Google’s €890 million DMA penalty package starts a 60-day compliance clock

Editor’s Note: Brussels put a price on gatekeeper non-compliance on July 23, fining Google €890 million across two Digital Markets Act decisions and starting a 60-day compliance clock that could carry steeper consequences than the penalties themselves. The €460 million Search decision appears to be the first the Commission has published under the DMA ban on self-preferencing, and it converts a design question into an evidence question. A gatekeeper must now be able to demonstrate that its ranking treated third parties fairly, not simply assert that it did.

That shift is why the story belongs to cybersecurity, data privacy, regulatory compliance and eDiscovery teams rather than to competition counsel alone. Ranking configurations, experiment records and model documentation become potential regulatory evidence, which draws retention planning, access controls and integrity controls onto artifacts engineering teams may otherwise treat as disposable. The Commission made the point explicit in March 2024, when it ordered five gatekeepers to retain documents bearing on DMA compliance.

Watch three things next: whether Google appeals, on a timetable that runs separately from compliance; how it responds by the expected Sept. 21 compliance date; and how the Commission applies the decisions to AI Overviews and AI Mode.

Industry News – Antitrust Beat

Google’s €890 million DMA penalty package starts a 60-day compliance clock

ComplexDiscovery Staff

The European Commission fined Google €890 million on July 23 for breaching the Digital Markets Act and required the company to comply with both decisions within 60 days. Complying is one problem. Demonstrating compliance from retained records is another, and that second problem reaches well past Google.

The Commission issued two separate decisions. One carries a €460 million fine for self-preferencing on Google Search, where the Commission found that Google “gives preferential treatment to its own services, including shopping, hotels, transport and sports results, over those of third parties,” according to the announcement issued in Brussels under reference IP/26/1670. The second carries a €430 million fine for anti-steering on Google Play, where the Commission found that Google “prevents app developers from freely communicating and promoting offers and concluding contracts with users in distribution channels of their choice, including third-party app stores.”

The obligations at issue are Article 6(5), which bars a gatekeeper from treating its own products “more favorably, in ranking and related indexing and crawling,” and Article 5(4), which requires gatekeepers, free of charge, to allow business users to communicate and promote offers to end users and to conclude contracts with them.

“Google has fallen short of effective compliance with the Digital Markets Act, and today we have taken decisive yet balanced enforcement action sanctioning these breaches,” said Teresa Ribera, Commission executive vice-president for clean, just and competitive transition. “The best products should succeed because they’re better, not because they’re owned by the company running the search engine.”

Henna Virkkunen, Commission executive vice-president for tech sovereignty, security and democracy, put the finding in business terms. “We found that Google harms businesses offering similar services, such as shopping or sports, by not granting them the same level of prominence on Google Search,” she said.

A note on the addressee before going further. The announcement names “Google” throughout and does not identify the legal entity fined. The proceedings the Commission opened on March 25, 2024, named Alphabet. Where this article uses Alphabet’s consolidated revenue to size the escalation exposure, it is using the parent’s reported figures against a decision whose formal addressee the Commission has not published.

Correcting the record on what came first

One framing circulating since the decisions were announced deserves correction before it hardens. These are not the first financial penalties in DMA history. The Commission fined Apple €500 million and Meta €200 million on April 23, 2025, in the first non-compliance decisions issued under the regulation. Apple’s rested on the Article 5(4) anti-steering obligation; Meta’s rested on Article 5(2), which governs consent for combining personal data across services.

Nor is €890 million the largest single DMA fine. Apple’s €500 million penalty still holds that position, and each of the two Google fines announced on July 23 falls below it. Taken together, though, the July 23 decisions constitute the largest combined DMA penalty package imposed on a single gatekeeper to date. The Search decision also appears to be the Commission’s first published DMA non-compliance decision applying the Article 6(5) prohibition on self-preferencing, and that is what changes the compliance question for everyone else. Article 6(5) reaches ranking, indexing and crawling rather than contract terms. Contract language can be revised prospectively. Historical ranking behavior has to be reconstructed from technical and operational records.

What the 60-day clock could cost

The escalation mechanism outruns the headline number. “Google is required to comply with the Commission’s decisions within 60 days, otherwise it risks periodic penalty payments of up to 5% of its total worldwide turnover,” the announcement said. That phrasing compresses the statute. Article 31(1) of the DMA provides that the Commission “may adopt a decision imposing” periodic penalty payments not exceeding “5 % of the average daily worldwide turnover in the preceding financial year per day,” which is a daily accrual rather than a single levy, and which requires a further Commission decision rather than switching on automatically at day 61.

The scale is worth understanding even so. If the Commission later imposed that statutory maximum through a separate decision, and if Alphabet’s consolidated turnover were the applicable base, the arithmetic against fiscal 2025 revenue of $402.8 billion, reported in the company’s fourth-quarter results filed with the Securities and Exchange Commission, produces a ceiling near $55 million per day. Both conditions matter, and the second returns to the addressee question noted above. That figure is a statutory maximum, not a forecast and not an automatic assessment.

Counting 60 calendar days from July 23 produces an expected compliance date of Sept. 21. The Commission did not publish that date, and the announcement does not establish whether formal notification to the company occurred on July 23.

Set against Article 30(1), which permits fines of up to 10 percent of a gatekeeper’s total worldwide turnover in the preceding financial year, and using the same Alphabet-turnover assumption together with an approximate currency conversion, the €890 million total is roughly one fortieth of that ceiling. Ribera called the action balanced. The amount sits far below the statutory maximum, which shows the Commission retained considerable escalation headroom. That distance does not by itself establish that the penalties were proportionate, a judgment that turns on gravity, duration, deterrence and the underlying conduct. Article 30(2) raises the ceiling to 20 percent for a repeated infringement of the same or a similar obligation on the same core platform service within eight years, and the Commission said it weighed “the gravity, duration and recurrence of the breaches” in setting the amounts.

Two years of dialogue and an explicit retention order

For information governance and eDiscovery professionals, the procedural history is the story. The Commission opened both investigations on March 25, 2024, and said at the time that it “intends to conclude these proceedings within 12 months.” It issued preliminary findings on March 19, 2025, and adopted the decisions on July 23, 2026. That is 28 months from opening to decision, against a stated 12-month target.

The preservation question was not left implicit. On the same day it opened the proceedings, the Commission “also adopted orders addressed to Alphabet, Amazon, Apple, Meta, and Microsoft, requiring them to retain documents which might be used to assess their compliance with the DMA obligations.” Five gatekeepers received those orders. The non-compliance proceedings opened that day concerned Alphabet, Apple and Meta; Amazon was subject to separate investigatory steps, and Microsoft was not named in any investigative action. For governance teams, that language turns product configurations, testing records, compliance correspondence and related technical materials into potential regulatory evidence rather than ordinary engineering exhaust.

What filled the 28 months that followed is a records problem. The Commission said Google “exercised its rights of defence by examining in detail all the documents in the two Commission investigation files and comprehensively replying in writing to the Commission’s preliminary findings,” and that the decisions followed “feedback from market participants, and extensive dialogue with Google.”

A gatekeeper proceeding generates two document populations: the regulator’s file, which the company reviews and answers, and the company’s own internal record of every compliance proposal, test and design change offered during the dialogue. Whether either requires a legal hold depends on jurisdiction, notice, the scope of any retention order and counsel’s assessment, and those questions belong to counsel rather than to a news article. What the record does suggest is a multi-year preservation planning horizon, well past the Commission’s stated 12-month target, and one that reaches product telemetry and experiment records alongside the correspondence.

Ranking fairness is now an auditability problem

Article 6(5) does not stop at prohibiting favoritism. It requires gatekeepers to “apply transparent, fair and non-discriminatory conditions to such ranking.” That is an evidentiary standard wearing the clothes of a design rule.

The Commission’s findings show what it looked at: Google “displays its own services more prominently in search results, including at the top of the search results page or by using enhanced visuals and filters, while similar third-party services do not have the same prominence.” Placement, visual treatment and filter availability are all observable from the outside. Demonstrating non-discrimination from the inside is a different exercise, and it draws on artifacts that product organizations may not retain by default: versioned ranking configurations, the experiment records behind layout decisions, and a documented rationale for why a given surface treats first-party and third-party results differently.

Security teams acquire a problem alongside that one. A detailed record of how a ranking system weights its inputs exposes sensitive information about system behavior, and it is an attractive target for insiders, competitors and external attackers. Integrity matters as much as confidentiality here, because a log whose integrity cannot be demonstrated may carry less evidentiary weight when a regulator asks what a system did on a particular date. Access monitoring, integrity controls and defensible provenance are worth extending to ranking-system change logs.

One recommendation for information governance teams, offered as advice rather than as a legal conclusion: attach retention schedules to ranking-system change logs and experiment results now, while the exercise is voluntary and cheap, rather than after a proceeding makes the request retroactive.

AI Overviews move into the compliance perimeter

The most forward-leaning sentence in the announcement drew the least attention. The Commission said it “takes note of Google’s proposals on how it plans to apply the principles of the decision to AI Overviews and AI Mode, on which dialogue will continue in light of today’s decision.”

Generated answer surfaces are now inside the ranking-fairness conversation. Any organization building an AI-mediated results surface, whether a search product, a marketplace or an internal retrieval system feeding a regulated workflow, should read that line as a preview. If a model decides what appears first, the fairness of that decision can become a question someone asks, and the provenance of the retrieval and ranking layer can become part of the answer.

The Commission was careful about what it has and has not blessed. It called Google’s tested changes to free services such as shopping, hotels and flights “substantial progress towards compliance,” and its revised steering terms, rolled out in June, “good progress towards compliance.” Neither phrase is clearance. Both remain under assessment.

Google’s answer and a widening multi-forum record

Google pushed back in a statement published the same day by Kent Walker, its president of global affairs. “This implementation of the DMA continues to break everyday products,” Walker said. Complying, he said, means “having to strip away real-time Search features Europeans love,” and he cited instant pricing and direct availability for hotels, flights and restaurants as examples. He called the outcome “product degradation driven by a small group of self-serving complainants.”

The Commission said Google “may decide to appeal today’s decisions.” As of July 25, no appeal filing had been publicly identified. Any action for annulment would run on its own procedural timetable, which is separate from the 60-day compliance period and computed from notification of the decision rather than from the public announcement.

The DMA penalties are not arriving in isolation, and that is the part US practitioners should sit with. On July 2, three weeks before these decisions, the Court of Justice dismissed the appeal of Google LLC and Alphabet Inc. in Case C-738/22 P and sealed a €4,125,000,000 Android fine, with Alphabet jointly and severally liable for €1,520,605,895. In the United States, Judge Amit Mehta’s remedies opinion of Sept. 2, 2025, in Case 1:20-cv-03010 in the District of Columbia held that “Google will have to make available to Qualified Competitors certain search index and user-interaction data, though not ads data,” and barred Google from “entering or maintaining any exclusive contract relating to the distribution of Google Search, Chrome, Google Assistant, and the Gemini app.” The judgment runs six years. Mehta entered final judgment in December 2025, Google filed its notice of appeal on Jan. 16, 2026, and it filed a 100-page opening brief in the D.C. Circuit on May 22.

Set those side by side. One forum has ordered Google to open specified search data to competitors. Another has ordered it to demonstrate that its ranking treated third parties fairly. The legal claims, relevant periods, custodians and production scopes differ, so these are not the same case in two languages. Some technical and evidentiary populations may nonetheless overlap, and records identified in one matter can make related populations more readily identifiable in another, subject to relevance, proportionality, privilege, confidentiality and cross-border transfer restrictions. Cross-border production planning is a live consideration here rather than a theoretical one. The entity question resurfaces inside it: the Court of Justice named Google LLC and Alphabet Inc. as parties, while the Commission’s DMA announcement names neither.

Advocacy and complainant-side voices pushed the other way on the decisions themselves. The European Consumer Organisation, known as BEUC, backed them in a statement headlined “European Commission is right to prevent Google’s anti-steering and self-preferencing practices,” and its director general, Agustín Reyna, said Google’s conduct had restricted consumer choice, according to reporting by Dagens. Thomas Höppner, a competition partner at Hausfeld who has represented complainants against Google in the Shopping, Android, adtech, Privacy Sandbox and News Showcase matters, argued the decisions open the door to a durable improvement in search quality, according to TechPolicy.Press.

Every institutional voice in this account has an identifiable stake: the Commission as enforcer, Google as respondent, BEUC as a consumer advocate, and Höppner as counsel who has acted for complainants against Google. Those interests are disclosed so readers can weigh the competing assessments rather than receive them as neutral testimony.

One point on the arithmetic in circulation. Several outlets headlined the penalties as $1 billion. That is a currency conversion of €890 million, not a separate figure, and it is a penalty Google may still contest rather than money recovered.

Where this lands for practitioners

The compliance-verification burden is the transferable lesson. A gatekeeper that cannot produce the record of how a ranking decision was made, or how a fee was set and for how long it applied, sits in a weaker position than one that simply made a debatable design choice. The Commission’s finding on Play makes this concrete: it said “the level of the steering-related fees charged by Google and the length of the charging period for these fees went beyond what is considered compliant with the DMA.” Both of those are questions of documented policy, not intent.

The DMA already supplies a recurring artifact for that proof. Article 11 requires each designated gatekeeper to give the Commission a detailed report describing the measures it has implemented to comply with Articles 5, 6 and 7 within six months of designation, to publish a non-confidential summary at the same time, and to update both at least annually. The July 23 decisions add a ranking-specific enforcement example against which Article 11 descriptions can be compared with observed product behavior and retained technical records. Anyone preparing or reviewing one of those reports should read the published summaries of the other gatekeepers as a comparison set, then ask whether their own descriptions could be substantiated from retained records rather than restated from memory.

As of July 25, 2026, the Commission lists seven designated gatekeepers and 23 designated core platform services. Each of them now has a worked example of how the Commission builds a case, how long it takes and what it reads.

If a regulator asked your organization to prove that its ranking, retrieval or fee logic treated third parties fairly on a specific date 18 months ago, could you produce the record, or only the result?

News sources

• Commission fines Google €890 million for breaches of the Digital Markets Act (European Commission)
• Our statement on the European Commission’s Search & Play Digital Markets Act (DMA) decision (Google Public Policy)
• Commission finds Apple and Meta in breach of the Digital Markets Act (European Commission)
• Judgment in Case C-738/22 P, Google and Alphabet v Commission (Court of Justice of the European Union)
• Alphabet announces fourth quarter and fiscal year 2025 results (U.S. Securities and Exchange Commission (EDGAR))
• DMA designated gatekeepers (European Commission)
• The high stakes behind the EU’s €890M Google DMA fine (TechPolicy.Press)
• Google weighs appeal, says 890 million euro EU fine kills Search (PPC Land)
• Memorandum opinion on remedies, Case 1:20-cv-03010-APM, Document 1436 (U.S. District Court for the District of Columbia)
• Federal court endorses behavioral remedies, rejects structural relief, in Google search antitrust litigation (Congressional Research Service)
• Google asks appeals court to throw out its entire search monopoly loss (PPC Land)
• Enforcement of the DMA: European Commission imposes first fines under the DMA on Apple and Meta (PwC Legal)
• Expanded billing choice and lower fees on Google Play (Android Developers Blog)
• Commission opens non-compliance investigations against Alphabet, Apple and Meta under the Digital Markets Act (European Commission)
• European Commission is right to prevent Google’s anti-steering and self-preferencing practices (BEUC, The European Consumer Organisation)
• Google fined €890 million by EU and says consumers could pay the price (Dagens)
• Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector, including Articles 5, 6, 11, 30 and 31 (EUR-Lex)

Assisted by GAI and LLM Technologies

Additional reading

• EU rewrites the AI Act’s clock and bans nudification tools in one stroke
• Council clears the AI Act rewrite as the enforcement clock keeps ticking
• Parliament hits pause on high-risk AI rules and bans nudifier apps
• Europe’s AI labeling rules arrive with a voluntary code and a hard deadline
• AI is becoming an advisor, and it is rewriting how buyers find you
• What marketing confidence actually looks like
• When credibility comes first, capability sells itself: The case for news-led marketing
• The one question that reveals whether your marketing plan is actually a plan
• How Prompt Marketing Is Redefining Thought Leadership In The AI Era
• Raising The Age Ceiling: How AI Is Extending Executive Leadership
• Staying Curious: One Practical Defense Against Creative Burnout
• From Longbows To AI: Lessons In Embracing Technology
• 20 Ways Creative Professionals Battle Burnout And Find Fresh Ideas
• 14 Points For Brands To Consider Before Making Sociopolitical Statements

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.