Alone among a thousand: the EU "anonymisation" of Google searches is broken

Security researcher Lukasz Olejnik, auditing Google's Digital Markets Act search-data sharing scheme at Google's request starting in October, found the European Commission's anonymisation layer fails, singling out the people behind half a million searches across a few countries in August 2026 alone. The scheme groups queries by day, location, device type and search language but ignores the browser's configured display language, leaving users alone in crowds of up to 2.2 million records — for example, a German searcher with Google displayed in Romanian was the only match among 479,463 records in Bavaria's Oberallgäu district. Olejnik also verified that 85,000 searches remained singled out even after the fallback generalisation to country level, a failure he called "direct, and undeniable" under GDPR singling-out rules.

The European Commission ordered Google to share the search data of all Europeans with other companies, such as AI chatbot makers or search engines. On a high level it's a copy-paste of search queries the user makes in Google search engine, to the recipient, with a kind of "anonymisation" step. I tested that layer on the real Google data hundreds of billions of search records . I broke it. The full report here https://lukaszolejnik.com/reports/alone-in-thousand-final.pdf?ref=blog.lukaszolejnik.com . European Commission issued a Digital Markets Act enforcement order https://ec.europa.eu/competition/digital markets act/cases/202637/DMA 100209 2799.pdf?ref=blog.lukaszolejnik.com to Google. In April I assessed the previous scheme as containing significant privacy and national security risks https://blog.lukaszolejnik.com/the-european-commission-is-turning-google-search-into-a-privacy-and-national-security-risk/ . I did that on my own, without access to data. Later in September this year, Google asked me to audit the scheme and release under the DMA order. I started in October. This report is the result. A crowd of a thousand Users are supposed to be hidden in a crowd of others. Under the EU Commission's scheme, search queries are to be handed in a way to make it impossible to identify individual searches among others. The grouping happens on metadata: day, location for example, Brussels area , device type e.g. desktop, mobile , query language. Data contain the location marker if at least 1,000 signed-in users make a search there on the same day, in the same language and on the same type of device. If not, the district is replaced by the country e.g. "Belgium" , and if that is still too small a group, the search is removed. The Commission argues that this makes users "indistinguishable from each other". I verified this, and found ways to violate these. The problem is that the scheme counts the language users search in, but not the language of your screen - as in, the configured web browser, which is arguably much more persistent than the search language. The dataset has both. But only one is considered in the generalisation scheme. Here is one case from the data. For example, on 1 August, a person in the Liège district of Belgium searched in English on a phone with Google displayed in Filipino, and that search was alone singled out among 92,990 records. There are many more of such singled-out searchers. This is also not only about non-European languages. For example, a German searcher with Google displayed in Romanian was alone among 479,463 records in the Oberallgäu district of Bavaria, a Polish search with Google displayed in Hungarian among 2.2 million in the Kalisz area of Poland, a French search with Google displayed in Italian among 1.7 million in the Eure department of France, and a French search with language display configured in Polish among 125,524 in the Verviers district of Belgium. Of course, the rarer the language of web browser configuration, the higher the risk. European Commission knows this - and noted it in the original decision from July. I made a systematic study on large-scale, for every record of the month August and others in May and other months . In a similar way, I singled out the people behind half a million searches, and that only for few countries over one month of August 2026 . The problem is definitely larger. In context of all the other searches in August made in Belgium, France, Poland, Germany it may look like a small share of 26 billion, but for anonymisation to work it must hold for everyone. The European Data Protection Board confirms this. Singled out means being alone in the crowd. The GDPR confirms that singling out is a way to identify a person. The failure here is direct, and undeniable. Strikingly, even the fallback generalization to the country level did not work, as I verified that the people behind 85,000 searches stayed alone even in their whole country that day. All of this was possible because an identifying signal was not considered an identifier in the anonymisation design. Formally this means that the anonymisation allows record isolation. Three searches European Commission also demands search history being cut in pieces of three. At most three searches should be linked via an ID mini-session ID . The EU Commission says it ran its own experiments, and the pieces cannot be joined. I joined them beyond the three-cap. Using the isolated searchers mentioned previously I joined pieces into more than 200,000 sets longer than three searches just for Germany and only in August. Linking works even better for specialised content. Here is an example synthetic modelled on what the data contains. Imagine a searcher searching for a brain tumour first, the second search query about brain surgery and recovery, the third about a neurosurgeon in a named town. Each piece reveals little, but together they read like a patient file. The EU Commission decision even says that search text is "not like a patient file with a diagnostic in it", because a search may be about someone else. One search? Maybe. But when the same medical condition appears in several joined pieces, this is much more difficult to explain that way. In about one in five of the sets linked via a rare medical value, such as a lab result typed twice, the set contained medical or personal details that no single piece had. A rare medical value also joined searches made on different devices, for example first on a phone and later on a computer. This is formally called linkage. Inference Having demonstrated record isolation and linkage, I also confirm that it is possible to perform inference on the dataset. Inference means learning something about a person that the person never stated. In the example above nobody typed “I have a brain tumour". But the linked searches make it clearer. Especially for the joined queries, linkage provides more information than any other individual search query. Such sensitive information appeared 3-5 times more often in linked searches than in a single mini-session capped at 3 . I used AI at a scale to infer information. I was able to extract information concerning health, religion, political opinions, sex, explicit material interests, and more. These are the categories that the GDPR protects the most. This moves us beyond data protection, and in the national security direction. Ramstein, Mons, Powidz, Poznań, Geneva Privacy is only a part of the problem. The data to be shared covers sensitive geographical areas such as those with military bases, for example in Europe in Ramstein, Mons, Powidz or Poznań, where American and NATO troops live with their families, but also Geneva, where diplomats and policymakers live and work. Around each of these bases, I identified searches that combine signs of military service in the household with health problems, alcohol or drugs, or disciplinary trouble. This may imaginably form a counter-intelligence risk even if most of them did not have a name, but I also did not look for names in this case. These are the personal circumstances that security vetting looks for, because they can be used against a person. In Geneva, searches point to the staff of international organisations and diplomatic missions, and to the people they look up. These are not just random names typed to queries, because the data to be shared identified persons precisely. Finally, I also identified searches coming from a person seriously considering a job at an intelligence agency of an EU country. The details in that particular search, together with public information, narrowed the searcher to a few 3 possible, identified people - instead of the promised crowd of a thousand. The main observations in this case took me a single day. Needless to say, a foreign intelligence agency has more time and resources. Back to square one While the main aims of the Digital Markets Act may be sound, it is not for me to decide here. What I can say, however, is that sharing data in the currently proposed form would be a big problem. In other words, the realisation is not proper. This scheme does not provide anonymity. What would be delivered is personal data. Delivering it as designed would likely constitute a personal data breach on a European scale. This work also proves that the currently proposed European Data Protection Board's guidelines on anonymisation should be amended. Specifically, its draft guidelines on anonymisation are inadequate because they only consider linkage between joining records across separate databases, not inside one. Here, I unambiguously prove that linkage within the same dataset may be a problem, and anonymisation-breaking. Interestingly, the 2014 Working Party 29 predating the GDPR correctly considered this point. I'm not sure what happened in between, but my work is an opportunity to correct course. Anonymisation is a property of the data. So it must be tested in practice. Declaring it in a decision is simply not enough. Full disclosure. Google commissioned and paid for my work, to which I allocated a lot of time. I had full independence. Google did not interfere with my work, and it could check the text only for personal data. Let me just say that I was critical https://blog.lukaszolejnik.com/biggest-privacy-erosion-in-10-years-on-googles-policy-change-towards-fingerprinting/ of some of https://blog.lukaszolejnik.com/google-wont-kill-third-party-cookies-after-all/ Google's actions before https://blog.lukaszolejnik.com/privacy-analysis-of-googles-privacy-sandbox-federated-learning-of-cohorts-leaking-information-about-browsing-in-incognito-mode/ . I raised these risks https://blog.lukaszolejnik.com/the-european-commission-is-turning-google-search-into-a-privacy-and-national-security-risk/ in April, on the draft of this plan, before I had seen any data. Now I have measured this on the final version. It is also clear to me that AI is redefining some assumptions behind years of data protection. This is the reality now, not in the future. In the current case, once such a dataset is released, future techniques can be applied to it, too. Fortunately, the GDPR is prepared for this. It takes into account the development of technology, and the state of the art. In this case, I’m the state of the art. I am an independent researcher and consultant in cybersecurity and privacy. For questions, offers or inquiries: me@lukaszolejnik.com . The full report: Alone among a thousand https://lukaszolejnik.com/reports/alone-in-thousand-final.pdf?ref=blog.lukaszolejnik.com .