliance by Google with the Digital Markets Act (DMA) for self-preferencing its own services on Google Search, and for putting in place restrictions on businesses to direct consumers to alternative, often cheaper, purchase channels on Google Play (steering).” reads the press release published by the European Commission. “In this regard, the Commission issued Google a fine of €460 million and a fine of €430 million respectively.”

The search fine covers Google’s handling of shopping, hotels, transport, and sports results, where the Commission found the company systematically promoted its own products over rivals. The Play Store fine targets steering restrictions that prevented developers from telling users they could buy the same app or subscription elsewhere for less.

Despite the scale of the penalties, the Commission signaled that ongoing daily fines for non-compliance are unlikely.

“The Commission notes that, after a constructive dialogue, Google has proposed and started testing changes to how it presents its own services on Google Search for free services such as shopping, hotels and flights.” EU continues. “The Commission will monitor the implementation of these solutions which constitute substantial progress towards compliance.”

The Commission described this as substantial progress and flagged a “constructive dialogue” with Google, which is regulatory language for “we’re not done but we’re not going to war either.”

Google has 60 days to comply with orders to treat rivals fairly and allow developers to redirect users away from the Play Store. The company rejected the findings and didn’t rule out taking the Commission to court. President of Global Affairs Kent Walker argued that complying would force Google to strip out real-time search features like hotel pricing and flight availability, and remove safety protections from the Play Store, framing the decisions as harmful to European users rather than protective of them.

“The Commission also notes that Google has proposed and started testing changes to how it presents shopping ads and content related services, such as sports.” states the press release. “The Commission is currently assessing these changes and will continue its dialogue with Google in light of today’s decision.”

That extension to AI features is the part of this decision that will matter most in the long run, as AI-generated summaries are increasingly becoming the first layer of search results that users interact with. The fines are the third under the DMA after Apple and Meta were penalized in April last year, and the U.S. government’s response was predictable.

Reuters reported that trade Representative Jamieson Greer said the actions are “driving massive uncertainty for U.S. exports.” though no specific retaliatory measures were announced.

“The two non-compliance decisions were adopted after a thorough investigation, including feedback from market participants, and extensive dialogue with Google.” concludes the press release. “When calculating the fines, the Commission has assessed the gravity, duration and recurrence of the breaches and concluded that the level of fines imposed are proportionate and appropriate.

Google may challenge today’s decisions in court.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, EU)

Lidl says attackers stole customer data in Germany, Belgium, and the Netherlands via a third-party provider, raising concerns about phishing and GDPR compliance.

The post Lidl Data Breach Exposes Customer Details in Germany, Belgium, and the Netherlands appeared first on TechRepublic.

EU’s top court upheld a €4.1B fine against Google, ruling it abused Android’s market dominance through restrictive licensing practices.

The Court of Justice of the European Union issued its ruling on July 2, 2026, and Google lost. The court dismissed the appeal brought by Google and its parent company Alphabet against an earlier judgment from the General Court, confirming a fine of €4,125,000,000. Alphabet is jointly and severally liable for €1,520,605,895 of that amount.

The case goes back to 2018, when the European Commission concluded that Google had abused its dominant market position through three categories of restrictions built into its Android licensing arrangements. Device manufacturers who wanted access to Google’s Play Store had to pre-install Google Search and Chrome. To get the licences needed for those apps, they also had to agree not to sell devices running Android versions that Google hadn’t approved. And Google paid manufacturers and mobile operators a share of its advertising revenue on the condition that they didn’t pre-install a competing search engine on a defined set of devices. The Commission concluded all three formed a single, coordinated strategy to protect Google’s search dominance, and fined the company €4,342,865,000.

The General Court reviewed the case in 2022 and agreed that the conduct was a single and continuous infringement. It annulled one piece of the Commission’s decision: the part dealing with revenue share agreements tied to the exclusive pre-installation of Google Search on a predefined device portfolio. That partial annulment led the court to recalculate the fine downward to €4.125 billion. Everything else held.

Google and Alphabet then appealed to the Court of Justice, the EU’s highest court, arguing the General Court had made legal errors in its analysis. The Court of Justice went through those arguments and rejected them all.

“The appeal brought by Google and its parent company Alphabet against the judgment of the General Court is dismissed, thereby confirming the penalty imposed for Google Search’s abuse of a dominant position in the context of the Android operating system.” the court’s press release states. “In 2018, the European Commission adopted a decision in which it concluded 1 that Google had abused its dominant position by requiring, in particular through pre-installation agreements and licensing conditions for certain apps, that its search engine, Google Search, and its Chrome browser be promoted on mobile devices running the Android operating system, which is also provided by Google. 2 It therefore found a single and continuous infringement covering the whole of that conduct and imposed an overall fine on Google of €4 342 865 000, with Alphabet jointly and severally liable as to €1 921 666 000.”

Google’s first argument was that the General Court assessed the anticompetitive effects of the pre-installation conditions incorrectly, in particular, that it should have run a counterfactual analysis to show what the market would have looked like without those conditions. However, the Court of Justice disagreed and confirmed the General Court was entitled to look at the full economic context, including the revenue share agreements, without needing to run a formal counterfactual test. The court also confirmed the finding that pre-installed apps enjoy a status quo bias, meaning users are less likely to switch away from them, and that Google hadn’t shown that user preferences or the quality of its services alone explained its market position.

On the pre-installation conditions specifically, Google argued that proving abuse of a dominant position requires showing the conduct could exclude competitors that are equally efficient. The Court of Justice rejected that too.

“Second, the General Court did not err in law by confirming the Commission’s assessment of the pre-installation conditions laid down by the Android agreements. Demonstrating an abuse of a dominant position is not conditional in any case on proof of a capability to foreclose only as-efficient competitors.” continues the press release. “Given the particular characteristics of the digital markets concerned, the General Court was entitled to conclude that those practices were liable to restrict competition and strengthen barriers to entry without applying that test.”

On the anti-fragmentation agreements, which required manufacturers to avoid selling devices running unapproved Android forks, the Court of Justice again sided with the General Court. Those agreements limited the commercial space for Android versions Google hadn’t blessed, which reinforced its dominant position. A counterfactual analysis wasn’t necessary because the anticompetitive effects were already sufficiently established on the facts.

Google also challenged how the fine was calculated, invoking procedural arguments including rights of defence. The Court of Justice endorsed the General Court’s use of its unlimited jurisdiction to set the penalty amount, ruling that the reasoning was sufficient and the procedural principles were respected.

“The Court of Justice endorses the exercise by the General Court of its unlimited jurisdiction to set the amount of the fine, ruling that its reasons were sufficient and that the procedural principles invoked by Google and Alphabet, including rights of defence, were adhered to.” states the report.

Google is disappointed with the ruling.

“We are disappointed with the ruling. Android has given people more choice, not less, enabling thousands of device makers to build affordable smartphones and giving billions of people access to a wide range of apps and services. We will review the judgment carefully.” the company said in a statement.

This is the end of the road for this particular case. The Court of Justice is the EU’s highest court on points of law. There’s no further appeal. The €4.1 billion fine stands, and the legal framework the Commission used to reach that conclusion has now been validated at every level of the EU court system.

The case also sets a precedent for how digital markets get treated under EU competition law. The court confirmed that the standard test used in traditional markets, whether conduct excludes equally efficient competitors, doesn’t automatically apply in digital contexts. That has implications well beyond Google. Any company with a dominant platform position in the EU now knows that structuring licensing arrangements to steer users toward its own products carries real legal risk, even if it can argue its products are genuinely better.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Google)

Microsoft and Trend Micro found hotel phishing attacks using fake guest complaints and photo links to target staff in Japan.

The post Microsoft Uncovers Widespread Hotel Phishing Campaign in Japan appeared first on TechRepublic.

Hackers claim 1M+ records tied to French employment apps were exposed, including HR files, health data, worker details, and plaintext passwords.

The post Hackers Claim French Employment Leak Exposes Over 1M Records, Health Data appeared first on TechRepublic.

A Danish court ordered the state to compensate TDC NET after the removal of Huawei fiber-network equipment, raising questions about telecom security costs.

The post Denmark Ordered to Pay $12M Over Huawei Equipment Removal appeared first on TechRepublic.

Europol and Microsoft disrupted malware infrastructure linked to 27 million stolen login credentials and 140,000 infected computers in a global cybercrime network.

The post Europol, Microsoft Hit Malware Network Behind 27M Stolen Logins, 140,000 Infected Computers appeared first on TechRepublic.

Apple lost a bid to narrow a UK iCloud lawsuit from Which?, keeping a £3 billion competition claim on track for an October 2028 trial.

The post Apple’s £3B iCloud Lawsuit Could Affect 40M UK Users appeared first on TechRepublic.

Hackers claim they stole 1.3TB of Novo Nordisk data, including clinical trial and AI model information, after issuing a $25 million demand.

The post Ozempic Maker Novo Nordisk Confirms Security Incident After $25M Hacker Demand appeared first on TechRepublic.

ShinyHunters claims it stole 297GB of data from the Council of Europe, including payroll and medical records, but the organization has not confirmed a breach.

The post ShinyHunters Claims Council of Europe HR Data, Threatens Leak appeared first on TechRepublic.