CMA vs Google: Is the UK’s fair ranking rule too good to be true?

For a decade, iGaming affiliates have treated Google's ranking system as a force of nature. A core update lands, money pages move, and affiliates are left discussing the damage in forums and rebuilding their sites. 

On 17 June 2026, the UK regulator changed the terms of that relationship, at least on paper. 

The Competition and Markets Authority (CMA) imposed two conduct requirements on Google's general search services, the first covering fair ranking and the second covering data portability. For an industry as familiar with regulation as iGaming, the measures give SEO a clearer regulatory and competition law dimension.

What the fair ranking requirement involves

The fair ranking requirement has three main parts, none of which force Google to disclose its full algorithm. Google must rank organic results using objective and non-discriminatory criteria, including results presented within AI Overviews and AI Mode. Paid or sponsored results remain outside the requirement. It must also explain how rankings work, provide advance notice of significant changes, and establish clear processes through which businesses can raise concerns.

What makes these obligations binding is Google’s underlying regulatory designation. The CMA granted Google strategic market status in October 2025 after finding that it handles more than 90% of UK searches. The designation turned what had previously been an industry grievance into an enforceable legal matter. Google has six months to implement fair ranking and three months for data portability, with compliance monitored through regular reporting.

A closer reading, however, reveals how little of the requirement directly favours affiliates. 

The most meaningful change: a compliant channel

The most useful part of the fair ranking order for affiliates is the formal route to challenge a ranking change, which has never existed before. Businesses previously had no formal channel for raising such concerns, and the CMA order creates one.

Consider the aftermath of the March 2026 core update: 71% of tracked affiliate sites reportedly suffered losses, while some money pages lost half their visibility overnight. Under the old regime, an affiliate swallowed that in silence. Under the new one, a UK-registered operator can lodge a formal concern and compel a response.

Temper the optimism, as the channel has a hard ceiling. Knowing why your rankings moved will not fix a site with weak technical foundations, and advance notice will not stop the drop if the page underneath lacks substance.

The complaint mechanism buys you an explanation and a paper trail. It does not buy back your traffic.

Where the order falls short: process, not outcomes

The fair ranking requirement assesses Google’s conduct rather than where individual pages rank, and that distinction guts much of its force. The Professional Publishers Association (PPA), which fought for these rules, flagged the problem on day one.

The PPA said it was disappointed the CMA chose to judge compliance by looking at processes rather than ranking outcomes. Fairness, the group argued, has to be measured by what happens to visibility and traffic, not by the stated intention behind a change.

Read that as a warning. Google can document its criteria, log its notice periods, operate its complaint desk and remain fully compliant while your comparison page continues to lose ground to an operator's own domain.

The process test has a second loophole. The CMA granted a six-month experimentation exemption for new search features, which the PPA warned gives Google room to make consequential changes before fair ranking conduct requirements fully apply. Since the most disruptive shifts in H1 2026 came through AI surfaces rather than classic blue links, an exemption aimed at new features leaves the most volatile part of the SERP lightly governed.

The non-discriminatory trap

Some operators may misinterpret the phrase "non-discriminatory criteria”, so the distinction is worth clarifying. In competition law, non-discriminatory means Google cannot rig rankings to favour its own properties over rivals.

It doesn’t mean gambling content gets levelled up to rank alongside consumer electronics or travel. iGaming remains a hyper-YMYL category, and Google's heavier scrutiny of gambling pages is a quality judgment applied to the category as a whole, not a discriminatory act against one competitor.

No affiliate is going to file a fair ranking complaint and win back category-level suppression of gambling money pages. Anyone briefing a compliance team on the order should draw that line clearly, because the distance between what the wording sounds like and what it delivers is exactly where wasted effort goes.

Data portability is the quiet opportunity 

Data portability, the second requirement the CMA imposed, reads like a footnote and might end up being the more commercially interesting one. Google must allow users to port their search data to authorised third parties, such as rewards platforms or companies that distribute personalised offers and discount codes.

The move puts UK users on a par with the EU under the Digital Markets Act, formalising a previously voluntary API. Cashback sites, odds-comparison tools and bonus-tracking products land squarely in the category the CMA named.

An affiliate building a rewards layer could, with user consent, pull in ported search signals to personalise which operators or offers it surfaces. Combining gambling, personal data and potentially vulnerable users creates substantial compliance risks. Any related product needs a robust data-protection and responsible-gambling framework before development begins.

Why UK-only does not mean UK-contained

Both conduct requirements apply only in the UK, yet the direction of travel should concern any affiliate working across regulated markets. The CMA tied its data portability rule explicitly to the EU's Digital Markets Act, which tells you the UK is converging with the EU template rather than inventing its own.

When two of your largest markets move toward the same transparency and portability obligations, the smart planning assumption is convergence, not fragmentation. The process-versus-outcomes debate may return at the next review, and affiliates that document the effect of algorithm changes will be better positioned to provide evidence if it does.

What affiliates can do now 

Three moves are worth making now, while the rest of the industry waits to see whether Google complies in spirit or merely in form.

Build a ranking-change evidence file. Timestamp visibility drops on your commercial pages, tie them to confirmed update windows, and record the revenue effect. When the complaint channel goes live, a documented case beats a vague grievance, and the same file feeds any future outcomes-based push.

Treat the complaint process as a tool, not a rescue. Use it to pull explanations and force engagement on genuine anomalies, especially where an operator's owned domain leapfrogs independent editorial content. Do not expect it to reverse a legitimate quality demotion.

Watch the data portability API as a product surface, not a Google problem. The affiliates who move first on consented, personalised offer products built on ported data will own that category before it gets crowded.

The verdict

The CMA has handed affiliates a lever they never had, and stopped well short of the disclosure the industry wanted. Google maintains its ranking systems are already fair and transparent, and the process-based test lets it keep saying so while complying.

For iGaming affiliates, the order will not tame update volatility or guarantee a single click. What it does is formalise the relationship, open a channel and hint at where the next regulatory dispute may emerge. In an industry already steeped in regulation, learning to work a regulator's transparency regime may become as core a skill as reading a core update.