CMA Forces Google to Open Search Data to UK Third Parties
Executive Summary
The CMA's binding data portability requirement gives UK loyalty platforms, cashback operators, and personalised commerce services legal standing to access user-level Google search history — the highest-signal intent dataset in consumer marketing — without paying auction premiums. Google will fight the ranking transparency rule; the portability obligation is structurally harder to contest. UK commerce and loyalty operators should begin authorised third-party registration the moment CMA publishes technical standards, expected September 2026.
The Signal
The UK Competition and Markets Authority issued two binding conduct requirements against Google Search on June 17, covering ranking transparency and search data portability. On transparency, Google must within six months introduce formal processes for businesses to raise ranking concerns, apply objective and non-discriminatory criteria to organic results including AI Overviews, and provide advance notice before significant ranking changes. On data portability, Google must within three months enable users to transfer their search data to authorised third parties such as rewards platforms and personalised commerce services. The CMA framed both requirements under its designation of Google as a Strategic Market Enterprise — a designation that carries legally enforceable conduct obligations. Google is widely expected to contest the requirements, particularly ranking transparency, which would expose algorithmic logic competitors could reverse-engineer.
What Changed
UK-based businesses and their agencies will, for the first time, have a formal regulatory channel to challenge Google Search ranking decisions that damage their organic visibility — including AI Overviews placements. Simultaneously, authorised third parties gain a legal basis to demand access to user-level Google search data for personalisation and commerce applications, creating a new data input that did not previously exist outside Google's own ecosystem.
Why It Matters
The decisive commercial implication here is not ranking transparency — it's the data portability requirement, and it arrives three months sooner. Search intent data is the highest-signal behavioural dataset in consumer marketing. Google has monetised it almost exclusively through its own advertising products, maintaining a structural information advantage over every retailer, loyalty platform, and personalisation engine that competes for the same consumer attention. The CMA's portability requirement breaks that monopoly open, at least in the UK. Rewards platforms, cashback services, and personalised commerce operators gain legal standing to access user-level search history — the revealed-preference data that tells you what someone wants before they've told anyone else. What becomes newly possible is a class of personalisation product that currently cannot exist outside Google's walled garden: intent-led commerce experiences built on actual search behaviour rather than inferred interest from purchase history or browsing patterns. The loyalty and affiliate sector in particular gets a material upgrade in targeting precision without paying Google's auction premiums to access it. What becomes devalued is Performance Max and broad-match search buying as the default mechanism for capturing intent. If third-party platforms can personalise offers around the same underlying signal, the argument for paying Google to intermediate that connection weakens. The strategic pressure driving this is straightforward: the CMA has watched Google extend its search monopoly into AI Overviews and is moving to ensure the data infrastructure sustaining that monopoly cannot simply be replicated behind a new interface. Regulatory arbitrage is the mechanism — Brussels and Washington are watching whether London's SME regime produces enforceable outcomes or expensive legal delay.
Marketing Impact
media
The data portability requirement creates a structural alternative to buying intent through Google's auction. UK media teams running loyalty-linked or commerce-adjacent campaigns gain a path to access search-intent signals directly via authorised third-party platforms, reducing dependency on Performance Max as the sole mechanism for capturing high-intent audiences.
research
Consumer insights functions gain access to revealed search intent at user level for the first time outside Google's own tooling. This upgrades demand sensing from inferred behavioural proxies to actual pre-purchase query data, sharpening category entry point mapping, trend detection, and audience segmentation with a signal that previously had no third-party access path.
product marketing
Personalised commerce and loyalty product teams can now architect intent-led offer engines built on real search history rather than purchase-pattern inference. For retailers and financial services brands operating rewards programmes, this is a category-level capability shift — the personalisation logic can move upstream of the purchase decision rather than reacting to it.
marketing ops
The ranking transparency requirement introduces a formal grievance mechanism that marketing operations teams should treat as a strategic tool, not a compliance footnote. Advance notice of significant ranking changes means ops teams can build structured monitoring and escalation workflows around a regulatory process rather than relying entirely on third-party algorithm trackers.
The Exploit
Opportunity
UK-based rewards platforms, cashback operators, and personalised commerce services can petition Google for user-level search data access within three months under legally enforceable CMA terms — bypassing Google's ad auction entirely to build intent-led personalisation. First movers who establish authorised third-party status before the portability window opens lock in a data input that Google's ad products currently gate behind auction premiums.
Risk
Google will contest the requirements, creating legal limbo that could stretch 12-18 months. Platforms that build product roadmaps around data availability before portability is technically live risk wasted engineering investment and regulatory disappointment.
The Move
UK commerce and loyalty operators should file for authorised third-party status the moment CMA publishes technical implementation standards — expected by September 2026 — and simultaneously brief engineering leads to scope an intent-signal ingestion layer. The checkpoint: a working data pipeline before Google's first compliance deadline lapses. Owner: Chief Data Officer, not the media team.
First-Mover Advantage
Gains
Platforms that secure authorised status early get first access to revealed search intent at structural cost — no auction premium, no Performance Max dependency. That data advantage compounds into personalisation models competitors cannot replicate without the same access.
Risks
Google will contest the requirements, creating legal limbo that could stretch 12-18 months. Platforms that build product roadmaps around data availability before portability is technically live risk wasted engineering investment and regulatory disappointment.
Window
The advantage window runs until Google implements technically and rivals complete authorisation — likely 12 to 18 months. It closes when portability APIs are standardised and access becomes broadly available to any qualified applicant.
Winners & Losers
Winners↑
Loyalty and rewards platforms
The data portability requirement gives cashback services, affiliate networks, and loyalty operators legal standing to access user-level Google search history in the UK — the highest-signal intent dataset in consumer marketing — without paying Google's auction premiums to act on it. The mechanism is direct: revealed search intent can now feed personalisation engines that previously had to infer consumer desire from downstream purchase signals. These operators should move immediately to register as authorised third parties under the CMA framework and begin building ingestion pipelines before the three-month compliance window closes in mid-September 2026.
Personalised commerce and recommendation services
Intent-led commerce products — personalised travel suggestions, contextual discount delivery, dynamic offer matching — have until now been structurally blocked from the search signal that would make them meaningfully more precise. CMA portability breaks that blockage, at least within UK user bases, enabling a new product category built on actual search behaviour rather than purchase-history inference. The strategic move is to pilot intent-enriched personalisation in the UK market during the compliance window and use demonstrated lift to build the investment case for scaling if equivalent frameworks emerge in the EU or US.
Organic search and SEO-dependent publishers
The ranking transparency requirement creates, for the first time, a formal regulatory mechanism for UK businesses to challenge Google Search ranking decisions — including AI Overviews placements — that suppress organic visibility without recourse. The mechanism is procedural: Google must apply objective and non-discriminatory criteria to organic results and provide advance notice of significant changes, giving affected publishers a documented basis for escalating ranking disputes. Teams with strong technical SEO capabilities are best positioned to exploit the notice window to pre-adapt before algorithm changes take effect rather than react to unexplained traffic drops.
Losers↓
Google Search advertising revenue
The portability requirement directly threatens the structural information monopoly that makes Performance Max and broad-match search buying the default mechanism for accessing consumer intent at scale — if third-party platforms can personalise against the same underlying search signal, the case for paying Google to intermediate that connection erodes. The mechanism is substitution: intent data flowing to loyalty and commerce platforms creates targeting infrastructure that competes with Google's own ad products for the same conversion moment. Google's most defensible response is legal delay — contesting the requirements through the CMA's appeals process and running out the clock on the three-month compliance window.
Performance marketing teams reliant on Performance Max
Performance Max operates as a black box that bundles Google's search intent signal with automated bidding and cross-channel delivery — a bundle whose premium is partly justified by exclusive access to that intent data. If authorised third parties can now build personalisation products on the same signal, performance teams lose the justification for accepting Google's opacity in exchange for reach, and the cost-per-outcome advantage of PMax over more transparent alternatives weakens. The defensive move is to begin building direct data relationships with loyalty and commerce platforms that will emerge as authorised portability recipients, reducing dependency on Google as the sole intermediary between search intent and conversion.
Strategic Outlook
Google will contest the ranking transparency requirement through every available legal channel — the algorithmic exposure risk is existential, not merely commercial. Expect an 18-to-24-month litigation timeline before meaningful compliance, if it comes at all. The data portability requirement is structurally harder to contest because it is user-rights framed, not algorithmic disclosure, making it the more durable of the two obligations. The three-month implementation window means authorised third parties — loyalty platforms, cashback operators, personalised commerce services — should be engineering integrations now rather than waiting for legal clarity. Brussels and Washington are watching the SME regime's enforcement credibility; if the CMA produces binding outcomes on portability while Google delays on transparency, expect both the EU AI Act's search provisions and US DOJ remedies discussions to tighten around data access specifically. The UK becomes a test market for intent-data infrastructure that does not route through Google's auction layer.
Sources
CMA (UK)
Further CMA action to secure a fairer deal for businesses and improve Google search services in UK
Search Engine Journal
Google Must Give Notice Before Significant Ranking Changes via @sejournal, @MattGSouthern
Search Engine Journal
Google’s Updated Guidance Now Says It’s “Fine” To Use LLMs.txt For AI SEO via @sejournal, @martinibuster
Search Engine Land
UK CMA orders Google to explain how search results are ranked