When Privacy Law Meets Competition Law: Alphabet's Data Sovereignty Dilemma

Alphabet now faces a regulatory environment in which the greatest expected private cost is not a single GDPR penalty but the interaction of three obligations: historical location-data enforcement, forward-looking data-protection impact assessment duties, and competition remedies that would compel sharing of the very data privacy law makes sensitive ^6,8,13,35,46. The utility-maximizing response is therefore to treat GDPR compliance as a pre-deployment investment in reducing the probability of standalone Article 35 and Article 36 violations, while separately managing the privacy-competition conflict through documented residual-risk assessment rather than broad privacy claims.

The Enforcement Baseline: Large, Ranked, and Slower to Collect Than It Appears

The most corroborated enforcement fact is a €403 million fine by Ireland’s Data Protection Commission for unlawful processing of users’ location data ^35,46, announced on 21 September 2026 ²³ and separately characterized as an Irish GDPR action over historical location-data practices ^3,25. Google’s reported response is that the watchdog’s allegations relate to historical policies ⁴⁵, consistent with a post stating the location data involved was flagged in 2018 ¹⁹. The DPC is Google’s lead supervisory authority in the EU ²³, a role that follows from the location of EU operations in Ireland for most large U.S. technology firms ^21,31. The underlying findings concern Location History and the Location Accuracy setting, where Google failed to demonstrate compliance with lawfulness, fairness, and transparency ^21,31,46, as well as accountability ²¹. The order to bring processing into compliance within six months ²¹ appears in another account as a required overhaul of location-data protocols within six months ¹⁸.

The enforcement context is not a narrow Irish construction: GDPR applies to processing by EU establishments regardless of where the processing occurs ²⁷, to non-EU controllers or processors when processing relates to offering goods or services to people in the EU ²⁷, and to monitoring their behavior there ²⁷. Controllers, processors, and organizations that collect or process relevant data are implicated ²⁷. This wide scope is what makes the DPC action, as lead authority, immediately relevant to Alphabet’s global data practices.

The cash impact, however, is materially lower than the headline suggests. The €403 million penalty is the fourth-largest in DPC history ³⁵ and sits inside a stock of more than €4.5 billion in GDPR fines imposed since 2018 ³⁵, of which only €20 million had been collected ³⁵. The explanation is procedural: most privacy fines are tied up in appeals ⁴⁴, fines must be confirmed in court before they become legally payable ³⁵, and companies can appeal that confirmation ³⁵. The fine is not automatically a final payment ²³, and one analysis explicitly emphasizes that enforcement timeline and the possibility of delayed or limited payment matter more than the headline amount ³⁵. New EDPB fining guidance does not convert every non-compliance finding into a financial penalty ³⁷, and does not change fine amounts ³⁷; its stated aim is consistency in whether a fine applies instead of or alongside other corrections ³⁹.

Even so, the comparative ceiling matters. The three larger penalties named in the comparison are Meta’s €1.2 billion fine in 2023, TikTok’s €530 million fine, and Instagram’s €405 million fine ⁸; GDPR’s most serious ceiling remains up to €20 million or 4% of global turnover, whichever is higher ³⁶. The DPC imposed €530.7 million in fines during 2025 ³⁵, indicating continued pace rather than a pause. Alphabet is also appealing a reported €3.0 billion European ad-tech fine ²⁴, and separate coverage notes an EC fine of $3.5 billion in the third quarter of 2025 ³³. The enforcement stock, therefore, is not a one-time charge but an extended legal overhang on the timing or level of cash flows ³⁴.

The Forward-Looking Control: DPIA as a Standalone Liability Gate

The second and operationally more important layer is that GDPR treats the Data Protection Impact Assessment as a pre-deployment control whose violation can be charged separately from the underlying processing harm. Article 35 requires a DPIA before processing likely to produce high risk to rights and freedoms ^1,38, and the controller owns that obligation and bears primary liability ³⁸; the processor supplies technical documentation and processing details ³⁸. Alphabet’s strategic position is made concrete by the September 2024 inquiry into whether Google complied with GDPR, particularly the DPIA obligation ^8,46.

The trigger structure is both narrow in text and broad in application to AI. Three categories are always mandatory: systematic and extensive profiling with significant effects ³⁸, large-scale special-category processing ³⁸, and systematic monitoring of publicly accessible areas ³⁸. For AI, the two-of-nine EDPB rule of thumb creates a presumptive assessment duty once multiple criteria are present ³⁸; sensitivity under Article 9 is one such criterion, exemplified by health AI, HR platforms with disability data, and biometric identification ³⁸. Training automated decision systems with personal data for high-stakes purposes or biometric matching also triggers assessment ²⁶, as does selling or sharing personal information, including via tracking pixels ²⁶.

The control regime is binary and non-retroactive, which is exactly where exposure crystallizes. A DPIA must begin before deployment ³⁸; a retroactive DPIA does not satisfy Article 35 ³⁸, and post-deployment DPIAs are identified as a common 2024–2026 enforcement failure ³⁸. A seven-step process is claimed to satisfy Article 35(7) and EU AI Act Article 26 deployer documentation ³⁸, with necessity and proportionality under Article 35(7)(b) mandatory and to be documented rather than assumed ³⁸. AI-specific DPIAs must assess training-data contamination ³⁸; standard templates are said to miss AI risks ³⁸ and to omit five AI-specific risks ³⁸. The DPO dimension is not optional: Article 35(2) mandates DPO consultation ³⁸, the DPO should be involved when AI processes personal data ⁴⁰, and the DPO’s duties include advising whether a DPIA is required and reviewing methodology ³⁸.

Maintenance and prior consultation convert the DPIA into a continuous, governed process rather than a project artifact. The completed DPIA must be retained ³⁸ and updated under Article 35(11) when risks change ³⁸, with review required on meaningful risk change ³⁸. New data sources can trigger review ³⁸, and new-activity assessments must be completed before data flows ²⁶ and revisited after meaningful change ²⁶. When high residual risk remains, Article 36 requires prior consultation before deployment ³⁸; deploying without it is a standalone violation ³⁸, characterized as such in addition to the underlying risk ³⁸ and unconditional when residual risk is high ³⁸. Documenting high residual risk and then deploying without consultation is evidence of a knowing violation ³⁸.

The Strategic Collision: Search-Data Sharing and the Privacy-Competition Divide

The forward-looking DPIA burden interacts directly with a competition remedy over proprietary data. The most corroborated claim in this strand is that the EU order could require Google to share search data with AI rivals ^6,13. Google argues that the measures would undermine privacy protections for European users ⁶, that the orders cause irreversible harm to European users’ privacy ^5,6, and that Digital Markets Act requirements threaten user privacy and security ²⁸. The sensitivity of the data makes this more than a technical transfer: the EDPB made 33 comments in a letter dated May 5 ¹⁷ and described rivals’ click data as “highly unique” ^16,17. The appeal’s legal detail remains undisclosed ¹⁵, while critics and a legal service warn that the proposed approach may violate EU law ²². Brussels insists that safeguards addressing device integrity and security are already incorporated ^4,6,12,14, and DuckDuckGo is reported to support the Commission’s approach ^4,6,30.

The same enforcement surface is widening through follow-on private claims. A damages action is described as the first private claim following the €2.95 billion fine imposed on Google in September 2025 ¹¹, with Sweden’s Ena Media Group named ¹¹ and publishers from Hungary, Finland, Poland, Estonia, and Lithuania participating ¹¹. This suggests that a single Commission or DPC decision can generate a multi-country claimant base, multiplying expected liability beyond the administrative fine.

Governance and Trust: The Revenue Channel Beyond Fines

What elevates these enforcement facts from compliance cost to strategy is the alleged link to user trust and advertising economics. A complaint argues that legal, regulatory, and reputational risks related to personal-data collection are material because they could reduce user trust, user engagement, and advertising revenue ⁹. The pleaded risk inventory includes loss of user trust and engagement ⁹, further fines, penalties, class actions, and legal expenses ⁹, restrictions on data practices and products ⁹, reputational damage ⁹, and possible harm to revenue, financial condition, and operating results ⁹. Board-level allegations—that the board was repeatedly alerted to potentially unlawful practices and conflicts with commitments ⁷, through fines and shareholder proposals ⁷, and did not require meaningful corrective measures ⁷, with materials revealing scant board-level consideration of significant privacy issues ⁷ and at least half of the Demand Board members lacking independence ⁷—frame this as an oversight failure rather than an isolated operational incident.

At the ecosystem level, the current controls are not fit for agentic AI. Four sources support the finding that 60% of employees felt pressure to use AI with sensitive or confidential information even when unsure whether it was permitted ^20,42, and two sources corroborate that 87% of IT and security respondents experienced or suspected an incident in which an AI tool or agent accessed sensitive information beyond what its task required ^20,42. Only 36% say they can always trace a sensitive access event back to a human authorizer ²⁰, and only 16% of organizations report high confidence in detecting an agent-specific threat ³². These figures define an incident class that users and enterprise buyers increasingly expect platforms to control; for Alphabet, which operates the Android, Play, and advertising-ID footprint where consented advertising IDs are the compliance precondition ²⁹, the gap is directly strategic.

The demand-side incentive is quantified. A Google/Ipsos study of 16,000 people found that 49% said a positive privacy experience with a second-choice brand would lead them to switch from their first-choice brand ⁹. In the most recent app ecosystem measurement, a December 2026 appraisal of 174 mobile pharmacy apps using a 38-indicator framework ² found mean privacy-policy compliance of only 67.30% ², with the sharpest failures in storage, sensitive-storage rules, cross-border transmission, and portability: 56.01% ², 27.59% ², 43.1% ², and 33.91% ², respectively. Collection transparency was comparatively strong at 86.53% ², but that contrast implies the differentiation opportunity is not another disclosure layer; it is demonstrable lifecycle control where competitors are weakest.

The Rational Compliance Posture for Alphabet

The bottom line for Alphabet is that the cost-minimizing posture has three components. First, treat AI data practices—profiling, special-category scale, monitoring, new data sources, and training-data risks—as presumptive DPIA triggers with owned review on meaningful change ³⁸. Second, maintain pre-deployment DPIA discipline with DPO review, retained records, and Article 36 consultation where high residual risk remains; retroactive or template-only assessments and deployment without consultation are treated as standalone violations ³⁸. Third, remap GDPR baselines for each additional regime rather than assuming automatic carryover; the DPDP’s closed lawful-basis list and no-threshold breach rules differ operationally from the legitimate-interest and risk-based GDPR approach ³⁶, and regimes such as the revised Swiss FADP and ADGM/DIFC impose their own assessment and documentation demands ^41,43.

That architecture does not eliminate the privacy-competition collision, but it reduces the surface on which future fines, governance claims, and trust defection can attach. The expected cost of non-compliance is not the headline €403 million but the probability-weighted stream of delayed payments, appeal costs, follow-on damages, and board-level liability; the optimal compliance investment should be allocated to the controls that reduce the highest-probability standalone violations, not to the largest nominal fine. With Brussels claiming safeguards are already incorporated ^12,14 and Google’s appeal theory undisclosed ¹⁵, the rational approach is to make privacy lifecycle controls independently demonstrable rather than to rely on privacy as a rhetorical shield. Given that 73% of Americans reportedly believe technology companies have failed to prevent societal harm ¹⁰, a privacy defense is only as valuable as the audit trail behind it.