Britain’s Competition and Markets Authority did something Tuesday that US publishers have been begging for: it forced Google to actually respect opt-out requests for AI features.

The new conduct rule requires Google to let website owners keep their content out of AI Overviews and prevent it from being used to fine-tune Google’s models. The CMA called it “a world first,” and they’re not wrong. Publishers now have effective tools to stop their content from powering AI features they never agreed to support.

This matters because Google’s AI Overviews pull answers directly from websites and display them at the top of search results, which means fewer people click through to the original source. Publishers lose traffic, and therefore revenue, while Google profits from content it didn’t create. The company already offers a way to opt out through robots.txt, but the UK rule puts real teeth behind it.

The timing is notable. Just as Britain gives publishers actual leverage, the US is going in the opposite direction.

Trump’s voluntary framework fools nobody

President Trump signed an executive order Tuesday creating what his administration calls a “voluntary framework” for AI companies to share frontier models with the federal government before release. The order talks about promoting “secure innovation” and strengthening cybersecurity for critical infrastructure, but the voluntary part is doing a lot of work in that sentence.

According to reporting from TechCrunch and The Verge, this is a watered-down version of an earlier proposal. The administration initially floated mandatory prerelease reviews, but industry objections killed that idea fast. What we got instead is a framework that lets companies submit their models if they feel like it, which means the most important models (the ones that might actually pose security risks) probably won’t get reviewed at all.

The order claims the US AI industry succeeded “because we refuse to stifle this innovation with overly burdensome regulation.” That’s the tell. This isn’t about security. It’s about giving the appearance of oversight without requiring companies to do anything they don’t want to do.

Wired reports the administration is at war with itself over how much regulation actually makes sense. Some officials want real guardrails. AI executives and their allies in government want none. The voluntary framework is what happens when neither side wins: a policy that satisfies no one and protects nothing.

The enforcement gap

Compare the UK approach to the US approach. Britain identified a specific harm (publishers losing control of their content), picked the company best positioned to fix it (Google), and imposed a mandatory rule with clear requirements. If Google doesn’t comply, the CMA has enforcement tools.

The Trump order identifies a real concern (AI models with security vulnerabilities getting released) but makes compliance optional. There’s no enforcement mechanism because there’s nothing to enforce. Companies can participate or not. The ones with the most to hide will simply opt out.

This isn’t even good voluntary regulation. Effective voluntary frameworks work when companies face reputational costs for non-participation or when industry coordination benefits everyone. Neither applies here. A company that skips the review process faces no consequences, and there’s no collective benefit to sharing sensitive model information with a government that might leak it or use it for purposes the company didn’t anticipate.

What happens next

The UK rule takes effect immediately, and other jurisdictions will be watching to see if it works. If publishers actually use the opt-out tools and Google complies without gutting the functionality, expect similar rules in the EU and possibly Australia. If Google finds ways to work around the requirements or pressures publishers not to opt out, the CMA will have to decide whether to escalate.

The US voluntary framework will probably result in a few press releases from companies eager to look cooperative, followed by quiet non-participation from everyone else. There’s no penalty for ignoring it and no benefit to complying, so most companies will do the rational thing and skip it.

Congress could step in with actual legislation, but don’t hold your breath. The current dynamic, where tech companies get to regulate themselves while the administration takes credit for “doing something,” works well for both parties. Publishers and security researchers are the ones left out.

Britain just showed what real AI regulation looks like. It’s not perfect, but it’s enforceable. The US is still pretending voluntary commitments will solve problems that require mandatory rules. That worked great with social media moderation, right?