On 16 July, the European Commission handed Google an order that changes what your Android phone lets an app see and hear. From the next major release of the system, Android 18, and by 1 August 2027 at the latest, the company will have to give rival artificial intelligence assistants the same reach into the device it currently reserves for its own Gemini: the camera, the microphone, whatever is on the screen, a wake word that fires even with the display off, and the ability to drive other apps by imitating taps.
The intention is good, and it is worth saying so plainly. For years Google designed Android so that Gemini reached these capabilities with an ease it denied to rivals, and forcing it to level the field is the legitimate aim of the Digital Markets Act (the DMA, the European law that curbs the abuses of the largest platforms). The problem is not competition. It sits in the bill that comes with it, written this time in security, and you are the one who pays it.
What Google has to open
In all, eleven Android features become available to other assistants, from voice invocation in the style of "Hey Google" to reading what is on the screen and carrying out tasks inside other apps on your behalf, such as booking a taxi or drafting a reply to a message. Six of these features open with no certification at all. The other five require the assistant to be certified by independent authorities, free of charge.
One clause shifts the whole balance: Google is barred from demanding higher security and integrity standards from competitors than it applies to itself. The company itself warned about the risk. Kent Walker, Google's head of global affairs and chief legal officer, said the decision "threatens device security by granting external apps sensitive and powerful device permissions," noting that phone makers currently vet who gets that access. There is an obvious commercial interest here, Google does not want to lose its walled garden, but the interest does not make the warning false.
The access has already been attacked once
And the fear is not abstract. Gemini, which already holds all of this access, was attacked in a demonstration through indirect prompt injection, a technique in which the attacker hides instructions inside seemingly harmless content, in this case a plain notification, so that the assistant carries them out as if they came from you. The security firm that showed it, SafeBreach, did so in exactly the kind of channel these rules will now open to third parties.
At the heart of the decision there is a silent trade. We move from a single gatekeeper, Google, with all its flaws and its conflict of interest, to many gatekeepers of uneven quality, vetted by certifiers we have not even met yet. The most intimate sensor you carry with you, the one that hears your bedroom and sees your face, stops depending on one decision and starts depending on several. More choice for the user is, at the same time, more surface for the attacker.
It is worth knowing that none of this is decided in Lisbon. Digital competition is the exclusive competence of Brussels, so neither the Portuguese government, nor its telecoms regulator, nor parliament can stop or renegotiate the measure. Portugal takes part only in an advisory capacity, through the committee provided for in Article 50 of the DMA, with no right of veto. What will change on your phone was decided above your border, and it reaches your home when Android 18 arrives.
How to protect yourself
While the change is still coming, and above all once it arrives, some habits still hold:
- Review the camera and microphone permissions of your apps, and revoke access from anything that does not truly need it.
- When a new artificial intelligence assistant asks you to make it the default, treat that request as you would the installation of a new program, not as a formality.
- Be wary of assistants that insist on always running in the background or with the screen off, because that is where access goes unnoticed.
- Keep the system updated, since it is Android that enforces the limits each app has to respect.
Europe has just given you more choice over who answers when you say "assistant." What no one will ask you out loud is the second half of the decision, which is deciding whom you now trust with the camera, the microphone and everything that appears on your screen.
Sources: The Hacker News, European Commission.
#StaySafe
🙏🖖
