Would that work in this case? I’d expect that to function like a massive multi-armed bandit test, but I’d assume (without any insider knowledge) that Google already does that internally anyway?

Would it be “better” (given the regulatory goals) to order Google to do XYZ and provide an audit trail to demonstrate compliance?