Google search conduct requirements: the CMA’s SMS regime in action
In short: Google search conduct requirements are the CMA’s first behavioural rules on Google’s search business. On 17 June 2026 the CMA imposed Fair Ranking and Data Portability requirements under the Digital Markets, Competition and Consumers Act 2024 strategic market status regime. Google has six and three months respectively to comply.
Almost every UK business that wants to be found online depends on where it ranks in Google search. Until now, those rankings, and any ability to move search data elsewhere, rested on Google’s goodwill rather than on any legal footing. That has changed. The Google search conduct requirements the CMA imposed on 17 June 2026 give businesses an enforceable entitlement to fair ranking and give users a right to port their search data. They are the clearest sign yet of how the UK’s digital markets regime turns a designation into concrete obligations, and of the pace at which the CMA now intends to act.
How strategic market status leads to conduct requirements
The power sits in Part 1 of the Digital Markets, Competition and Consumers Act 2024, which created the strategic market status (SMS) regime and came into force on 1 January 2025. Under section 2, the CMA may designate an undertaking as having SMS in a digital activity where it has substantial and entrenched market power and a position of strategic significance. The CMA designated Google with SMS in general search services on 10 October 2025, the first such designation in the search market.
Designation does not by itself constrain how Google behaves. The operative tool is the conduct requirement. Under section 19, the CMA may require a designated firm to conduct itself in a specified way in relation to the relevant digital activity. It may impose a conduct requirement only where it considers that doing so is proportionate for one or more of three statutory objectives: fair dealing, open choices, and trust and transparency. The requirement must also be of a permitted type listed in section 20, and the CMA must have regard to the likely benefits for consumers. Breach exposes the firm to penalties of up to ten per cent of worldwide turnover. The two requirements imposed on 17 June 2026 are the regime working exactly as Parliament designed it.
What the two Google search conduct requirements actually do
The Fair Ranking requirement responds to a long-standing business complaint: that Google’s ranking is neither predictable nor transparent, that changes arrive without notice, and that there is no effective way to challenge them. Under the requirement, Google must rank organic search results, including in AI Overviews but not sponsored results, using objective and non-discriminatory criteria. It must explain to businesses how ranking works and give advance notice of material changes, and it must run a clear process for businesses to raise and resolve concerns. This maps onto the fair dealing and trust and transparency objectives in section 19. Google has six months to implement it.
The Data Portability requirement is the quieter of the two but it closes a gap with the European Union. It puts Google’s existing voluntary Data Portability Application Programming Interface on a legal footing, so a UK user can authorise a third party to receive their Google search data and build a service on it, such as cashback, tailored offers or personalised recommendations. UK users now have a portability route broadly comparable to the position under Article 6(9) of the EU Digital Markets Act, which obliges designated gatekeepers to provide effective data portability, though the UK has reached that outcome through a bespoke conduct requirement rather than a per-se obligation. This is the open choices objective in practice, and it sits alongside the wider UK push on portability through the Data (Use and Access) Act 2025 smart data schemes. Google has three months to comply.
A sequence, not a single decision
These requirements did not appear in isolation. The CMA consulted on a package of four proposed conduct requirements on 28 January 2026, covering fair ranking, data portability, publisher controls and user choice. It imposed the Publisher requirement on 3 June 2026, in what it described as a world first, letting publishers opt their content out of Google’s AI features such as AI Overviews and requiring clear attribution. The Fair Ranking and Data Portability requirements followed on 17 June 2026. A User Choice requirement remains outstanding, and the CMA has said more activity is expected over the summer.
The wider picture matters too. The CMA has designated Apple and Google with SMS in relation to their mobile platforms, and Google in general search and search advertising. It has launched a fourth SMS investigation, into Microsoft’s business software ecosystem. The Google search work shows the model the CMA will run across all of them: designate, publish a roadmap, consult on targeted requirements, and impose them in tranches rather than in one block. The table below summarises the two requirements imposed on 17 June 2026.
| Requirement | What Google must do | Section 19 objective | Time to comply |
|---|---|---|---|
| Fair Ranking | Rank organic results (including AI Overviews, excluding sponsored results) on objective, non-discriminatory criteria; give transparency and advance notice of material changes; provide a route to raise concerns | Fair dealing; trust and transparency | 6 months |
| Data Portability | Put the voluntary Data Portability API on a legal footing so users can authorise third parties to receive their Google search data | Open choices; fair dealing | 3 months |
What it means for businesses and platform-dependent firms
The compliance burden falls on Google, not on the businesses the rules are meant to help. What changes for UK firms is the bargaining power the requirements create. A business that relies on search visibility now has a stated entitlement to objective ranking, to advance notice of material change, and to a process for raising concerns, where before it had none of these. As AI Overviews and AI Mode reshape how results are presented, that entitlement reaches the AI surface too, which is where the commercial stakes are moving fastest.
For firms whose business models depend on a designated platform, the regime is now a standing feature of the commercial environment rather than a future prospect. Data portability opens a route for third parties to build on Google search data with the certainty their EU counterparts already have. Acquirers and investors looking at platform-dependent targets have a new layer to assess: how exposed is the target to a designated firm’s conduct, and how far do the conduct requirements change that exposure. That assessment belongs in regulatory due diligence on any deal where search discovery, app distribution or platform access drives the value. The same regime is mapped in our guide to what the CMA does and in our analysis of the DMCCA 2024 enforcement trajectory.
Viewpoint
The detail that the market underrates is pace. The CMA designated Google in October 2025, consulted in January 2026, and imposed three of its four proposed conduct requirements across a fortnight in June, the publisher requirement on 3 June and fair ranking and data portability on 17 June. That cadence is deliberate, and it reflects the flexibility the regime gives the CMA to act in tranches and to revisit requirements as search changes. The roadmap the CMA published with the designation signalled ranking transparency, choice architecture and data access as priorities, and that is what has now landed. I would watch the outstanding User Choice requirement, and any move from conduct requirements to a pro-competition intervention, which is the more structural tool the Act provides and the one that can compel deeper change. The UK has chosen a participative, iterative model that diverges from the more codified obligations in the EU Digital Markets Act, and on the evidence of June it is willing to use it quickly. Our fuller account of where the UK and EU regimes meet sits in our note on competition law and data protection convergence.
Frequently asked questions
What is a conduct requirement under the DMCCA 2024?
A conduct requirement is a rule the CMA imposes on a firm designated with strategic market status, setting out how it must behave in a digital activity. Under section 19 of the Digital Markets, Competition and Consumers Act 2024, the CMA may impose one only where it is proportionate for the fair dealing, open choices or trust and transparency objectives, and the requirement must be of a permitted type listed in section 20.
Does the Fair Ranking requirement apply to AI Overviews?
Yes. The Fair Ranking requirement covers organic results including those shown in AI Overviews, but not sponsored results. Google must use objective and non-discriminatory ranking criteria, explain how ranking works, give advance notice of material changes, and provide a route for businesses to raise concerns. Google has six months from 17 June 2026 to implement it.
What does the Data Portability requirement change?
It puts Google’s previously voluntary search-data portability on a legal footing. A UK user can authorise an approved third party to receive their Google search data through Google’s Data Portability API and use it to deliver services such as cashback or personalised offers. The change gives UK users a portability route comparable to the position under Article 6(9) of the EU Digital Markets Act, reached through a bespoke conduct requirement rather than the per-se obligation the DMA imposes. Google has three months to comply.
What happens if Google does not comply?
Breach of a conduct requirement exposes a designated firm to enforcement under the Digital Markets, Competition and Consumers Act 2024, including financial penalties of up to ten per cent of worldwide turnover and remedial directions. The CMA has said it will monitor Google’s compliance closely, including through regular reporting, and may introduce further measures if needed.
For advice on how the Google search conduct requirements affect a platform-dependent business or a transaction involving one, contact Rob Bratby at Bratby Law. We advise on the digital markets regime, regulatory due diligence and platform terms and policies.
