Something Inc. covered Google's two-tier AI opt-out, exclude versus full removal, as a feature launch back in July. It read at the time like Google getting ahead of regulatory pressure by shipping its own version first. The UK's Competition and Markets Authority has now made clear that reading was only half right: Google shipped something, but a legally binding order for a stronger version was already in motion behind it.
What the CMA actually ordered
The CMA designated Google Search as holding Strategic Market Status in 2025, a UK competition-law designation that gives the regulator power to impose specific conduct requirements on a dominant platform rather than simply fining it after the fact. On June 3, 2026, it used that power to order Google to let website operators opt their content out of AI Overviews, AI Mode, and AI-generated summaries inside Discover, without being forced to also remove that content from standard organic search results.
Three provisions in the order go further than anything Google had shipped voluntarily. First, opting out carries an explicit no-ranking-penalty guarantee: a site that excludes its content from AI features cannot be demoted in regular search results as a side effect. Second, the order requires Google to give operators a separate, distinct way to prevent their content from being used in AI model fine-tuning and training, not just from appearing in a live AI answer. Third, when Google's AI features do use a site's content, the order requires that content be cited with proper attribution and a clear link, not a vague or buried reference. Google has nine months from the order to build and ship compliant controls, and is currently testing the mechanism with a limited number of UK website operators ahead of a broader rollout.
Why a UK regulator can force this
Strategic Market Status is a specific tool in the CMA's post-Brexit competition powers, modeled loosely on the EU's Digital Markets Act but administered independently by a UK regulator rather than the European Commission. A company designated with Strategic Market Status in a given activity, Google Search, in this case, doesn't just face fines for past conduct. The CMA can issue forward-looking conduct requirements that dictate how the company has to operate going forward, enforced with the threat of penalties up to 10% of global turnover for non-compliance. That's a materially different enforcement mechanism than the EU's approach of fining Google after the fact for self-preferencing, which is what produced the €890 million DMA fine covered elsewhere on this site. A conduct requirement doesn't wait for the harm to already have happened; it specifies what has to change and puts a clock on it.
That distinction matters for how confidently a site operator can plan around this. A fine is a cost Google can absorb and a signal that behavior needs to shift eventually. A conduct requirement with a nine-month deadline and an active testing phase already underway is a much harder commitment to walk back, because the regulator retains ongoing supervisory power over the designated activity rather than issuing a one-time penalty and moving on. The CMA can also revisit and tighten the requirement if Google's initial implementation doesn't satisfy the underlying competition concern, which is part of why the order includes specific, checkable provisions like the attribution requirement rather than a vague mandate to "provide more publisher control."
How it differs from Google's own opt-out
The two systems will likely converge eventually, since Google has said it plans to roll the CMA-compliant controls out globally over time rather than keeping a UK-only version. Right now, though, they're meaningfully different products, and a site operator evaluating which levers actually exist should not assume the version they read about in July already covers what the CMA is requiring.
| PROVISION | GOOGLE'S OWN OPT-OUT (SHIPPED) | CMA-MANDATED ORDER (IN PROGRESS) |
|---|---|---|
| Legal basis | Voluntary product decision | Binding Strategic Market Status conduct requirement |
| Ranking-penalty guarantee | Not contractually stated | Explicitly required by the order |
| AI training opt-out | Not clearly separated from live-answer opt-out | Required as a distinct control |
| Attribution requirement | Not specified | Properly attributed, clear links, required by the order |
| Rollout status | Live globally since July | Testing with limited UK operators, 9-month deadline |
What to audit now
Nine months and a limited UK test group means most site operators, especially anyone outside the UK, have time before this becomes an active decision rather than a future one. That time is better spent auditing the current state than waiting for the rollout.
It's also worth being honest about what opting out actually costs, since the CMA order removes the ranking-penalty risk but doesn't touch the traffic-and-visibility tradeoff underneath it. A site that opts out of AI Overviews and AI Mode isn't just declining a citation, it's declining the exposure that citation carries, in categories where AI answers are increasingly the first surface a buyer sees before ever reaching a traditional results page. For most commercial content, that's a real cost, not a free option, and the no-ranking-penalty guarantee only removes one specific downside, not the opportunity cost of being excluded from an increasingly large share of how people search.
The timeline risk
The real risk in this specific story isn't the opt-out mechanism itself, it's treating a nine-month regulatory deadline as a fixed date you can plan around precisely. Something Inc. has already tracked how unevenly Google ships regulatory-driven and self-imposed AI search changes: the EU's €890 million DMA fine came with its own 60-day forced redesign window that reshaped self-preferencing behavior faster than expected, while Google's own opt-out rollout described in our July coverage shipped as a global default well ahead of when most teams had planned around it. Regulatory deadlines in this space have consistently been either the floor or the ceiling of the actual timeline, rarely the precise date things change.
The practical response is to treat the nine-month window as "sometime in the next three to nine months, watch for a limited-market test first," not as a date to calendar and ignore until it arrives. UK-based technical SEO teams should already be tracking whether they're part of Google's limited test group; everyone else should build the citation baseline now so the decision, whenever it lands, has real numbers behind it instead of a guess made under a compliance deadline.
For publishers already running a GEO program, the opt-out decision is really a citation-value decision wearing regulatory clothing: is the AI-answer traffic and brand exposure you get from being included worth more than the training-data and answer-surface control you'd get from opting out. That's not a question a compliance deadline can answer for you, and it's worth having a real number attached to both sides before Google's testing group expands.
The categories most likely to answer that question differently are the ones worth flagging now, before the decision has to be made under a deadline. Publishers in regulated or reputation-sensitive categories, where an AI answer paraphrasing or summarizing content carries real liability or brand-control risk, are the more obvious candidates for opting out once the training-data control exists as a separate lever from the live-answer one. Publishers whose commercial model depends heavily on being the named, cited answer to a comparison or research query are the more obvious candidates for staying fully in, since the CMA's attribution requirement, if it holds, makes citation exposure more valuable, not less, by guaranteeing a visible link where none was previously guaranteed.
There's a middle group this order doesn't cleanly resolve: publishers who currently get meaningfully cited but see little of the traffic converted into anything, the exact pattern our own research into ghost citations and the recommendation gap has been tracking this year. For that group, the training-data opt-out is close to a free option once it exists as its own control, since it removes one exposure vector without touching the live-answer citation relationship that may or may not actually be earning anything today. That's the group most likely to benefit from treating the two new controls as genuinely separate decisions rather than a single opt-out toggle.
None of this requires action today. It requires a decision framework ready before the controls exist, since a nine-month regulatory deadline with an active limited test already running is not the kind of change that gives a comfortable amount of warning once it starts expanding beyond the initial test group. Build the baseline, decide the two-part answer in advance, and treat Google's own July opt-out as the interim tool it is, not the finished picture the CMA order is actually going to produce.
One more thing worth checking now, quietly, without waiting for an announcement: whether your own domain is already inside Google's limited UK test cohort. There's no public list, so the only reliable way to find out is watching for a new opt-out control appearing inside Search Console itself, alongside the generative AI performance report Google shipped earlier this summer. A site that finds itself in the test group early gets a genuine head start on making this decision with real data instead of a projection, which is a meaningfully better position than reacting once the global rollout makes the choice unavoidable for everyone at once.
See where you are cited today
A free snapshot audit of your rankings and AI citations before we ever talk.
Tyler leads work at the intersection of SEO and generative engines at Something Inc., helping B2B brands get ranked and cited across every major AI engine.