Google Loses €4.7B Android Antitrust Appeal as Privacy and Malware Questions Mount

The Court of Justice of the European Union upheld a four-point-seven billion dollar fine — 4.125 billion euros — against Google this week, concluding an eight-year legal process that began with the European Commission's 2018 ruling. The Commission found that Google illegally required Android device manufacturers to pre-install Google Search and Chrome as a condition of licensing the operating system. The court agreed and upheld the fine in full.

The antitrust argument centers on a distinction that market-share figures alone cannot capture. European competition law does not prohibit dominance; it prohibits using dominance in one market to foreclose competition in another. Google's position was that bundling Chrome and Search with Android licensing was efficient — manufacturers received a free, well-tested OS and Google received distribution. The Commission's position was that this arrangement structurally prevented competing browsers and search engines from reaching consumers on the dominant mobile platform. The court sided with the Commission. Going forward, Google operates Android licensing in Europe under modified rules requiring genuine choice screens, though the Hacker News comment thread debated whether those behavioral remedies have materially shifted competitive dynamics or whether Google's position is sufficiently entrenched that the fine functions as a cost of doing business.

On the malware front, F-Droid — the open-source Android app repository favored by privacy-conscious users as an alternative to Google's Play Store — published an advisory about Android malware that drew 722 points and 287 comments. The comment thread actively debated attribution and whether the phrase 'from Google' in the headline refers to Google's infrastructure being abused or to something else. Modern Android malware increasingly exploits legitimate-looking app updates, Android's accessibility APIs, and supply chain compromises of SDKs that legitimate developers include unknowingly.

Also on the privacy side, Google published an open-sourcing of its zero-knowledge proof technology for age assurance. The mechanism allows a user to prove they satisfy an age condition — over 18, for example — without revealing any underlying personal data. The website learns only that the condition is met. The 168-comment HN thread engaged with both the genuine cryptographic utility and the question of whether Google open-sourcing this is primarily a privacy contribution or primarily a move to make Google's identity services the standard infrastructure for age verification across the web. The thread largely concluded that both things can be true simultaneously.