Google Search requires user consent to function, a technical gate that has taken on new significance as the World Health Organization (WHO) declares a Public Health Emergency of International Concern (PHEIC) over an Ebola outbreak in the Democratic Republic of Congo (DRC) and Uganda. The search tool, embedded on many websites via Google Custom Search, cannot load until a visitor clicks “Allow and Continue” – a step that may use cookies or similar technologies, according to the search provider. With health authorities racing to contain the spread of a virus that has already crossed borders, the friction between user privacy and rapid access to information has moved from a routine web annoyance to a matter of public health urgency.
How consent works
The consent mechanism is straightforward but non-negotiable. A website that embeds Google Custom Search must ask the user to agree before the search field becomes active. The prompt states: “To use the search feature, we need your consent to load Google Custom Search, which may use cookies or similar technologies. Please click ‘Allow and Continue’ below to enable search.” A link to the site’s privacy policy is provided for those who want more detail. Without that affirmative click, the search function remains disabled – a design intended to comply with data protection rules, particularly the European Union’s General Data Protection Regulation (GDPR), which requires explicit opt-in for non-essential cookies. In practice, this means a reader landing on a news article about the Ebola outbreak must first grant permission before they can search for related terms, such as “Bundibugyo virus symptoms” or “WHO travel advice.”
The timing of this requirement is critical. On 17 May 2026, the WHO determined that the Ebola outbreak met all four criteria for a PHEIC: it is an extraordinary event; it already shows international spread, with cases confirmed in Kampala, Uganda, linked to travel from the DRC; it poses a risk to other States, particularly neighbouring countries; and it requires a coordinated international response. The WHO has explicitly stated that the outbreak does not meet the criteria for a pandemic emergency, as defined under the International Health Regulations (IHR). However, Dr. Tedros Adhanom Ghebreyesus and his team warned that the outbreak “may be much larger than what is currently being detected and reported,” citing clusters of unexplained deaths and a high positivity rate among tested samples. The affected areas include Ituri Province in eastern DRC, the capital Kinshasa, and Kampala – urban centres with intense population movements, mining activity, and cross-border traffic that heighten the risk of further exportation.
The search function under pressure
Once consent is given, Google Custom Search acts as a third-party tool that indexes the host site’s content and often broader web results. For a user seeking information about the Ebola outbreak, this could mean finding official WHO guidance, local health ministry announcements, or medical literature. But the dependency on user consent adds a layer of friction at a moment when every second counts. The research briefing prepared by this newsroom’s colleagues details the nature of the threat: the outbreak is caused by the Bundibugyo virus, a less common strain of Ebola first identified in Uganda in 2007. Unlike the more familiar Zaire ebolavirus, there are no licensed vaccines or specific treatments for Bundibugyo virus disease; care is supportive only. The historical case fatality rate ranges from 25 to 50 percent. Patients have presented with classic symptoms – fever, headache, vomiting, severe weakness, abdominal pain, nosebleeds, and vomiting blood – and the majority of cases so far are adults between 20 and 39 years old, with two-thirds being female.
The scale of the outbreak remains uncertain. As of 16 May 2026, the DRC reported eight laboratory-confirmed cases, 246 suspected cases, and 80 suspected deaths in Ituri Province, where the outbreak likely originated in the Mongbwalu health zone, a high-traffic mining area bordering South Sudan and Uganda. Uganda has confirmed two laboratory cases, including one death, in Kampala, both linked to travel from the DRC. At least four healthcare workers have died, raising alarms about infection prevention in health facilities. The Africa CDC has assessed the risk of spread within the DRC as “very high” and the risk for East Africa as “high.” A four-week detection delay – initial samples were negative before the Bundibugyo virus was identified in a hospital in Bunia Health Zone – allowed “extensive uncontrolled community transmission,” according to WHO assessments. Ongoing armed conflict and insecurity in eastern DRC are restricting surveillance and rapid response operations, compounding the challenge.
Privacy in a public health emergency
The privacy implications of requiring user consent for search are not trivial. Google Custom Search typically deploys cookies to track user behaviour, personalise results, and serve targeted advertising. In the context of a health emergency, a user searching for “Ebola symptoms in Kampala” or “where to get tested for Ebola” may be hesitant to consent to data collection, fearing that their search history could be used for purposes beyond their control – whether by advertisers, insurers, or authorities. The site’s privacy policy, referenced in the consent prompt, is meant to reassure users, but the burden of reading and understanding it falls on the individual at a time when stress and urgency are high.
The WHO’s decision to declare a PHEIC – only the second time the Bundibugyo strain has triggered such a designation – underscores the need for accurate, timely information. The DRC is experiencing its 17th Ebola outbreak since the virus was first identified in 1976. Previous large outbreaks, such as the 2018-2020 Kivu epidemic (3,470 cases, 2,280 deaths), were hampered by community mistrust and inadequate communication. The current outbreak has already seen a “four-week detection delay,” and the WHO advises countries to strengthen surveillance, preparedness, and community engagement while ensuring accurate public information. No international travel restrictions are recommended at this stage. The economic consequences of Ebola can be severe: the 2014-2016 West African outbreak cost an estimated $30 billion to $50 billion, and the three most affected countries lost $2.2 billion in GDP in 2015 alone, with annual losses from decreased trade, border closures, and flight cancellations reaching at least $3.6 billion per year.
The lack of a licensed vaccine for the Bundibugyo strain – progress has been made on the Zaire ebolavirus vaccine, such as rVSV-ZEBOV – means that control depends on rapid case identification, contact tracing, and safe burial practices. In this environment, a search function that requires a deliberate opt-in before it can be used may inadvertently slow down the dissemination of life-saving information. The WHO is deploying rapid response teams, delivering medical supplies, and strengthening cross-border preparedness, but the digital infrastructure that connects individuals to that help is contingent on a click. For a reader in Kampala who has just heard of a suspected case on their street, that click might be the difference between finding a nearby treatment centre and remaining in the dark – a privacy trade-off that public health officials and technology companies have yet to fully reconcile.
