Alone among a thousand: the European Commission's "anonymisation" of Europeans' Google searches is broken

Cybersecurity researcher Lukasz Olejnik reports that he successfully broke the European Commission's anonymisation scheme for Google search data mandated under the Digital Markets Act. The author found that failing to account for browser configuration languages instead of search languages allowed him to isolate individual search records, link search histories beyond the three-query cap, and infer sensitive personal details such as health conditions and political opinions. Open article →