Water flowing over Srisailam Dam in Andhra Pradesh, India in Aug. 2019. Photo by Sharath G. from Pexels (CC-licensed)

India’s Data Center Boom Should Learn from its Dams

A person takes a picture of the newly unveiled sign for Lake Ontario at Fifty Point Conservation Area in Grimsby, Ontario, on Saturday, Aug. 29, 2026. (Keito Newman/The Canadian Press via AP)

Canadian Hydronyms, Builders, and Other Adventures in Middle Power Tech Policy

The Muse logo is displayed on a smartphone screen placed on a reflective surface onto which the Meta AI logo is projected, in Creteil, France, on September 9, 2026, after Meta launched Muse, an autonomous personal artificial intelligence agent. (Photo by Samuel Boivin/NurPhoto via AP)

The Internet Was Built For Human Agency. AI Agents Are Changing the Rules.

A mouse pointer lingers on button in the shape of a cookie. Photo by: Lino Mirgeler/picture-alliance/dpa/AP Images

Photo by: Lino Mirgeler/picture-alliance/dpa/AP Images

Europe’s Cookie Law Is Really a Law About Surveillance

Image of map and computer language over binary codes on server racks in server room.

Global Digital Policy Roundup: August 2026

Electrical infrastructure with a data center in the background, and a large puddle of water on the ground with a reflection of the infrastructure. 

Electrical infrastructure at a Flexential data center in Hillsboro, Oregon, on May 16, 2026. (Photo by Alex Milan Tracy/Sipa USA)

To Change Data Centers, Flip the Narrative on Sustainability

A major data center project underway in Cape Town, South Africa. Photo: David Harrison/The Continent 

Cape Town is Approving Data Centers with Rules That Still Treat Them Like Warehouses

Students return to classrooms in Tuxtla Gutiérrez as the 2026–2027 school year begins across Chiapas. (Photo by Diego Pérez Gómez / JNA Press/Sipa via AP Images)

Building LLMs? Think Beyond Borders

Parents and teachers held a rally calling on Mayor Mamdani and NYC School Chancellor Kamar Samuels to have a two year moratorium on AI in public schools in New York City, NY. July 29, 2026 (Photo by Steve Sanchez/Sipa via AP Images)

Across the US, School Districts Wrestle With Classroom AI Policy

Deepfake vector illustration. Fake media method in tiny persons concept. Use artificial neural networks to make hoaxes video. Falsified machine learning autoencoders system. Fraud systems development.

China’s Disinformation Operations in Taiwan Are Changing with AI

New York Gov. Kathy Hochul (center), flanked by Attorney General Letitia James (right) and supporters, holds up one of two bills she signed in July 2024 aimed at protecting children and youth from the harmful effects of social media. Photo by Susan Watts/Office of New York Gov. Source

New York Gov. Kathy Hochul (center), flanked by Attorney General Letitia James (right) and supporters, holds up one of two bills she signed in July 2024 aimed at protecting children and youth from the harmful effects of social media. Photo by Susan Watts/Office of New York Gov. 

As Age Assurance Moves Into Practice, What Can Policymakers Learn From New York?

An illustration to depict a conceptual network, with various points connected by strings of different colors. The visualization represents networks, relationships, or interconnected systems, such as in social media, data flow, or neural networks.

Why the UK Needs Better Social Media Data Access to Research Online Harms

Within the frames are people bound to their office cubicles; beyond them, individuals work freely from diverse locations, connected through digital signals.

Digital Nomads Beyond the Cubicle by Yutong Liu & Digit / 

This Labor Day, Consider AI's Impact on Hiring

United States Representative Zoe Lofgren (D-Calif.) speaking at a hearing of the House Committee on Science, Space, and Technology Subcommittee on Energy at the US Capitol in Washington, DC, on September 2, 2026. (Photo by Michael Brochstein/Sipa via AP Images)

Rep. Zoe Lofgren on FISA, Surveillance and the Fourth Amendment

The landmark front entrance of the Virginia State Capitol in Richmond, Virginia, the historic seat of the commonwealth government, on April 18, 2025. Shutterstock

The landmark front entrance of the Virginia State Capitol in Richmond, Virginia, the historic seat of the commonwealth government, on April 18, 2025. 

Virginia Eyes AI Chatbot Rules as Observable Risks Warrant Action

New York City Schools Chancellor Kamar Samuels and Mayor Zohran Mamdani hold a press conference at the Brooklyn STEAM Center on September 2, 2026 in New York. Photo by: NDZ/STAR MAX/IPx

America’s Two Largest School Districts Impose AI Moratoriums

The OpenAI logo is displayed on a mobile phone screen in this photo illustration, as artificial intelligence tools continue to expand across consumer and business applications in Brussels, Belgium, on February 28, 2026. (Photo by Jonathan Raa/NurPhoto via AP)

What ChatGPT’s DSA Designation Means for OpenAI and the EU

Google CEO Sundar Pichai talks before a dinner with President Donald Trump and Japan's Prime Minister Sanae Takaichi in the State Dining Room of the White House, Thursday, March 19, 2026, in Washington. (AP Photo/Julia Demaree Nikhinson)

The Google Ad Tech Remedies Matter to You, Too

The Meta logo on a smartphone against a red background.

Without a Child Rights Framework, Meta’s $17.1bn Settlement Will Only Go So Far

Demonstrators take part in a protest against the deployment of an AI-assisted police surveillance system in Berlin on July 17, 2026. Photo by Andres Trujilo/ JNA PRESS(Sipa via AP Images)

Violent Anti-Tech Extremism Has Roots in History

Policymakers continue to debate artificial intelligence as if it were primarily a new category of software applications, comparable to social media or cloud computing, effectively treating the technology as if it were another bolt-on tool to the Internet’s architecture. But as AI agents proliferate, they challenge a deeper assumption: not what the Internet does, but who acts through it. And, early incidents with agents point at the need for a new architectural layer of the Internet, one that respects and protects human agency.

There’s a naive interpretation that simply sees AI agents as ‘users’—digitally they are no different than any person interacting online, whether it’s browsing content or shopping. However, as the term ‘agent’ implies, they are there as an intermediary between a human or an organization, and the network. Social scientists have long discussed 

, but for human agents. This field of study observes legal, contractual and communication relationships between people who act on behalf of others—elected officials, insurance agents, brokers, or real estate agents, for example. This extensive literature observes agents as information-incomplete actors who may inadvertently act in a misaligned manner; agentic AI should be viewed similarly, but at a more massive scale.

Multiply these capabilities, potential risks, and asymmetries by millions of deployments and the implications become much larger. Increasingly, Internet traffic will not simply represent humans clicking links, sending messages or making purchases. It will represent software acting on behalf of humans and increasingly interacting with other software acting on behalf of other humans and organizations, to varying degrees of success.

The human remains the principal, but the software increasingly becomes the actor exercising delegated authority. The question is no longer simply whether a user or device can be authenticated. It becomes: Which agent is acting? On whose behalf? Who authorized it? What exactly was it authorized to do? For how long? Under what conditions? Can those permissions be verified, constrained, audited and revoked?

Today's policy debates remain divided between two largely separate communities. Internet governance focuses on infrastructure, standards, interoperability, cybersecurity and digital rights. AI governance concentrates on models: how they are trained, whether they are safe and what outputs they produce. Both conversations are necessary, but neither is sufficient.

The current narrative on misaligned agents simplifies the problem of defining AI systems that have suddenly gone "

." The more nuanced observation is that systems designed to pursue human-defined objectives can increasingly navigate complex digital environments in ways their operators did not explicitly script step by step. The resulting risks are therefore not primarily about machines developing independent intentions. They are about humans giving increasingly capable systems increasingly consequential permissions. Operational autonomy should never be confused with moral or legal agency. The governance challenge is therefore how human responsibility survives when human intent is increasingly mediated through autonomous software.

What the literature on ‘principal-agent’ dynamics untangles, and what agentic governance must grapple with, is the complex liability and responsibility held by various actors. Humans and organizations remain responsible for the objectives they set, the permissions they grant and the systems they deploy. However, an agent acting in an unexpected manner is very different from human-agent misalignment, as agents are typically built and managed by a company. The governance challenge is therefore how human responsibility survives when human intent is increasingly executed through autonomous software.

This is not an entirely empty standards landscape. The 

 is developing mechanisms for agents and applications to access external tools and data, including an authorization framework based on OAuth. Likewise, 

—is intended to allow agents built by different vendors to discover one another, communicate and coordinate. The 

IETF is also seeing proposals for agent identity and verifiable delegation

, including mechanisms intended to bind agent identity, authorization and delegation across multi-agent workflows.

These efforts may look like separate standards conversations, but together they are beginning to construct something more consequential: an authority layer for the Internet. Identity, delegation, authorization and agent-to-agent interoperability will determine not just how machines communicate, but how authority moves between humans and machines. The opportunity is to connect these efforts around a common principle of verifiable human delegation, rather than allowing an agentic Internet to emerge as a collection of interoperable protocols with no shared model of accountability.

Technical standards are a difficult, but not insurmountable, task. The harder question is procedural: where does human authority sit when actions can pass through chains of agents, platforms and tools? Who decides how responsibility is divided, and what choices do people have when the negotiating actors are powerful companies? If that chain becomes opaque, attribution may survive technically while accountability disappears in practice.

How can the architecture of the agentic Internet preserve and expand human agency, rather than replace it? Technological agency means designing systems in which delegation is visible, permissions are meaningful, actions are attributable and authority can be withdrawn. It means preserving interoperability so users are not locked into a single agent or platform simply because that agent has become their gateway to the Internet. And it means ensuring that when an agent acts, there remains a clear line back to the human or organisation that authorized it.

The Internet did not become a global public resource because it was designed for autonomous machines. It became one because its architecture allowed different networks, technologies and communities to interoperate while leaving room for human choice. While the future of the Internet may well be increasingly agentic, it should remain, at its core, human-directed, human-accountable and human-centered.

Water gushing from a water dam, surrounded by nature. 

India's AI ambitions increasingly depend on physical infrastructure. Across the country, state governments are competing to attract data center developers with offers of subsidized land, infrastructure status, tax incentives, and commitments to expand electricity supply. Cumulative investment commitments 

exceeded US$126 billion by the end of 2025 and are projected to surpass US$180 billion in 2026

, while installed capacity is expected to grow 

. States including Maharashtra, Tamil Nadu, Karnataka and Andhra Pradesh have launched dedicated policies or large investment packages as they compete to become India's leading AI infrastructure hubs.

This is not the first time India has invested so heavily in infrastructure to drive economic transformation. India's first Prime Minister, Jawaharlal Nehru, described large dams as the "

" in 1954, underscoring the central significance of large infrastructure projects in the country's development strategy after independence from British rule. The 

 was enormous: India had fewer than 300 large dams at independence in 1947, but more than 4,000 by the year 2000, with over half constructed between 1971 and 1989.

Today's data centers are assuming a comparably important role. They sit at the center of India's AI ambitions and are being actively promoted through industrial policy. Like the large dams of the post-independence era, data centers are ambitious, capital-intensive projects intended to reshape the national economy. Both depend on significant state support and primarily promise benefits to the nation as a whole, rather than to local economies.

Looking at data centers through this longer history of infrastructure development in India raises familiar questions. How should projects of this scale be governed? How should environmental and social costs be weighed against national objectives? And how should their benefits be shared?

The promises surrounding large infrastructure are often framed at the national scale. Projects such as the Bhakra Nangal and Sardar Sarovar dams were presented as investments in electricity generation, irrigation and national development. Data centers are expected to deliver digital sovereignty, attract investment, create jobs, and provide the computing capacity needed for an AI economy. State governments 

as anchors for wider digital and industrial development, even as growing concerns about their environmental impacts have prompted 

These ambitions are important, but India's experience with earlier infrastructure projects suggests they tell only part of the story. Large infrastructure often distributes its costs and benefits unevenly. National gains may be measured through investment, economic growth and new forms of connectivity, while host communities experience projects through negative changes in land use, water availability, electricity demand and environmental conditions.

The experience of large dams makes this geography particularly visible. Dams generated electricity and irrigation for regions far beyond the valleys where they were built, while displacement and environmental change were 

. Data centers create a different pattern, but they too concentrate investment, resource use and environmental pressures in particular places while delivering benefits much more widely. Mumbai and Chennai together account for roughly 

two-thirds of India's data center capacity

, and many existing and proposed facilities are located in 

regions already experiencing water stress

Mumbai illustrates the wider implications of this concentration. The city has become India's leading data center hub through its connectivity advantages and sustained policy support, yet its rapid expansion has also 

intensified debates over electricity demand, public subsidies, and the allocation of scarce urban resources

. Where dams displaced entire communities in the service of new reservoirs and electricity generation, data centers compete more quietly for land, water allocations, and subsidized power. Host regions therefore bear concentrated resource demands while many of the resulting economic benefits accrue elsewhere — in the profits of technology firms and investors, or in digital services consumed far beyond the communities hosting the infrastructure.

This matters because AI infrastructure depends on resources that are not evenly distributed. India is home to around 

18 percent of the world's population, but has only around 4 percent of its freshwater resources

. Data center water demand is projected to 

more than double over the next five years

, from roughly 150 billion liters in 2025 towards 358 billion by 2030, while electricity consumption is expected to 

rise from about 0.8 percent of demand to over 2.5 percent

, placing additional pressure on a power system that remains heavily dependent on coal. These pressures will be experienced most directly by the regions that host this infrastructure rather than by the users who ultimately benefit from it.

Rather than asking only how many data centers India should build, policy discussions therefore need to consider where they are located, how resources are allocated, and how host communities share in the benefits they generate.

Questions of governance become particularly visible once projects move from announcement to implementation. A 

large AI data center project underway in Visakhapatnam

 illustrates why. Its environmental clearance was challenged after it was approved without a public hearing, having been classified as a building project rather than as infrastructure requiring a more extensive environmental review. The case raises broader questions about whether existing regulatory frameworks are equipped to govern infrastructure of this scale.

Similar debates surrounded many of India's large dams. The 

, for example, faced decades of legal challenges, environmental scrutiny, and conflict over displacement and rehabilitation before it was completed. Such conflicts were not simply obstacles to infrastructure development. They also forced questions about who should bear its costs, whose voices should count in decision-making, and what responsibilities states and developers have towards affected communities.

Despite the similarities in the “mega infrastructures” of dams and data centers, the differences between them reveal the extent of India’s shift towards market led development.

First, funding. The Government of India has historically been a major financier and developer of large dams. Data centers, by contrast, are largely financed by private corporate capital, including American Big Tech companies and Indian conglomerates, such as the Adani Group, while governments provide land, 

 and power. The state has therefore shifted from owner-financier to facilitator of privately financed infrastructure.

Second, control over output. Dam electricity entered publicly regulated systems of distribution. Data centers produce privately controlled computing capacity whose distribution stays opaque. Will it be made available to Indian startups and institutions or primarily serve the companies that own it? What claim does the public have over infrastructure enabled by subsidized land, water, and electricity?

Third, contestation. Protests against the Sardar Sarovar Dam eventually forced recognition of displacement and resettlement of communities. Opposition to data centers, by contrast, has been more readily stifled or recast as resistance to development itself — or even "anti-national."

Data centers, then, sit comparatively closer to India’s “

”, state-based enclaves that use land, infrastructure, tax concessions, and regulatory advantages to attract private investment, and that have themselves generated some of India’s

. In India, these zones became particularly important to the growth of the 

. Data centers extend this model into the digital economy, with public resources, again, mobilized for privately controlled infrastructure.

Governing the next infrastructure transition

Aside from the question of whether India should build data centers, is how these projects should be governed. The rapid expansion of AI has created pressure to move quickly. Governments are competing to attract investment, while developers are racing to build capacity. Yet India's infrastructure history suggests that governance questions rarely disappear when postponed; they re-emerge later through litigation, public opposition, environmental conflict, or expensive policy corrections.

India has considerable experience confronting the social and environmental challenges of large infrastructure projects. Conflicts over dams helped shape debates and policy around environmental assessment, public hearings, rehabilitation and compensation. There is a history of learned best practices to draw on.

Elsewhere, governments have experimented sharing infrastructure benefits more directly with communities. 

Nepal has introduced local share ownership

 and royalty payments for hydropower projects, while 

Wales is considering community ownership requirements

 for large renewable energy developments. These are not ready-made solutions for data centers, but they demonstrate that who benefits from infrastructure is a matter of policy design, not an inevitable outcome.

As India's AI infrastructure expands, the challenge is therefore not simply to accelerate investment but to govern it well. That means recognising the demands data centers place on land, water and electricity; requiring greater transparency around their environmental performance; ensuring meaningful consultation before approvals are granted; monitoring environmental and community impacts throughout their operation; and exploring ways for communities hosting data centers to share more directly in the benefits they generate.

It also means leaving space for public scrutiny and contestation. As earlier infrastructure conflicts in India have shown, resistance can expose overlooked costs and force questions of accountability and transparency into public debate.

The technologies may be new, but the governance challenges are not. India has built transformative infrastructure before. Its experience shows that the real test is not simply how quickly infrastructure can be built, but how its costs, benefits and risks are shared once it arrives.

 of location data linked to visits to over 600 Planned

 in the United States. The dataset showed where groups of visitors had come from, how long they stayed, and where they went next. The broker withdrew the product after the story was published. However, the market behind it remained.

Europe has seen a similar market emerge. Journalists have obtained 

. The data exposed movements around hospitals, religious sites, trade union offices, government ministries, military sites, EU institutions and NATO buildings. Information gathered through ordinary apps for advertising can reveal intimate details of people’s lives, identify public officials and create security risks for entire institutions.

These examples illustrate a distinction at the heart of what people usually call ‘EU privacy law’ that may seem unnecessarily fussy to readers elsewhere. In the United States, ‘privacy’ often covers the whole problem, while EU law recognizes two distinct fundamental rights. 

 of Fundamental Rights of the Union protects private life, the home and communications, while 

The distinction is quite important: whereas data protection largely governs what happens when personal data are processed, privacy and communications confidentiality also protect the space from which information is obtained. They put a boundary on entering that space in the first place.

 around that question. ePrivacy adds specific rules for the confidentiality of communications and access to information stored on, or generated by, people’s devices, including rules covering communications, metadata, and location. While the General Data Protection Regulation (GDPR) primarily governs access to personal data — what organizations might do with data once they have processed it. This distinction matters, and it disappears when ‘privacy’ becomes a casual synonym for data protection.

The law everyone notices in the wrong place

Most people meet ePrivacy through a cookie banner, and this may be the worst possible introduction. A framework about confidentiality looks like a tedious set of rules about pop-ups, while the tracking industry points to the pop-ups it helped create as proof that the law has failed.

, the provision behind many banners, controls when an actor may store information on, or obtain information from, a person’s terminal equipment. But it goes beyond that: ePrivacy is concerned with the act of accessing the device itself.

“Terminal equipment” includes phones and laptops, connected cars, televisions, wearables, smart glasses and other parts of the Internet of Things. The rule covers fingerprinting, tracking pixels, local storage, operating-system identifiers and instructions that make a device send information elsewhere. The principle is straightforward: a device does not become open to inspection simply because one fragment of information cannot identify its user on its own.

ePrivacy also protects communications confidentiality and regulates the traffic and location data held by communications providers. It limits retention and reuse, covers unsolicited communications, and sets the conditions under which Member States may restrict confidentiality. 

The ePrivacy Directive’s scope has never matched the way people use digital services. It was written around traditional telephone and communications providers, meaning that many online services originally were excluded from its protection. 

Messaging and webmail services can now fall under

, but coverage still depends on legal classifications that users cannot see. The same message, location trail, or device data can receive different protection depending on whether the company is labeled a telecom provider, messaging service, or platform: under these conditions, is the law still protecting the underlying right?

The distinction between GDPR and ePrivacy becomes even more important when we look at surveillance. From one side,commercial surveillance commonly starts before the GDPR question even arises, with access to a device or a communications-related signal: for example, an app includes a software kit that collects location, a television records viewing habits. These small acts of access feed systems of profiling, advertising, measurement and sale.

While the GDPR remains essential once personal data enter that chain, ePrivacy asks the question that comes first: Is the provider allowed to use traffic or location data? Can a tracker read from a device, or must a communication remain confidential? It does not regulate the entire data-broker market, but it can close some of the taps that supply it.

The same distinction matters in terms of state surveillance. ePrivacy has shaped 

one of Europe’s longest surveillance disputes:

. Governments have repeatedly wanted providers to keep traffic and location data for later use by police and security bodies. 

 allows restrictions for public objectives, but they remain subject to the Charter, including the necessity and proportionality requirements in 

The resulting Court of Justice case law — from 

 — has become complicated. While the Court rejects general and indiscriminate retention of traffic and location data as the default, it allows targeted retention and some limited forms of general retention.

A record of who contacted whom, when, for how long and from where can reconstruct a life without revealing the content of a single message. Repeated calls to an oncology department may disclose a diagnosis. A phone present at an abortion clinic, mosque, union office or demonstration may reveal health, religion, employment relations or political activity.

This is why ePrivacy matters: the metadata can be revealing long before anyone even reads the message.

Commercial and state surveillance involve different powers and safeguards. Still, they increasingly use the same infrastructure. In the United States, ICE and Customs and Border Protection bought

 access to phone-location data gathered through ordinary apps

 and sold by brokers. The authorities did not need to build their own tracking system; the advertising industry had already collected people’s movements at scale.

Spyware makes the overlap even clearer. Pegasus-type tools are developed and sold by private companies, then used by public authorities against journalists, activists, lawyers and opposition figures. They can enter a phone, access communications and metadata, follow location, and activate microphones or cameras. The European Data Protection Supervisor 

has explicitly connected spyware deployment to the ePrivacy Directive

 where EU law applies, and described the phone as a person’s “virtual domicile.” A commercial market is selling the capacity to enter the devices and communications that ePrivacy is meant to protect.

The proposals commonly called “ChatControl

” have made this question unusually concrete. Can communications remain confidential when private providers scan them for a public-policy

purpose? The legal link is direct. Once many messaging and webmail services came within the scope of the ePrivacy’s confidentiality rules, practices that had previously been assessed mainly under the GDPR now also had to comply with 

Articles 5 and 6 of the ePrivacy Directive

, which protect communications and traffic data. That meant providers wishing to continue voluntary scanning could no longer rely on a GDPR legal basis alone, but also on a specific exception from confidentiality rules.

 for that purpose. It created a temporary derogation that allowed providers, on a purely voluntary basis and subject to conditions, to use technologies to detect and report child sexual abuse material and the solicitation of children, without providing a legal basis for scanning. While negotiations on a permanent framework continue, the co-legislators have twice renewed the derogation with 

The need for a derogation is important: A GDPR legal basis does not give you a free pass through the ePrivacy door, both layers must be satisfied.

ChatControl also shows the blurred lines between private and public surveillance. The service and technical infrastructure are private, but the objective and legal pressure come from public authorities. People use confidential communications to speak with lawyers, doctors, journalists, family members and support organizations, to organize politically, report wrongdoing and seek help. 

 requires any restrictions to that space to be lawful, necessary and proportionate. This matters, even if the objective to pursue is worthy

How the EU made its confidentiality law look obsolete

The ePrivacy Directive is indeed outdated. It dates from 2002 — with its best-known amendment in 2009 — its terminology reflects an earlier telecoms market; its enforcement is inconsistent, both in terms of insufficiencies and lack of harmonization, and cookie banners have become a tool for manipulation rather than meaningful choice. But the EU did try to replace it.

 covering internet-based communications, metadata, tracking technologies and connected devices. However, industry groups argued that the GDPR was sufficient, demanded greater flexibility for further processing and opposed stronger limits on tracking. Civil society, consumer organizations and data protection authorities wanted stronger confidentiality and better protection for metadata and devices. Member States disagreed over scope, enforcement, exceptions and data retention. After years of negotiations, the 

The Commission is not a neutral observer in what followed. It proposed the ChatControl framework and its temporary derogation, is working towards a 

, and has now proposed moving important terminal-equipment rules into the GDPR through the 

Industry, the Commission and Member States do not form a single alliance. Their interests often conflict: companies want more room to use device and communications-related data for advertising, analytics and AI; many governments want providers to retain data for law-enforcement access; and the Commission wants to show simplification while expanding lawful-access tools. The net result is pressure to treat confidentiality as friction requiring an exception, derogation, or more flexible legal regime.

What changes when device access moves into the GDPR

The Digital Omnibus was completely inadequate from the

 outset, but tried to address one real problem: people are tired of banners that repeat the same question, hide the refusal button or turn privacy into an endurance test.

But simplifying the consent should not mean simplifying the rights away.

The Commission’s proposal keeps consent as the general rule for storing or accessing personal data on a person’s device, while widening exceptions. But it would split the same act between two regimes. Access to personal data would fall under the GDPR, while other information could remain under ePrivacy. Oversight would also shift towards the GDPR’s one-stop-shop system, whose record in holding large technology companies accountable has been poor.

Much of industry is pressing for more, with some companies seeking to access devices aligned with all GDPR legal bases, 

A business interest in advertising, analytics, security, service improvement, or AI development may explain what a company wants to do with information. But it does not, by itself, answer whether the company is allowed to enter the device in the first place. 

There is a better response to the so-called cookie fatigue.

 People should be able to express privacy choices — both refusal and consent — once through browsers, operating systems, apps, or other user-side tools, and services should have to respect those 

. This would remove many banners without getting rid of the boundary.

The EU also needs clearer rules for new communications services, consistent enforcement, and updated protection for metadata, location and connected devices. It needs an honest debate about state access too. A 

 will determine how far governments can turn the records of ordinary communications into a standing investigative resource.

The strange thing about ePrivacy is that people tend to notice it when it is ineffective and to overlook it when it matters most. We see the banner, but rarely the rule limiting a provider’s use of location data, the judgments against indiscriminate retention, or the need for a derogation before private messages can be scanned.

This invisibility has made ePrivacy easy to attack. Industry can reduce it to cookies. Governments can describe confidentiality as an obstacle to investigations. The Commission can call the remaining division between ePrivacy and the GDPR unnecessary complexity.

distinction between privacy and data protection remains valuable: connected cars, smart televisions, phones, and always-on communication devices expose more than ever our everyday lives. As the boundary between the physical world and the digital world thins, so does the idea that privacy is only about data collected. That’s why a crucial protection is stopping someone from accessing it in the very first place.

If you look at the Great Lakes on Google or Apple Maps from the United States, you might notice that Lake Ontario is now labeled “Lake America.” Named long ago and commonly traced to the Wendat word Ontari’io, the change follows an 

 from President Donald Trump directing the US government to rename the body of water. The order was issued amid a trade war, part of Trump’s strategy to leverage US economic integration with its northern neighbor to erode Canadian sovereignty.

 for US-based users. But users geo-located in Canada, Google says, will find the lake labeled with its usual name, and those outside both countries will see both names. Shortly after the change, however, some Canadian government and financial institutions 

 Lake Ontario as Lake America. The change likely resulted from their reliance on data accessed from Google’s API to display maps on their sites. The incident illustrates a larger problem: as tech and state power have merged under the Trump administration, Canada has struggled to ensure autonomy for institutions and people reliant on US tech—which is most institutions and people in Canada.

The Carney government is widely celebrated for its middle power 

 to the tech-fueled ambitions of US empire. Memes, slogans, and speeches evoking desires to build circulate widely in Canada. There is ‘build, baby, build,’ an election night meme, and ‘build, partner, buy,’ an industrial strategy for defense and AI (also a meme). The middle power approach, however, is an international overture to other state actors. How it informs policy for addressing tech companies tied in with the US state (and that follow its directives) is less obvious.

The Canadian tech policy landscape is more kludge than doctrine. It includes largely rhetorical ambitions to build, well-meaning gestures toward 

, and a generally accelerationist AI posture (

). Industry’s fingerprints are apparent, including on Minister of Canadian Identity and Culture Marc Miller’s proposed bills on social media, in trade deals, 

, and in public consultations and data center 

 bloated with industry talking points. Miller’s bills, in particular, address public concerns, including social media safety for children and teens (

. The consultations were rushed, however, and the government failed to adequately distribute agency into public and civic sectors with the AI transparency (

). Despite the duty of care model incorporated into 

, these legislative interventions are not organized around a comprehensive taxonomy of vulnerabilities, risks, or harms that can handle the collision of tech and state power shaping the AI moment.

Part of the problem is that Carney’s ‘builder’ mindset is associated with industry deployment, not government regulation. This dichotomy limits how Canadians understand building and emboldens the political ambitions of tech actors that create systematic vulnerabilities in Canada’s tech and AI policy.

A middle power approach to tech accepts an inability to compel platform and AI companies to align with Canadian values, principles, and laws. In fact, the diminished role of regulatory power is framed as a principle of partnership for building technologies with companies. It is an intentionally distinct posture from the previous liberal government, and powerful actors are pursuing its implications in different ways.

On the one hand, there is the example of Cohere. The company 

itself in middle-power desires for digital sovereignty that dependencies on US tech companies have created. Whether it is 

 on enterprise infrastructure so politicians cannot meddle with national 

 or restrict access to a systemically important AI provider, Cohere executives use middle-power sovereignty 

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe