EU orders Google to stop favouring its own travel and shopping results
The European Commission fined Alphabet €460 million on July 23, 2026, for self-preferencing in Google Search results for hotels, flights, transport and shopping, and ordered the company to make third-party listings "fair and non-discriminatory" within roughly 60 days, by about September 12, 2026. The Commission said "Google gives preferential treatment to its own services … over those of third parties in Google Search." Google Hotels and Google Flights compete directly with online travel agencies, metasearch sites and supplier-direct listings for booking traffic. EU Travel Tech, whose members include Booking.com, Expedia, Airbnb, Skyscanner, Amadeus and Travelport, had argued that Google's earlier DMA compliance tweaks still left its own modules prominently placed at the top of results.
Second fine targets Google Play developer steering
Alongside the search ruling, the Commission imposed a separate €430 million fine on July 23, 2026, for practices that make it harder for app developers to direct users toward cheaper options outside Google Play, bringing the combined penalties to €890 million. Google now faces a single compliance clock covering both findings. President of global affairs Kent Walker said the company is "having to strip away real-time search features Europeans love — like instant pricing and direct availability for hotels, flights and restaurants — and dismantle safety protections on Google Play," and indicated Google may appeal the decisions. The order currently applies only to Google's EU search results, so travel suppliers and advisors outside Europe will not see immediate changes.
Booking-flow data suggests winners may shift rather than broaden
Industry data already shows that Google's previous DMA-driven redesigns have changed where EU bookings go. Mirai's review of more than 3,000 properties found that after Google's first DMA changes in January 2024, Google Hotels' share of EU direct bookings dropped. A more recent assessment of Google's updated layout suggests it now leans toward large intermediaries such as Booking.com over individual hotels, meaning the EU-mandated adjustments could route more traffic to online travel agencies rather than levelling the field for suppliers. Whether the new 60-day fix produces a more even distribution remains uncertain.
Google Threat Intelligence Group consolidates threat-actor naming
Google Threat Intelligence Group (GTIG) introduced a new two-word naming scheme for the threat actors it tracks, consolidating separate systems previously run by Mandiant and Google's Threat Analysis Group (TAG), which merged into GTIG. Each tracked actor now receives a cryptonym with a first word identifying the specific group and a second word indicating its category: CASTLE for People's Republic of China-linked groups, ION for Iran-linked groups, NEPTUNE for North Korean groups, RELIC for Russian groups, and COMET for cybercriminal groups. The Russian state-linked group long known as Sandworm, or APT44, now carries the cryptonym SANDWORM RELIC. Existing names will remain searchable as aliases alongside MITRE ATT&CK mappings.
Video-selfie authentication prompts privacy and deepfake concerns
Google has begun letting users upload a "video selfie" for account login and recovery, comparing new clips against an enrolled reference video. PCWorld recommended a wait-and-see approach, citing two concerns: rapid advances in AI-driven deepfakes that could defeat such checks, and Google's note that it may use video selfies to help train AI for facial recognition and age estimation where permitted. Google said it has protections against presentation attacks and is "constantly adapting to new threats to improve security across our products." PCWorld advised users to continue relying on established methods such as passkeys until clearer rules emerge around biometric data.
Share this article
