Meta Is About to Start AI Training on Public EU User Data—What Will the GDPR Authorities Do?

On 27 May, Meta plans to begin AI training using public EU user data from Facebook and Instagram. Yesterday, Meta’s lead GDPR regulator, the Irish Data Protection Commission (IDPC) published a statement highlighting the additional safeguards adopted by Meta since the previously paused plan from early 2024. On my reading, the IDPC implies that they do not object to Meta’s current plan, including Meta’s reliance on the “legitimate interest” basis for data processing under the GDPR. Nevertheless, it remains to be seen whether other EU data protection authorities (DPAs) and the courts will take the same approach. Following the IDPC’s statement, the Hamburg authority issued a “hearing letter” which may suggest German officials will try to overrule the Irish DPC to force a more restrictive approach as they have done in the past. There is also an ongoing attempt to secure an injunction in a German court to stop Meta’s 27 May plan. This matters to all AI developers and deployers in the EU, because Meta’s situation is not unique and whatever limitations are imposed on Meta, they can easily become a standard for others.

Read the full piece here.

The European Data Protection Board (EDPB), a sort of an EU assembly composed of national data protection authorities, has published draft Guidelines on applying the EU’s primary data protection law (the GDPR) to “blockchain technologies.” The European Crypto Initiative (EUCI) rightly raised an alarm, noting that the Guidelines call for deleting entire blockchains to achieve GDPR compliance. As some of you may know, I work extensively on EU data protection law (see my EUTechReg.com), and I thus thought it would be useful for me to explain why the EDPB document is as problematic. I should also add that the document is still formally a draft subject to consultation, to which everyone can respond.

Read the full piece here.

Just as we learn that the European Commission’s “GDPR reform” plan is likely to be a performative window-dressing exercise, the EU General Court again denied direct judicial review of a privacy-fundamentalist guidance document from the European Data Protection Board (EDPB) on “pay or OK.” The EDPB is acting like an unaccountable legislator, issuing theoretically non-binding guidance, which easily becomes the law in action. This occurs even when the guidance extends EU data protection law beyond its intended scope, driven by ideological extremism.

Read the full piece here.

The European Commission’s newly announced fines of €500 million against Apple and €200 million against Meta for alleged violations of its Digital Markets Act undermine key aspects of both online ecosystems. To make matters worse, they are also almost certain to exacerbate tensions with a notoriously trigger-happy U.S. administration.

The commission claims Meta’s “consent or pay” advertising model, which lets users either consent to personalized ads or pay monthly fees starting from €5.99 for an ad-free experience, violates the Digital Markets Act because users are not offered a “truly equivalent and free” alternative to personalized ads.

Read the full piece here.

Regulações ex ante de mercados digitais — como o Digital Markets Act da União Europeia (DMA), o Digital Markets, Competition and Consumers Act (DMCC) do Reino Unido e a Seção 19a da Lei Concorrencial alemã — vêm buscando coibir práticas consideradas prejudiciais à concorrência e aos consumidores, incluindo a cada vez mais debatida conduta de self-preferencing.

Read the full piece here.

President Donald Trump’s “Liberation Day” tariffs–and his promised trade agenda—draw partly from a narrative popular among protectionists. In this telling, high tariffs fueled America’s nineteenth-century industrial rise. Tariff-supporters like Oren Cass have argued that the United States “transformed from colonial backwater to continent-spanning industrial colossus” behind protective barriers.

Economic research suggests otherwise. While the United States did maintain exceptionally high tariffs from the Civil War through World War I (often 40 percent to 50 percent on manufactured imports), these were at best incidental to industrial growth—and likely harmful to it.

Lobbyists for big box retailers want Arizona’s legislature to impose price controls on card transaction fees. They claim that doing so will save merchants millions of dollars that will be passed on to consumers.

But, we’ve heard this story before and it doesn’t end well. It’s also probably illegal.

Read the full piece here.

It looks like GDPR reform, touching both its enforcement and its substantive rules, may be happening. I only hope that it will not be a wasted effort. In March, the EU Justice Commissioner announced that the EU Commission’s “simplification” agenda will involve reducing GDPR compliance burdens for smaller organisations. Moreover, Axel Voss, a prominent Member of the European Parliament from the dominant EPP faction called for a reform in the similar direction. Apparently, the privacy activist Max Schrems joined Voss’ call, though I assume with reservations and for different reasons. My regular readers won’t be surprised that I welcome the idea of GDPR reform, as I’ve been writing about GDPR’s problems and the need for change, most recently in A serious target for improving EU regulation: GDPR enforcement. However, even though we don’t know much about the various March proposals, what has been released causes me to worry that they are missing the biggest issue with the GDPR: its imbalanced, privacy-absolutist enforcement framework. In this text, I will briefly summarise what we know about the new proposals and what I think is missing in them.

Read the full piece here.

Nicotine vaping products are increasingly being pushed underground in two contrasting jurisdictions, as my recent research illustrates. This sends a damaging message about important harm reduction tools, and threatens consumer safety.

Read the full piece here.