Introduction
You are an analyst in an investment bank conducting research on stock performance in Nigeria. You ask a question on Google’s search engine. A Nigerian newspaper’s reporting supplies the answer, which appears as a summary at the top of the results page. Your question is resolved without having to click on the newspaper’s site. The newspaper’s content has been crawled, ingested and used to generate a substitute for itself, without consent, attribution or payment, and the newspaper cannot refuse the crawl without disappearing from search altogether.
Between December 2025 and July 2026, four competition authorities acted on that sequence of events. On 9 December 2025 the European Commission opened a case against Google and Alphabet under Article 102 TFEU. [1] On 23 April 2026 the Tribunal of Brazil’s Conselho Administrativo de Defesa Econômica (“CADE”) unanimously approved the opening of an administrative proceeding into Google’s use of journalistic content. [2] On 3 June 2026 the United Kingdom’s Competition and Markets Authority (“CMA”), having designated Google with Strategic Market Status (“SMS”) in general search, imposed a Publisher Conduct Requirement (the “Publisher CR”) entitling publishers to withhold their content from Google’s generative artificial intelligence (“AI”) features and obliging Google to attribute what it does use. [3] On 6 July 2026 Nigeria’s Federal Competition and Consumer Protection Commission (“FCCPC”) announced an investigation into Meta, Alphabet, X and unnamed generative AI platforms, following a petition from the Nigerian Press Organisation (“NPO”) and a directive from the President. [4] In under eight months, the same theory of harm reached four jurisdictions, however, the capacity to act on it did not travel with it.
This article argues that the diffusion of digital competition remedies is governed by three conditions that, unlike the merits of the theory of harm, do not travel easily: (i) a jurisdictional hook able to reach a firm with no local office and no local turnover; (ii) institutional capacity to run an evidence-heavy case against a well-resourced respondent; and (iii) market leverage, meaning a credible expectation that the firm would rather comply than absorb the penalty, restrict the product by territory or withdraw it.
The article then turns to what Google has actually built. Google has built the controls the CMA required and, on its own account, has made them available to every website in the world. If the effect of those controls is global, publishers in jurisdictions whose regulators could never have obtained them are protected anyway, and those regulators are rational free riders. If the effect stops at the United Kingdom’s border, the enforcement gap compounds.
The question, then, is whether the remedy travels with the theory of harm and, if it does, who decides its content.
The conduct and the theory of harm
When a search is conducted on Google, an AI overview converts the search engine from a referral mechanism into an answer mechanism. The European Commission’s opening notice describes the practice as Google’s use of “publishers’ web content to generate AI Overviews and AI Mode summaries on Google Search”. [5] CADE’s release describes “the automated collection of journalistic content available on the web”, followed by features “based on generative artificial intelligence, capable of synthesising information directly within the search interface”. [6] The FCCPC’s statement lists “unauthorised extraction, scraping, ingestion, or commercial utilisation” of media content among the three areas under investigation. [7] The CMA’s SMS final decision brought AI Overviews and AI Mode within the scope of the designated activity, while leaving the Gemini assistant outside it “at this point in time”. [8]
The cases and investigations also describe the same absence of choice. The European Commission’s press release puts it most directly when it states that Google is said to have used publisher content “without the possibility for publishers to refuse without losing access to Google Search”. [9] Crawling is the price of visibility, so a publisher’s consent is formally given and practically compelled. CADE reaches the same point through a different concept, observing that the relationship “could take on the characteristics of structural dependence”. [10] The CMA reached it by designating Google in general search first and regulating the AI features as an extension of that position, which is why its remedy addresses controls rather than consent.
The harm runs in two directions. First, publishers supply the content and cannot refuse to supply it. Second, rival AI developers cannot get the same content on the terms Google gives itself. The European Commission’s press release alleges that Google placed “developers of rival AI models at a disadvantage” by “granting itself privileged access to such content”, and that “rival developers of AI models are barred by YouTube policies”. [11] The formal notice of initiation lists two practices and does not mention rival AI developers, self-preferencing or privileged access. [12] So the European Commission has formally alleged only two things: Google’s use of publishers’ web content to generate AI Overviews and AI Mode summaries, and the collection and use of creators’ video content from YouTube to train its generative AI models. It has not alleged that Google disadvantaged rival AI developers by granting itself privileged access, or that those developers are barred by YouTube policies. That second theory of harm is addressed by none of the instruments discussed below. It is, however, the theory on which the European Commission has moved fastest elsewhere. In Case AT.41034, against Meta, it alleged and then enjoined on an interim basis the exclusion of rival general-purpose AI assistants from a dominant firm’s distribution channel. That case is taken up below, because it supplies a controlled test of the three conditions this article sets out. [13]
It is easy to think that this is simply a copyright issue. But beyond the copying, the terms on which the copying occurred were dictated by a firm whose position made refusal impossible, and what Google produces from the content displaces the content itself: the reader who gets the summary does not visit the article. That makes it a competition problem as well as a copyright problem.
The United Kingdom and the CMA
The CMA launched its investigation into Google’s general search and search advertising services on 14 January 2025, published a proposed decision on 24 June 2025, and designated Google with SMS on 10 October 2025. [14] Alongside the proposed decision it published a roadmap sorting candidate measures into categories, with “Ensuring publishers have effective transparency, attribution and choice in how their content” is used placed in Category 1 and “Fair and reasonable terms in relation to use of publisher content” held back to Category 2. [15] It consulted on the proposed conduct requirements between 28 January and 25 February 2026, and imposed the Publisher CR on 3 June 2026. [16]
The Publisher CR lets publishers withhold their Search Content from the training and grounding of Google’s AI, both in search and in Google’s other generative AI products. [17] Google must not attempt to work around a publisher’s decision to withhold its Search Content, and the Interpretative Notes make it clear that this includes knowingly paying someone else to crawl a site that has opted out. [18] Google has to explain publicly how it uses content and what the controls actually do, give publishers clear and detailed figures on how users engage with their Search Content, and take reasonable steps to make sure content appearing in AI search features is clearly attributed. [19] It must also publish an explanation of the steps it takes to “ensure and measure the factuality” of those features — a transparency duty about accuracy rather than a duty to be accurate, though an unusual subject for a competition authority even so — and the Interpretative Notes indicate that the engagement metrics should be given for each publisher and delivered through a commonly accessible platform such as Google Search Console. [20] Google cannot try to stop publishers from using the controls or punish them for doing so, including by pushing them down the rankings or costing them features like snippets. [21]
The Publisher CR also leaves things out. There is no payment obligation, no fair-terms obligation and no arbitration backstop. “Fair and reasonable terms in relation to use of publisher content” sat in Category 2 of the roadmap and stayed there, [22] and the final decision commits the CMA only to bringing forward work on further measures “if needed”, in language about “a fair exchange of value” rather than about terms. [23] Nothing since has changed that. The CMA imposed a fair ranking conduct requirement and a data portability conduct requirement on 17 June 2026 and consulted again on a user choice conduct requirement between 23 September and 9 October 2026. None of the four addresses terms or payment. [24] The remedy imposed in London, and the remedy this article asks whether others can borrow, is a control and a disclosure duty. The controls reach “broader generative AI services”, defined as Google’s generative AI-dependent products and services offered outside general search, even though the SMS final decision left the Gemini assistant outside the designated activity. [25][26]
The Publisher CR comes into effect on 3 December 2026 [27] and remains in force until 10 October 2030, [28] with Google’s first compliance report, covering 3 June to 3 December 2026, due on 3 January 2027, a second six-month report covering 4 December 2026 to 3 June 2027 due on 3 July 2027, and annual reports thereafter. [29] As at the date of this article it is not yet in force, and nothing Google has shipped since June 2026 is compliance with it. Nor is it straightforwardly the CMA’s achievement: the final decision records that Google had announced it was developing updates to its controls to let publishers opt out of generative AI features in Search, citing Google’s own response to the consultation of 18 March 2026. [30]
The European Union, the TFEU and the EEA
The European Commission’s case was opened on 9 December 2025 under Article 102 of the Treaty on the Functioning of the European Union (“TFEU”) and Article 54 of the European Economic Area (EEA) Agreement, procedurally under Article 11(6) of Regulation 1/2003 and Article 2(1) of Regulation 773/2004, against Google and Alphabet. [31][32] The notice records two practices: (i) the use of publishers’ web content to generate AI Overviews and AI Mode summaries, and (ii) the collection and use of creators’ video content uploaded on YouTube “to train Google’s generative artificial intelligence models”. [33] The European Publishers Council filed a formal Article 102 complaint on the same conduct on 10 February 2026. [34]
The contrast with the UK route is procedural. The CMA had only to designate Google in general search, which it did on the strength of market-wide evidence, and could then impose forward-looking conduct requirements without proving an abuse. The European Commission must establish dominance and abuse to the standard of an infringement decision, with the respondent’s rights of defence attached at each stage. As at the date of this article there is no statement of objections, commitments offer or interim measure on the public record, more than ten months after the case was opened. [35] However, in Case AT.41034 — a different case, brought against Meta rather than Google and concerned with access to a messaging interface rather than with publisher content — the Commission issued a statement of objections sixty-seven days after opening proceedings, and imposed interim measures one hundred and eighty-seven days after opening them. [36] That case is taken up below. The difference lies in the conduct and the evidence it requires.
The EU also splits competition and consumer enforcement across different instruments and institutions, so that the unfair-terms characterisation of the same conduct would run through the Unfair Contract Terms Directive, the Unfair Commercial Practices Directive, the Consumer Protection Cooperation Regulation and the Platform-to-Business Regulation rather than through Article 102 TFEU. [37] The European Commission proceeded under Article 102 rather than under the Digital Markets Act, without stating why. [38]
Brazil’s administrative inquiry
Brazil’s administrative inquiry dates from 2019. The Superintendência-Geral (“SG”) found a lack of evidence of an antitrust violation by Google and recommended that the case be dismissed. [39] The Tribunal took the matter up instead, and on 23 April 2026 it voted unanimously to return the matter to the SG with an instruction to open an administrative proceeding into Google’s use of journalistic content, which the SG did on 8 May 2026, giving Google thirty days to file its defence. [40][41]
What distinguishes CADE is its willingness to act on thin statutory hooks. It ordered notification of a below-threshold transaction under Article 88 § 7 of Law 12.529/2011, [42] requiring Microsoft to notify its arrangement with Inflection AI. [43] The SG has also granted interim relief. On 12 January 2026 it imposed a preventive measure on Meta, suspending new WhatsApp terms on AI; a federal court stayed the measure on 21 January, and the Tribunal upheld it on 4 March. [44]
Nigeria and the FCCPC
The FCCPC’s investigation involving Meta, Alphabet, X (formerly Twitter) and certain generative AI platforms covers market dominance and potential anti-competitive conduct in the form of “unauthorised extraction, scraping, ingestion, or commercial utilisation” of media content, and a lack of equitable commercial engagement. [45]
The investigation follows a joint petition to the Presidency by the Nigerian Press Organisation (“NPO”) and a directive from President Bola Ahmed Tinubu to the FCCPC. [46] The statement alleges that publishers have been “denied meaningful opportunities to negotiate fair compensation”. [47] Nigerian practitioner commentary made the same point within days: the investigation “does not automatically create an immediate right to payment”. [48]
This is not the first time the FCCPC has investigated a global platform. Following a joint investigation with the Nigeria Data Protection Commission (“NDPC”), it issued a Final Order against Meta and WhatsApp on 19 July 2024, and on 25 April 2025 the Competition and Consumer Protection Tribunal upheld a penalty of USD 220 million, setting aside only Order 7 of the Final Order. [49] The FCCPC relied on section 104 of the FCCPA and on findings that the companies had “engaged in discriminatory and exploitative practices against Nigerian consumers”. [50] It stated in July 2026 that Meta has appealed, and no appellate outcome has been found. [51] A separate data-protection penalty of USD 32.8 million imposed by the NDPC is a distinct matter and was settled by consent judgment; on the reporting of the terms of that judgment, what Meta agreed to pay was the Commission’s costs of defending the judicial review rather than the penalty. [52] No record of collection of the FCCPC penalty has been found either. Both points bear on an argument developed below: a penalty imposed is not a penalty collected, and a penalty collected is not conduct changed.
The same conduct, four authorities: WhatsApp and rival AI assistants
The four Google matters run on four timetables, under four procedural regimes, against four records of different depth. That makes them an imperfect test of what explains the difference in outcome, because almost everything differs at once. A parallel sequence controls for most of it. There the conduct is a single policy change, by a single firm, announced on one date and applied at the outset without territorial distinction; only the authorities differ, and so do the results.
On 15 October 2025, Meta amended the WhatsApp Business Solution Terms to prohibit “AI Providers”, a category defined in broad and non-exhaustive terms, extendable to similar technologies “as determined by Meta in its sole discretion”, from using the WhatsApp for Business Application Programming Interface (the “API”) where general-purpose AI is the primary rather than an incidental or ancillary functionality. The change bound new providers immediately and providers already on the platform from 15 January 2026. Meta’s own assistant, Meta AI, is integrated into WhatsApp without using the API, and was unaffected. [53]
In Italy, the Autorità Garante della Concorrenza e del Mercato adopted interim measures in case A576 Meta AI at its meeting of 22 December 2025, announcing them on 24 December, and Meta responded by exempting telephone numbers with the Italian country code +39, so that third-party assistants could continue to message Italian users while the ban ran everywhere else. and Meta responded by exempting telephone numbers with the Italian country code +39, so that third-party assistants could continue to message Italian users while the ban ran everywhere else. [54]
The European Commission opened proceedings on 4 December 2025 under Article 102 TFEU and Article 54 of the EEA Agreement, covering the EEA except Italy; issued a statement of objections on 9 February 2026; extended the geographic scope to Italy and issued a supplementary statement of objections on 15 April 2026; and on 9 June 2026 adopted a decision imposing interim measures under Article 8 of Regulation 1/2003. Meta was given five working days to reinstate access on the terms in force before 15 October 2025 and ten working days to report compliance; the measures run for three years from that report or until a final decision on the merits, whichever comes first; and breach carries a periodic penalty of up to 5% of average daily turnover for each day of non-compliance. [55] It is only the second time the Commission has used Article 8 since Regulation 1/2003 came into force, the first being Broadcom in 2019. [56] Meta filed an appeal against the decision at the General Court in August 2026, so the order is in force and under challenge at the same time. [57]
Brazil is described above. Meta carved out Brazilian numbers as it had carved out Italian ones, and nobody else’s, and obtained a judicial stay within days.
COMESA did not act. A complaint was lodged with the CCC on 5 January 2026, and on 17 February 2026 the Commission issued Notice of Investigation 1 of 2026, inviting written representations by 16 March 2026. [58] On 25 March 2026 the head of the CCC said that the concerns had not met the “very high bar” required to warrant interim measures; in May he added that the Commission would not be influenced by the European Commission’s supplementary statement of objections on the same conduct. [59]
Two features of that record bear on what follows. The first is about the firm. Faced with the same obligation in different places, Meta did not generalise. It carved out Italy by country code, then Brazil by country code, and its revised policy of 4 March 2026 priced access per message on a schedule running from EUR 0.0490 to EUR 0.1323 according to the recipient’s country code, expressly, in its own words, “in countries where Meta is legally required to support AI providers usage”. [60] The firm’s compliance documentation keys off whether a given country has an enforceable rule. Where Google’s controls travelled because they ran through machinery that was already global, Meta’s did not travel because the switch was a dialling code.
The Commission also found, prima facie, that the fee Meta substituted for the ban was equivalent to the ban. On its figures, moving a gigabyte of data through the API at Meta’s per-message rate cost in the region of forty thousand times a typical cloud egress charge; the per-message rate was more than seven hundred times the estimated per-message cost of operating the Signal messaging service; and the rate varied almost threefold between EEA countries, which no difference in the cost of delivery explains. [61] A remedy expressed as access, and silent as to price, can be answered with a price.
The second feature is about the authorities. The instrument that restored access, in each place where access was restored, was an interim measure, the AGCM’s, CADE’s and finally the Commission’s. The one change Meta made without being ordered to, the fee, restored nothing. It is cheap relative to an infringement decision, it asks for a prima facie case rather than proof to the standard of a final decision, and it arrives while the market is still contestable. It is also the instrument that the authority with the least leverage declined to use. The power was there: Regulation 32 of the 2025 Regulations lets the Commission make an interim order pending an investigation, and Regulation 9(4)(a) confers the same power in general terms. [62] The CCC did not lack the instrument; it concluded that the threshold for using it was not met.
The payment gap
Every authority has identified compensation as part of the problem. The European Commission’s press release describes Google as having used publisher content “without appropriate compensation to publishers”. [63] The FCCPC’s investigation follows a petition about publishers “denied meaningful opportunities to negotiate fair compensation”. [64] And yet not one of the four creates a payment right. The CMA’s Publisher CR does not; [65] the European Commission’s case is at the stage of allegation; [66] CADE’s output is a further investigation; [67] and the FCCPC’s statement grants no remedy at all. [68]
A regulator with little leverage cannot borrow a payment. It can borrow a control. But publishers can rarely afford to use a control, because switching it on means losing visibility in the search features readers now use to find things. The remedy that spreads is the one that costs the people it was meant to help. There is a converse risk, and Case AT.41034 has now demonstrated it. Where an authority orders access and says nothing about price, the firm may set the price. Less than five months after banning rival assistants outright, Meta readmitted them subject to a per-message fee of its own design; the Commission had to find at the interim stage that the fee was prima facie equivalent to the ban, and to order access on the pre-ban terms under which the messages counted as service messages and were free before the order meant anything. [69] An authority that borrows a control without borrowing the power to say what the control may cost has borrowed less than it thinks.
What makes a remedy bind?
Nigeria’s statutory definition of control follows South Africa’s, enacted twenty years earlier, and Kenya’s follows the same template. Each runs through majority shareholding, voting control, board appointments, holding-company status and trusts, and each ends with a catch-all for anyone else who can materially influence a firm’s policy. [70] Harder to copy is the power to turn a rule into something a firm will actually do. Three conditions decide that, and all three are needed.
A law that reaches the conduct
To be an enforceable remedy, the law must reach a firm with no local office, no local assets and, often, no local turnover.
In Nigeria, section 2(1) provides that, “except as may be indicated otherwise”, the Act applies to all undertakings and all commercial activities “within, or having effect within” Nigeria. [71] Section 2(3) then applies the Act to conduct outside Nigeria by four classes of person. The paragraph usually cited here is (d), which reaches “any person in relation to the acquisition of shares or other assets outside Nigeria resulting in the change of control of a business, part of a business or any asset of a business, in Nigeria”. [72] That catches an acquisition, not the conduct under investigation. The applicable provisions are section 2(1) and section 2(3)(c), which reaches “any person in relation to the supply or acquisition of goods or services by that person into or within Nigeria”. [73]
In the UK, under section 86 of the Digital Markets, Competition and Consumers Act 2024 (the “DMCC Act”), the CMA may impose a penalty of up to 10% of turnover, and section 86(5) defines turnover as turnover arising both “inside and outside the United Kingdom”. [74] A penalty that does not depend on local revenue turns the power to act into a threat a firm has to take seriously.
The FCCPA also sets penalties as percentages of turnover in the preceding business year, and section 167 defines turnover as “the amount of money taken by the business in a determined period”. [75] That definition carries no territorial limit at all, and the silence is the finding, because the same Act is explicit wherever it means to confine itself: section 2(3)(c) reaches supply “into or within Nigeria”, and the merger thresholds are set by reference to turnover “in, into or from Nigeria”. Where the drafter wanted a territorial limit, the drafter wrote one. On the face of the Act the penalty base is therefore not confined to Nigerian revenue, which puts Nigeria closer to the United Kingdom than the leverage argument has assumed. The reading is mine, not a decided point: I have found no case in which the FCCPC has calculated a penalty on anything other than Nigerian revenue, and a respondent would argue that “the business” means the business carried on in Nigeria. The Administrative Penalties Regulations 2020 list abuse of a dominant position and gun-jumping among the conduct attracting a base penalty, and allow that base to be set as a proportion of annual turnover, as a proportion of the statutory fine, or as a fixed sum. [76] The question is therefore not what the Act says but whether the FCCPC will say it first.
At the regional level, COMESA’s Competition and Consumer Protection Regulations 2025 [77] prohibit “any abuse of economic dependence within the Common Market” and provide expressly that “determination of abuse of economic dependence does not require a dominant position in any market”. [78] That removes dominance, which is usually the most difficult and expensive thing to prove, and it fits the structural dependence theory CADE has adopted. Regulation 37 is untested, however, and the first opportunity to test it was passed over. When the COMESA Competition and Consumer Commission (the “CCC”) opened its first case against a global platform under the 2025 Regulations, it proceeded under Regulation 36, the ordinary abuse-of-dominance prohibition, and not under Regulation 37. [79] The hook exists; nobody has yet used it.
Institutional capacity
A merger must be notified where the parties’ combined annual turnover “in, into or from Nigeria” equals or exceeds NGN 1 billion, or where the target’s turnover on the same measure equals or exceeds NGN 500 million. [80] Because the thresholds are fixed in naira and have not been revised since 2019, they now catch far smaller deals: NGN 1 billion was worth about USD 3.27 million in September 2019 and about USD 750,000 in October 2026. [81] Low thresholds therefore pull small Nigerian deals into review, while the deals that decide what AI capability reaches the market need no filing at all. The thresholds may not catch them, but Nigeria’s definition of control would. The definition goes beyond majority shareholding to anyone who can materially influence the target’s policy, and the Merger Review Regulations tell the FCCPC to take information rights into account. [82] Those are the features of the minority and quasi-acquisitions through which AI capability is assembled. What is missing is not the definition but the duty to notify. The Chambers practice guide records that “at least 46 merger matters have been published” on the FCCPC’s portal since September 2025, and that Nigeria applies no market-share threshold. [83] For deals between two foreign parties, it notes that where the target has no Nigerian subsidiaries, sales or assets, the deal generates no Nigerian turnover and so needs no notification. [84] I have found no official filing statistics since 2019, so the common claim that the FCCPC is flooded with trivial filings cannot be made out from published data. What can be said concerns what the caseload contains, not how big it is.
The call-in power does not close the gap. Section 95(3) of the FCCPA allows the FCCPC, “within six months after a small merger is implemented”, to require notification where “in the opinion of the Commission… the merger may substantially prevent or lessen competition”. [85] It reaches only mergers that have already closed, it lasts six months, and it asks the FCCPC to reach a view on the competitive harm before it has seen the parties’ documents. Brazil’s equivalent under Article 88 § 7 runs for a year and has been used sparingly. [86] A power the better-resourced authority rarely uses is not a solution for the authority with less.
Capacity is not only a matter of resources. It is also a matter of how much the law requires an authority to prove. An authority acting in advance never has to define the market first. The CMA designated Google on market-wide evidence and then regulated the AI features as part of that position, without ever having to define a market in which an AI summary competes with the article it summarises. An authority acting after the event has no such shortcut. It must define a market in which the product is supplied to users free of charge, and the standard tool does not work there, because you cannot model a small price rise where there is no price. The FCCPC’s Notice on Market Definition acknowledges the difficulty. It records that the hypothetical monopolist test is hard to apply where services carry no monetary price, that firms in those markets compete mainly on quality, and that the FCCPC might use variants measuring changes in quality (“SSNIQ”) or in the non-monetary cost to the consumer (“SSNIC”). [87] The Act itself gives one foothold the Notice does not mention. Section 71 sets out the criteria for delineating the relevant market, and paragraph (c) directs attention to the suppliers consumers may turn to in the short term “if the abuse of dominance leads to a significant increase in price or to other detrimental effect upon the consumer”. [88] The second limb is a statutory hook for non-price harm, written into the criteria for market definition itself. So the law is there. It is simply expensive to use, and the cost falls on the authority least able to bear it.
Market leverage
A remedy binds only where obeying it is cheaper than the alternatives and paying the fine is not the only alternative. A firm can offer a different version of its product in one country, withdraw the feature there, or stay out of that market altogether. Where a market earns the firm little, those options are real, and the remedy fails in practice however sound it is in law. Nor are those options confined to small markets: Apple announced in June 2026 that Siri’s AI features would be delayed in the EU for iOS 27 and iPadOS 27, citing the Digital Markets Act. [89] Leverage makes disobedience expensive. It does not stop a firm from withholding the feature instead. Meta did both in a single episode and did so by telephone country code. It kept its restriction on rival AI assistants everywhere it was not ordered to lift it, lifted it in Italy for numbers with the country code +39 and then in Brazil for Brazilian numbers, and, once an EEA-wide order looked likely, offered access for a fee it set itself — telling the market it would support general-purpose AI chatbots on the WhatsApp Business API “in Europe” for the next twelve months “in response to the European Commission’s regulatory process”. [90] Compliance scoped to the regulator is not the same thing as compliance. Gal makes the same point about small and developing jurisdictions: they cannot credibly threaten multinationals, and so depend on enforcement by larger ones. [91]
The research on regulatory spillover points the same way, and what it finds has changed over time. Measurement of GDPR compliance found substantial globalisation of EU standards, which the Brussels Effect literature read as evidence that rules travel. [92] More recent measurement is less encouraging. A 2026 review of web tracking found that a common set of top global sites made about 50.5% fewer tracker connections when visited from EU than from non-EU countries, and the authors describe the law as a “Brussels shield” rather than a broad Brussels effect. [93] Where it is cheap to treat countries differently, firms do. Marotta-Wurgler and Davis point the same way: on their findings the strongest predictor of spillover is the cost of compliance and a firm’s physical presence in the EU, rather than the risk of a penalty. [94]
The three conditions explain whether an authority can get an order. They do not explain how far its effects reach, which depends on what it costs the firm to run two standards rather than on the power of the authority that made the order. An authority that meets all three conditions may still produce a remedy that stops at its border, and one that meets none may find its publishers protected by someone else’s. The WhatsApp sequence illustrates both halves within one set of facts. The European Commission satisfied all three conditions and obtained an order whose effects Meta confined to the EEA. The CCC satisfied the first, arguably the second and not the third, and its complainants were not protected by anybody else’s order.
The Meta order is the obvious objection. A penalty of USD 220 million against a global platform is not decoration, and if the FCCPC can impose a figure of that size, the shortfall in leverage is smaller than this framework suggests. But a penalty imposed is not a penalty collected, and the appeal noted above remains undecided. [95] Leverage is also a claim about conduct rather than about money. The question is not whether an authority can extract a sum, but whether the prospect of paying it makes obeying cheaper than differentiating or leaving. The published record does not show, either way, what effect the order had on the conduct it condemned. Until that is known, the order is good evidence of capacity and says little about leverage.
This is why the same theory of harm produces a binding conduct requirement in London and, on present evidence, nothing enforceable in Abuja. The difference lies in neither the analysis nor the drafting. Google would rather rebuild its publisher controls than lose 10% of global turnover. Whether it would rather rebuild them than give up what it earns from AI summaries served to Nigerian users is much less clear.
The Nigerian case
The first route is an abuse of dominance in a market with no price. Section 70(2) asks two things of a dominant position: economic strength enabling the undertaking to prevent effective competition being maintained on the relevant market, and “the power to behave to an appreciable extent independently of its competitors, customers and ultimately consumers”. Both limbs must be satisfied. Dominance is not unlawful; abuse is. Section 72(1) prohibits abuse by “one or more undertakings”, so the prohibition is not limited to a single firm, but it is expressly subject to section 72(3), which provides that an undertaking is not to be treated as abusing a dominant position where its conduct improves production or distribution or promotes technological or economic progress “while allowing consumers a fair share of the resulting benefit”, is indispensable to that end, and does not eliminate competition in a substantial part of the goods or services concerned. [96] Any case on this route would meet that defence, and on these facts Google would run it.
Establishing dominance is not the hard part; naming the abuse is. Section 72(2) sets out the grounds, and they are drafted for pricing and for exclusion: charging an excessive price to the detriment of consumers; refusing a competitor access to an essential facility; exclusionary acts whose anti-competitive effect outweighs their technological efficiency; and a list of exclusionary acts running from tying to below-cost selling. [97] None of them fits taking a supplier’s input on terms it cannot negotiate and publishing a substitute for it. The closest is section 72(2)(b), which makes it an abuse to “refuse to give a competitor access to an essential facility when it is economically feasible to do so”, and it runs in the wrong direction: the publisher does not want access to something Google is withholding, it wants Google to stop taking something the publisher cannot withhold. The exploitative grounds fit the economics better, but the excessive-price ground cannot carry the case, because the price complained of is zero.
The second route is the consumer one. Nigeria vests competition and consumer protection in one agency under one statute. [98] Where proving dominance and abuse is evidentially expensive, the consumer provisions may reach the same conduct at lower cost. Section 127 prohibits supplying goods or services “at a price that is manifestly unfair, unreasonable or unjust, or on terms that are unfair, unreasonable or unjust”, [99] and section 127(2) deems a term unfair where “it is excessively one-sided in favour of any person other than the consumer or other person to whom goods or services are to be supplied”. [100] A crawl-or-disappear term is one-sided on its face, and saying so needs no market definition. The Meta enforcement shows this route working: the FCCPC proceeded on findings of “discriminatory and exploitative practices against Nigerian consumers”. [101] The question is whether a publisher can stand in that provision at all, and the Act is more accommodating than it first appears. Section 167 provides that a consumer “includes any person… to whom a service is rendered”, a limb that requires no purchase and no payment; the definition is inclusive rather than exhaustive; and the same section defines supply, in relation to services, as including “provide, grant, or confer”. [102] A publisher to whom Google renders search listing, indexing and reporting services is therefore capable of being a consumer on the face of the Act. Section 127(2)(a) points the same way, because it measures one-sidedness against “any person other than the consumer or other person to whom goods or services are to be supplied”, which reaches past consumers in terms. [103] The route is better than arguable. What it lacks is a decision applying either provision to a supplier of an input rather than to the recipient of a retail service, and that, rather than the words of the Act, is the risk a practitioner should price.
The remedial gap
Nigeria’s remedial framework is built for mergers. The Merger Review Regulations provide for structural remedies, behavioural remedies and hybrids of the two. Behavioural remedies are “unlikely to be accepted by the Commission in phase one as they tend not to be clear-cut and are less effective and capable of ready implementation than structural remedies”. [104] The only remedy package the FCCPC has published is itself a merger remedy. On 4 March 2023 it published a proposed package for FMDQ’s acquisition of a 21.61% stake in the Central Securities Clearing System, having found that the acquisition was likely to substantially lessen competition. [105]
Now set the Publisher CR beside that. It is a purely behavioural instrument: a control, an anti-circumvention duty, a disclosure duty, a qualified attribution duty and a periodic reporting obligation. It is the kind of remedy Nigerian merger-remedy policy treats as second best, and the only conduct orders the FCCPC has made against a global platform are those in the Meta Final Order, one of which the Tribunal set aside. [106] An authority that could compel Google to act would still have to draft, monitor and enforce an instrument for which it has no template. That is why borrowing one drafted elsewhere is attractive, and why it matters what the borrowed instrument actually does.
Does the remedy travel?
The framework predicts that a Nigerian publisher cannot obtain a remedy in Abuja. It does not follow that the publisher goes unprotected, because the remedy obtained in London may not stop at the border. Whether it does is a question about the instrument and about how Google has built it.
Who the remedy is for
The Publisher CR puts no geographic limit on who it protects. “Publisher”, as defined in the Notice, “means any party that makes content available on the web”. [107] A Nigerian newspaper is therefore a publisher for these purposes. The geographic limit is on the output: the requirement applies to generative AI features “shown to any natural or legal persons located in the UK”. [108] The final decision confirms that the obligations cover “generative AI services and features shown to UK end users”, because “the location of the end user is readily identifiable”. The Interpretative Notes add that UK location may be assumed “on the basis of the location reported by their device”. [109]
That choice has a consequence the decision does not discuss. The CMA fixed the scope by reference to the reader of the output rather than the supplier of the content. A rule drafted the other way, protecting UK publishers wherever their content is used, would have protected fewer publishers across more territory. As drafted, it protects publishers everywhere and bites only at home, and the decision does not say whether that was deliberate. It is also silent on timing. Nothing in the instrument requires Google to unwind content it has already taken. [110] A publisher that exercises the control in December 2026 withholds its future output, not its archive.
Which parts travel?
The training control was global from the start. The Interpretative Notes direct Google to deliver it by making “any changes necessary to the existing Google-Extended control”, and the final decision records that Google-Extended “already operates on a global basis and captures the training of the models underlying outputs to UK end users”. [111] A publisher anywhere that sets Google-Extended withholds its content from training everywhere.
Google’s blog post of 3 June 2026 said it was “beginning to roll these features out to a subset of website owners in the UK”. The same post, updated on 31 August 2026, now states: “As of August 31, 2026, we’ve rolled out these features to all websites worldwide.” [112] The control lets an owner “decide if they want their site to appear in and help ground responses in our generative AI Search features”, and the post states that sites which opt out “will not receive traffic or impressions from our generative AI features”, attaching no geographic limit to that effect. [113] The rollout has since been confirmed independently of Google’s own account: the control appears in Search Console for site owners worldwide as a property-level setting with three values, include, exclude and inherit from parent. [114]
A third obligation points the same way. The engagement metrics are to be delivered for each publisher separately, through a commonly accessible platform such as Google Search Console. [115] Search Console is a single global product with a single interface. Supplying those metrics to every publisher is cheaper than working out which publishers’ content appeared in outputs shown to UK users and supplying only those. Training and grounding behave this way on the evidence available, and the metrics point is no longer an inference: the generative AI performance report reached every Search Console property on the same day as the control. What has gone global, though, is the mechanism and not the obligation. The report documents impressions in generative AI features and no click metric, which is the one figure a publisher would need in order to price the choice the control offers it; Google says further metrics will be added over time. [116] Where an obligation can be met through something that is already global, it spills over. Where meeting it would mean building a new territorial switch, it need not. Meta supplies the counter-example for that second limb. The obligations it faced could be met with a dialling code, and were. [117]
The finding is therefore narrower than “the remedy is global” and wider than “the remedy stops at the border”. Google’s documentation describes no geographic limit, either on who may use the control or on what opting out suppresses. But it nowhere states what effect an opt-out has for users outside the United Kingdom, and I have not tested the behaviour. The claim that publishers outside the UK are protected rests on the absence of a stated limit, not on anything Google or the CMA has said.
Four reasons for caution
First, none of this is compliance yet. The Publisher CR is not in force until 3 December 2026 and the page-level control not until 3 March 2027, and the first compliance report is not due until 3 January 2027. [118] Everything released since June 2026 is voluntary, and a voluntary global rollout can be narrowed later without breaching an obligation that covers only UK users. A firm that does more than it must before the deadline keeps the option of doing exactly what it must afterwards.
Second, nobody asked for this. The consultation submissions were about the opposite risk. The News Media Association warned that content “scraped from UK publishers but used to support Search or AI services in other jurisdictions” would “fall outside the scope of the remedy” and that this “would risk creating a substantial loophole”. It noted the CMA’s own observation that the design “allows Google to comply on a global basis”, which is permission rather than obligation. [119] The Publishers Association warned that “the Conduct Requirements could be exploited by Google’s operations overseas”. [120] The Financial Times urged that “the CR should operate in a way that avoids territorial loopholes where UK publisher content is used in non-UK AI services”. [121] All of those arguments are about UK content leaking out. None is about foreign publishers benefiting from the remedy. The spillover that matters to a Lagos publisher is a by-product of an engineering decision, not something anyone argued for or any regulator intended.
Third, the attribution obligation may behave differently from the opt-out. An opt-out can be switched on the location a user’s device reports at the moment of the query. How a model cites and links its sources is part of the output format, and varying that by territory costs more than standardising it. If that is right, attribution should spill over more readily than the control, which is the reverse of what the drafting suggests. I have not found evidence either way, and I do not know whether Google has varied attribution behaviour by territory. One piece of indirect evidence cuts the same way. Google told the consultation that it “has every incentive to prominently attribute content to publishers”, arguing on that basis that an attribution requirement was unnecessary. [122] A firm that says attribution serves its own commercial interest is unlikely to build a territorial switch for it. That is an inference about incentives, not a finding about behaviour.
Fourth, the territorial switch is no longer hypothetical. In the WhatsApp matter, a firm of comparable size, facing orders in three jurisdictions, scoped its compliance to each of them in turn, and the scoping instrument was as crude as a dialling code. Google’s controls run through Search Console and Google-Extended, which are global products, and that is the whole of the reason they reach a publisher in Lagos. Nothing obliges Google to keep them that way, and nothing in the Publisher CR would be breached if it did not.
Why it matters
If remedies obtained in high-leverage jurisdictions spill over, low-leverage authorities are right to free ride, and the best use of a small agency’s budget is influencing foreign proceedings through interventions, submissions and timing rather than bringing domestic cases it cannot win. South Africa has already done this. Its Competition Commission’s Media and Digital Platforms Market Inquiry reported on 13 November 2025 with a package of remedies agreed with Google and YouTube rather than imposed on them, [123] and one commitment states the position on the face of the document: “AI companies will offer South African media the same content controls and opt-out mechanisms available in the EU.” [124] An authority without the leverage to design a remedy of its own asked instead for the same treatment as publishers in a jurisdiction that had it. [125] The limits of that strategy are visible in the WhatsApp matter. Free riding assumes that the borrowing authority is content to take what the lending authority obtained. The CCC’s position was the opposite: asked whether the European Commission’s charges on the same conduct would move it, its head said they would not. [126] Deference is a choice, and an authority may decline to make it even where its own leverage is slight. If remedies stop at the border, free riding fails, and publishers in unprotected markets face the same taking with none of the relief. What happens on 3 December 2026 and 3 March 2027 will settle which of those worlds this is.
Two things qualify that. A borrowed remedy comes with the lender’s policy choices attached: a jurisdiction relying on the Publisher CR inherits a control without a payment, limited by the location of the reader, forward-looking only, and enforceable by nobody outside the United Kingdom. Free riding is not a choice of remedy; it is acceptance of someone else’s. There is also a third option between enforcing and free riding, and South Africa has shown what it looks like. A negotiated commitment to the same treatment costs little, needs no leverage, and turns a product decision the firm made alone into something the borrowing authority can hold it to. It is a weaker instrument than an order and a stronger one than a hope, and for most of the authorities described in this article it is the only one of the three available.
What this means in practice
The opt-out has no enforcer a foreign publisher can reach. A Nigerian or South African publisher can set Google’s controls today, but no regulator it can petition is enforcing them. The control exists because of a UK obligation that is not yet in force and that covers only UK users. If Google narrows it, the publisher has no claim at home and no obvious forum abroad.
Opting out costs something and may not be possible on its own. Withholding content from grounding costs visibility in the search features readers increasingly use to find things, which is why trade reporting described the control as a choice publishers cannot safely use. [127] Whether Google’s crawlers should be separated was argued over in the consultation: Guardian Media Group pointed to Google’s “over 20 crawlers and fetchers”, Cloudflare called mandatory crawler separation the “only viable technical solution”, and Microsoft agreed with the CMA’s own assessment that requiring separate search and AI crawlers would be disproportionate. [128] Google itself resisted “splitting Google-Extended into two separate controls”. [129] Until the crawlers are separated, advising a client to opt out of AI use is close to advising it to opt out of search.
Inflation, not policy, decides which deals get reviewed. Thresholds fixed in 2019 now catch deals with under USD 1 million in combined Nigerian turnover, while the acquisitions that decide AI capability generate no Nigerian turnover and so need no filing. Clients pay fees on the small deals and face no review on the large ones, and the section 95(3) call-in reaches only small mergers already completed, within six months.
The attribution duty is softer than the headlines. The obligation is to “take reasonable steps” to ensure that content is “attributed clearly, accurately” and that users are given “a clear means to access” it, without prescribing any particular form of link, and expressly “taking account of” end-user experience, design aesthetics and source diversity. The Notice itself does not use the word “fine-tuning”; that extension comes from the Interpretative Notes. [130] A client advised from the press release rather than the Notice will have been advised wrongly in both respects. [131]
The FCCPC’s independence is now an issue in the Nigerian case, and the Act supplies the provision. Section 3(2) states that the Commission “shall be independent in carrying out its functions, powers, duties and responsibilities conferred upon it under this Act”. [132] An investigation announced as following a presidential directive, conveyed by a ministerial letter, hands Google an administrative-law argument built on that subsection, about the decision to investigate, to be run before any question about the conduct itself. Whether or not it succeeds, it has to be answered, and it lengthens a timetable that was already the FCCPC’s weakest point.
The control does not reach what has already been taken. The Interpretative Notes confirm that Google is not required to remove Search Content that has already been added to its models. [133] For a publisher whose archive has been crawled for years, the control covers what comes next, not what is already in. Advice that presents the opt-out as a remedy for content already taken is wrong, and the distinction is worth putting in writing: it is the point on which a client is most likely to feel misled later.
What could be done
For authorities short of capacity, four things follow. Index the merger thresholds, or set them in a unit that holds its value: a threshold left fixed in a falling currency is a policy that changes every year without anyone deciding it should. Spend the budget on conduct cases that can produce a remedy at home rather than on merger review that nothing triggers. And ask the firm the territorial questions directly, and early: is a control built for another jurisdiction available here; does using it suppress outputs shown to users here; and does it reach content already taken? Those questions cost nothing to ask, and on the evidence above they are the ones local protection turns on. Finally, use the interim power, where there is one — and press for one where there is not. Nigeria is the cautionary case: the FCCPA gives the Commission an express power to make interim orders pending investigation of a restrictive agreement, but no equivalent power in the abuse-of-dominance Part, where the direction to cease comes only after a finding. [134] In the one matter in which the same conduct was put to four authorities at once, every restoration of access followed an interim order. The one change the firm made in response to an investigation alone was to readmit its rivals at a price, and the Commission found that price prima facie equivalent to the exclusion it replaced. An interim measure asks for a prima facie case rather than proof of an infringement to the standard of a final decision, and it arrives while the market is still contestable. It is the cheapest instrument an authority short of capacity has — and in that matter it is the instrument the authority with the least capacity declined to use. [135]
For regional bodies, COMESA’s prohibition of abuse of economic dependence is the most promising provision in African competition law for this conduct, because it removes the dominance finding that makes the case expensive. [136] That is a recommendation the CCC has so far not taken up: its first platform case under the 2025 Regulations proceeds under Regulation 36, the ordinary abuse-of-dominance prohibition, and the interim relief sought in it was refused. [137] Its gatekeeper rules reach a platform favouring its own services and using data from the businesses on it, though nothing in the text mentions news content or model training. [138] The AfCFTA Protocol on Competition Policy, adopted at the 36th Ordinary Session of the AU Assembly on 18–19 February 2023, sets up the AfCFTA Competition Authority as an autonomous body with independent legal personality and leaves gatekeeper designation to regulations made by the Council of Ministers. It enters into force, by way of the AfCFTA Agreement, thirty days after the twenty-second ratification is deposited. [139] The article number usually cited for its digital-markets provision comes from a draft, and I have not been able to confirm it against the adopted text. The point of interest is aggregation: a continental market creates leverage that no single member state has.
For the enforcement centres, the territorial scope of a remedy deserves to be treated as a decision rather than a drafting habit. The CMA scoped the Publisher CR to the location a user’s device reports. That choice decided, as a by-product, whether publishers in every jurisdiction not represented in the consultation get the benefit of the remedy, and it was never discussed in those terms. At the least, an authority imposing conduct requirements on a global firm should ask the firm to state where it proposes to implement them, and should publish the answer.
For research, the question is answerable and nobody is answering it. The method already exists in the privacy research: Mahieu and colleagues measured the Brussels Effect by sending matched data-access requests from inside and outside the EU and comparing the responses to those the GDPR covered against those it did not, and Yu, Yin and Zimmeck measured how tracker behaviour differed across ten countries. [140] The equivalent here is to set Google’s publisher control on comparable sites in different countries and measure whether their content still appears in AI Overviews served to users in each. Publishers are well placed to collect that data. Regulators are well placed to require it.
Conclusion
That gap — between how fast the theory spread and how little has been enforced — matters more to most of the world’s competition authorities than any disagreement about what the conduct is. They are not short of analysis. They are short of a penalty base that is demonstrably not tied to local revenue, of staff to run an evidence-heavy case against a firm with unlimited counsel, and above all of a market large enough that obeying is cheaper than treating that market differently. The first two can be designed around; the third cannot. What they would be borrowing is also less than it sounds: a control rather than a payment, and one that reaches what is taken from now on rather than what has already been taken.
The decision that matters most about whether a publisher in Lagos can withhold its journalism from an AI summary was not made in Abuja, or in Brussels, or even in London. It was a product decision at Google, disclosed in a one-line update to a blog post on 31 August 2026 and announced as work in progress before the requirement meant to compel it was imposed. [141] Google can withdraw it until a UK obligation that nobody outside the United Kingdom can enforce comes into force on 3 December 2026. The WhatsApp matter shows what it looks like when the product decision goes the other way: a firm that scoped its compliance to the jurisdictions able to compel it, and a regional authority that opened the file and then declined the interim relief the European Commission granted on the same facts. Borrowed remedies are better than none. They are not the same as having one.