In a new @LawEconCenter regulatory comment on the DMA–GDPR interplay, @MBarczentewicz explains how the draft guidelines could add to cookie consent fatigue and weaken data security by limiting gatekeepers’ ability to protect users from bad actors. 🔗 ⬇️

👇

My new podcast with @eric_seufert is now out: this time on EU's new digital regulation reform proposal. Will it do anything for AI in Europe? Are cookie banners going away? If you prefer to read my notes on the conversation, they're now online too: https://t.co/Mpu20sKd0x

A good discussion of the shortcomings of the digital omnibus legislation and what is wrong with Europe's privacy rules. (And thanks for supporting the Constitution of Innovation!)

Good Thread and great way to say the hard truth Time to wake up It’s time to have an in-depth upgrade of Europe

For all its apparent good intentions, Europe can't get out of the "enforcement mindset." Great thread from @MBarczentewicz on why the EU's digital omnibus isn't going to change much of anything.

This is fantastic. Everyone should read this. 👇

How the EU’s 2024-2025 tech regulatory debate looks in practice: 1. The Commission proposes a change, which sounds good in theory, but one needs to read in between the lines (there is often a surprise hidden somewhere). Main keywords: simplification, deregulation, level-playing

If you want to read more:

If Europe wants fewer cookie banners and more technological progress, the real choice is not privacy versus innovation, but pragmatism versus performative maximalism.

Even this simplification is fragile. If the change is sold merely as “codifying” existing case law, privacy enforcers and courts can, over time, interpret “reasonably likely" to identify so broadly that almost nothing changes in practice. The law of everything quietly re‑emerges.

The irony is that a narrower, clearer scope for “personal data” would likely reduce the total amount of identifiable data processed in Europe. But for parts of the privacy community, giving up even a fraction of control is worse than that outcome.

It is exactly the sort of simplification Europe needs. Yet much of the early criticism has been almost reflexive: any limit on the GDPR’s reach is treated as an attack on privacy, and any shift of trust toward businesses is rejected on principle.

This would create a powerful incentive to restructure systems: let specialist entities handle identifiable data under full GDPR obligations, while others only see pseudonymous data they cannot link back to individuals.

On substance, the most promising part of the omnibus package is the attempt to narrow the definition of “personal data.” In plain language: GDPR should apply to you only if you are reasonably likely to identify the person behind the data you process.

A truly central EU data protection authority could also help – but only if built from scratch, with ideological neutrality and a duty to balance different parts of the public interest. Simply “upgrading” existing structures would not solve the problem.

Fixing this requires enforcement reform. One option: an EU‑level tribunal with a mandate to approve guidance and cross‑border cases, explicitly balancing privacy with innovation, competition and other EU goals.

Courts have so far been highly deferential to data protection authorities. In doing so, they failed to notice that many privacy enforcers behave less like general‑interest regulators and more like single‑issue campaigners.

But we cannot build a European digital economy on the hope that a few national authorities will be pragmatic while the EU‑level bodies are not.

There are positive counter‑examples. The French @CNIL has published pragmatic guidance on AI, which at least tries to make real‑world deployment possible. It is no coincidence that France has a national AI champion and a government that cares about that success.