The CMA Just Told Google to Open Up
Here's a move that actually matters for anyone running a business in the UK: on 17 June 2026, the Competition and Markets Authority served Google with two conduct requirements that fundamentally change how the search giant operates in British markets. Not a fine. Not a threat. Actual, enforceable rules.
The first one? Google has to rank organic search results using objective, non-discriminatory criteria. The second? Users can now port their search data to authorised third-party services — think rewards platforms, personalised recommendation engines, discount-code aggregators. You connect your Google account, you explicitly authorise the transfer via Google's Data Portability API, and boom — your data moves.
This isn't theoretical. The timelines are real: three months for data portability, six months for fair ranking. Google's already been designated with Strategic Market Status (SMS) for general search and search advertising in the UK, which is what gives the CMA this power in the first place.
Let's break down what each requirement actually means, because the implications run deeper than most headlines suggest.
How the Fair Ranking Requirement Works
Google's organic search rankings have always been a black box. Businesses pour money into SEO, chase algorithm updates, lose sleep over ranking drops — and the CMA heard enough complaints to act.
Under the new conduct requirement, Google must rank organic results using criteria that are both objective and non-discriminatory. That's the legal language. In practice, it means the search giant can't quietly tweak its ranking signals in ways that favour its own services or disadvantage competitors without explanation.
Here's where it gets interesting for AI Overviews. Yes, the CMA specifically called out that AI-generated summary results at the top of search pages fall under this requirement. No, sponsored and paid ad results don't — those remain in a different regulatory lane.
But the transparency obligations go further than just "use fair criteria." Google now has to:
- Give advance notice before making significant ranking changes
- Provide clearer documentation about how its ranking systems actually work
- Establish formal processes for businesses to raise concerns when they suspect unfair treatment
That last point alone is huge. UK businesses have been complaining for years that Google's ranking practices lack transparency, with changes rolled out without sufficient notice and no effective mechanism to push back. The CMA is essentially saying: build the complaint system, or we will.
The six-month implementation window starts ticking now. That's tight, especially when you consider how deeply embedded Google's ranking infrastructure is.
Data Portability: What Users Actually Get
The second conduct requirement is where this gets personal. Google must now allow users to port their search data to authorised third parties.
Here's how it works in practice: you sign up for a rewards platform, a personalised recommendation service, or a discount-code company that's been authorised by the CMA. You connect your Google account through their interface. You explicitly authorise the data transfer via Google's Data Portability API. The data moves.
This isn't about scraping. It's a structured, user-initiated transfer with clear consent mechanisms. You control what leaves your account. The third party gets what it needs to deliver its service. Google can't block it.
The parallel with the EU's Digital Markets Act is worth noting. Under DMA, European users already have data portability rights for certain Google services. This CMA order brings UK users to parity. Same rights, different jurisdiction, same outcome.
For the authorised third parties — rewards platforms, recommendation engines, discount aggregators — this is a competitive equalizer. They can now offer personalised experiences built on real user search history without having to build that data from scratch or rely on less accurate proxies.
For users? It's about choice. If a rewards platform can show you better deals because it knows your search patterns, why shouldn't you be able to opt in? The CMA's framing is clear: data portability isn't a security risk when done right. It's a competition tool.
Timelines, Enforcement, and What Comes Next
The implementation deadlines are non-negotiable. Three months for data portability. Six months for fair ranking. The CMA will monitor compliance through regular reporting requirements — Google can't just implement the letter of the rules and miss the spirit.
This isn't the CMA's first rodeo with Google. The Strategic Market Status designation for general search and search advertising gave them the legal authority to impose these conduct requirements in the first place. And this order builds on earlier action: back in early June 2026, the CMA gave publishers tools to control whether their content gets used to power Google's AI features. That was an opt-out for AI Search. This is broader.
The CMA has been explicit about what comes next. They expect more activity over the summer. If Google implements these requirements half-heartedly, or if new issues emerge, further measures are on the table. The tone from the regulator is clear: this is step one, not step five.
For Google, the message is unambiguous. The UK market matters enough that the CMA will keep pushing until the rules work as intended. And given the SMS designation, Google has limited options for resistance.
Why This Matters Beyond the Headlines
Let's be honest about why this story matters. It's not just about Google vs. a regulator. It's about the fundamental question of who controls the digital infrastructure that businesses and consumers rely on.
UK businesses depend on Google search to reach customers. That's not a debate. But the ranking practices that govern visibility have been opaque, inconsistent, and frustratingly unaccountable. The CMA's fair ranking requirement is a direct response to years of complaints from businesses that feel at the mercy of algorithmic changes they can't see, question, or influence.
The data portability angle is equally significant. For years, user data has been locked inside walled gardens — Google, Meta, Amazon — with good privacy reasons but bad competitive ones. Portability requirements force those walls to have doors. Not wide open. But open enough that users can actually exercise choice.
The EU parallel matters too. When the UK and EU move in lockstep on digital platform regulation, it creates a de facto standard. Google can't play jurisdictions against each other as easily when the rules are aligned. That's good for regulators, bad for platforms that relied on regulatory arbitrage.
This is what digital competition policy looks like in 2026. Not fines after the fact. Forward-looking conduct requirements that reshape how markets operate.