A blurred black-and-white portrait of a man on the left, with the xAI company logo displayed on a screen to the right against a black background.

What Data Was Your AI Trained On? xAI Doesn't Want You To Know

Multiple floating video screens displaying various images—including cityscapes, technology graphics, and nature scenes—arranged in a layered, three-dimensional pattern against a blurred, dark background of digital displays.

The Web Needs a Context Layer Built on a Shared Protocol

Helen McEntee, Ireland's Minister for Foreign Affairs and Trade, outlines priorities for Ireland's upcoming EU Council Presidency on June 10. Source: Irish Presidency of the Council of the EU 2026.

Blaming Ireland Misses Where Europe’s Digital Agenda is Really Set

Federal Trade Commission Chairman Andrew Ferguson speaks during a roundtable with Vice President JD Vance and state attorneys general on anti-fraud initiatives in the Eisenhower Executive Office Building on Tuesday, May 26, 2026. (Tom Williams/CQ Roll Call via AP Images)

The FTC Statement on AI Bias Lacks Conviction

A woman walks by a giant screen displaying the Google logo at an event at the Paris Google Lab on the sidelines of the AI Action Summit in Paris, Feb. 9, 2025. (AP Photo/Thibault Camus, File)

The High Stakes Behind the EU’s €890M Google DMA Fine

Digital concept with the flag of Europe on a tech background. Europe in the context of cybersecurity, programming, and digital sovereignty. Symbolic image of site development in Europe

How the Digital Omnibus Could Unravel Europe’s Digital Safeguards

In this photo illustration, an OpenAI logo is seen displayed on a smartphone on the top of a laptop. (Photo by Omar Marques / SOPA Images/Sipa USA)

The Real Lesson of OpenAI's 'Rogue' Agent Isn't Alignment

US President Donald Trump talks to CEO of OpenAI Sam Altman while CEO of Google DeepMind Demis Hassabis looks on as they participate in a meeting with leaders during the G7 summit, Wednesday, June 17, 2026, in Evian-les-Bains, France.

Is the Age of Purely Private-Sector AI Coming to an End?

Chinese President Xi Jinping, center takes a group photo with other attendees before the opening ceremony for the World AI Conference in Shanghai, Friday, July 17, 2026. (AP Photo/Ng Han Guan, Pool)

The World Must Decide How to Govern AI While the Decision Is Still Ours

A brightly coloured mural which can be viewed in any direction. It has several scenes within it: people in front of computers seeming stressed, a number of faces overlaid over each other, squashed emojis, miners digging in front of a huge mountain representing mineral resources, a hand holding a lump of coal or carbon, hands manipulating stock charts and error messages, as well as some women performing tasks on computers, men in suits around a table, someone in a data centre, big hands controlling the scenes and holding a phone, people in a production line. Motifs such as network diagrams and melting emojis are placed throughout the busy vignettes.


Making the Case for Actionable Prosocial Design Research

Can the Pall Mall Process Curb Spyware Abuse?

United Nations Secretary-General António Guterres addresses the opening ceremony of the 2026 World AI Conference and High-Level Meeting on Global AI Governance on July 17, 2026 in Shanghai, China. Themed "AI Partnership for a Brighter Future," the event included more than 140 forums, bringing together 1,400 guests from home and abroad. (Photo by VCG/VCG via AP)

United Nations Secretary-General António Guterres addresses the opening ceremony of the 2026 

World AI Conference and High-Level Meeting on Global AI Governance

 on July 17, 2026 in Shanghai, China. Themed "AI Partnership for a Brighter Future," the event included more than 140 forums, bringing together 1,400 guests from home and abroad. (Photo by VCG/VCG via AP)

UN Scientific Panel Warns of AI Concentration, But UN’s Vision Entrenches It

Flock Safety camera at the intersection of West Sylvania Avenue and Homeville Circle in Toledo, Ohio. The ubiquity of Flock surveillance systems in the United States raises questions about privacy and data security. (Photo by Stephen Zenner / SOPA Images/Sipa USA)(Sipa via AP Images)

Flock Safety camera at the intersection of West Sylvania Avenue and Homeville Circle in Toledo, Ohio. The ubiquity of Flock surveillance systems in the United States raises questions about privacy and data security. (Photo by Stephen Zenner / Sipa via AP Images)

Researchers Detail How AI Systems Can Enable Authoritarianism

Portland, OR, USA - Sep 1, 2024: ChatGPT, Gemini, Microsoft Copilot, Claude, and Perplexity app icons are seen on a Google Pixel smartphone. AI competition concepts.

ChatGPT Didn't Break the AI Act. It Showed Why Adaptive Regulation Matters

Social media puppeteering the public through paid political influence — a hand emerging from a smartphone controls a wooden marionette by red strings.

How to Close the Federal Election Commission’s Dark Money Loophole

European Union flag displayed on a screen and AliExpress, Temu and Shein icons displayed on a phone screen are seen in this illustration photo taken in Krakow, Poland on July 1, 2026. (Photo by Jakub Porzycki/NurPhoto via AP)

(Photo by Jakub Porzycki/NurPhoto via AP)

EU Turns to Online Marketplaces After Record AliExpress Fine

A photo of a Team Spain player taking a corner kick during the 2026 FIFA World Cup final.

EAST RUTHERFORD, NJ - JULY 19: Nico Williams of Team Spain takes a corner kick during the 2026 FIFA World Cup Final between Spain and Argentina on July 19, 2026 in East Rutherford, New Jersey. Spain defeated Argentina 1-0 to win the tournament. (Photo by Liu Lu/VCG via AP)

The World Cup Ends Today. The Surveillance Will Continue.

BIDDEFORD, MAINE - JULY 15: A person observes a makeshift memorial for Joan Sebastian Durán Guerrero, a 26-year-old Colombian immigrant who was fatally shot by US Immigration and Customs Enforcement (ICE) agents, on July 15, 2026 in Biddeford, Maine. Guerrero's death comes less than a week after federal immigration agents shot and killed 52-year-old Mexican national Lorenzo Salgado Araujo in Texas. (Photo by Ryan Murphy/Getty Images)

ICE and the Architecture of Authoritarianism

Spain fans gather for a rally on the eve of the World Cup final soccer match in New York's Times Square, Saturday, July 18, 2026 (AP Photo/Yuki Iwamura)

The Silent World Cup Winners are the Companies Normalizing Surveillance

Miami, June 24, 2026: WORLD CUP, BRAZIL vs. SCOTLAND. General view of the VAR screen at the Miami stadium for the match between Brazil and Scotland in the 2026 World Cup. Photo: Rodolfo Buhrer/AGIF

Soccer's Tech Revolution Has a Labor Chain

fined Google a total of 890 million euros

 after finding the company violated the Digital Markets Act (

) by favoring its own services in Google Search and restricting app developers' ability to steer users to alternative purchasing options from their apps distributed through the Play Store. 

The Commission imposed a €460m fine for Google’s search-related practices and €430m for its Play Store policies. The decision follows a 

 Google of its preliminary finding of the company’s noncompliance the following year. Regulators 

 of the DMA, which states that Google cannot self-preference its own services in ranking and indexing, and mandates that the gatekeeper apply transparent, fair and non-discriminatory conditions to such ranking. 

The Commission also found Google non-compliant with 

, which mandates that Google allow app developers to communicate cheaper deals and alternative distribution.

 it was reviewing the decision and evaluating whether to appeal. Kent Walker, president of global affairs at Google and Alphabet, criticized the ruling, saying it would harm European businesses and consumers. “Regulation should improve products, not make them worse,” he 

The decision also arrives amid growing tensions between Brussels and Washington over EU regulation of US technology companies. The US administration has opposed enforcement of the DMA, with 

 that Under Secretary of State for Economic Affairs Jacob Helberg said the law accounts for “90% of the problems” between the United States and the EU in trade negotiations.

Earlier reports suggested the Commission had 

 amid concerns about a possible reaction from President Donald Trump. EU officials 

 that the timing was linked to trade tensions. A senior EU official told 

“that they had no knowledge of how Trump was likely to react, insisting that it had the ‘sovereign right’ to regulate US tech companies in its own jurisdiction and the timing of the fine was not connected to tariffs.”

Teresa Ribera, Executive Vice-President for Clean, Just and Competitive Transition, 

 that the decision is “decisive yet balanced”, adding that “the best products should succeed because they're better, not because they're owned by the company running the search engine.”

Google has a long history of self-preferencing complaints. The European Commission 

 against Google in 2010 for more prominently placing its own services in Google Search results. In 2017, the Commission handed a 

for abusing its dominance in the search market by favoring its comparison shopping service over competing services, stating that Google must adhere to the “principle of equal treatment.” The European Court of Justice 

 Google’s appeal on the matter, confirming that self-preferencing can constitute abuse of dominance in itself if the practice restricts competition on the merits.

A ban on self-preferencing was then transplanted into the DMA, and despite the long litigious history of the Google Shopping case, the Commission immediately opened the non-compliance 

 into Google. The preliminary findings of non-compliance came despite Google’s 

 its results page to “boost the prominence of comparison sites for free in categories like flights, hotels, and shopping, among others.”

While Google has made changes to meet compliance for self-preferencing on Search, the Commission 

 in Thursday’s ruling that the company treats its own services, such as shopping, hotels, transport and sports results,

more favorably in Google Search results than similar services offered by third parties. The Commission has found that Google

gives its own services more prominent treatment compared to others by displaying them at the top of Google Search results or on dedicated spaces, with enhanced visual formats and filtering mechanisms.

 that Google has proposed and begun to test changes to how it displays its own free services, which will continue to be monitored by the regulator. The press release 

 that such changes “constitute substantial progress towards compliance.” However, the Commission will also consider how Google plans to “apply the principles of the decision to AI Overviews and AI Mode, on which dialogue will continue,” flagging the possibility for new challenges. The Initiative for Neutral Search 

 that “structural, lasting change” is needed, adding that “if it fails to include AI overviews and AI Mode into the DMA’s self-preferencing ban, Google will once again be in a position to undercut fairness and restrict competition.”

, the company outlines the various changes made by the gatekeeper, such as deprecating the Google Flights unit on the search results page and introducing a feature to make user clicks on entity results trigger a new result or preview page to show search results for that entity. The report gives the example of a user searching “hotels Brussels” and clicking on one of the hotel entities shown in the results (e.g., Hotel Amigo). The user will see a preview of the results that Google Search would show if the user searched for that specific hotel on Google Search.

Google states that it has not made substantial changes to its ranking of search results, which continue to be based on machine learning with human feedback. Google explains that results are rated against how relevant the results are for a given query, as well as quality of results, which are based on “expertise, authoritativeness, and trustworthiness of the underlying content.” Google adds there are other criteria, such as context, which includes user location or Search settings, as well as webpage “usability”, such as the webpage experience.

Google has not allowed app developers to place direct links within an app to direct users to an alternate payment method and has required that developers use Google Play’s billing system, for which it charges a commission of 30% on transactions. The UK’s Competition and Markets Authority noted in its own 

 that “in some respects, Google’s rules have become more closely aligned with Apple over time.” They noted that from 2022, all developers selling digital goods in their apps must only use Google Play’s billing system, paying a service fee on the purchase. Google 

 that app developers not compliant with the change would be removed from the Play Store.

Google’s 30% commission rate and restrictions on alternative billing have been the subject of antitrust cases outside of the DMA, including 

Epic Games, a games developer famous for producing Fortnite, filed lawsuits against both Apple and Google for engaging in monopolistic practices due to the restrictions. Epic 

 against Google, with the jury ruling that Google had engaged in anti-competitive practices for its billing system requirement. Following appeals, the case 

, with Google allowing developers to steer users to alternative payment methods.

The Commission finds Google’s Play Store steering rules noncompliant with the DMA as Google has placed technical barriers to prevent steering, including alternative app stores, and finds that Google’s steering fees “went beyond what is considered compliant with the DMA.” While the company is allowed to receive a fee for facilitating the initial acquisition of a new customer by an app developer via Google Play, the Commission takes issue with the length of the charging period.

 a new global fee structure which took effect from June 30, 2026, and includes the ability for developers to steer users to alternative distribution. The new terms state that even steered transactions will be subject to a service fee of 10% for recurring subscriptions, and Google has updated its Google Play Games Level Up program in which steered transactions will attract a 15% fee. The Commission has stated in the 

 that these changes “constitute good progress towards compliance and will also be assessed in light of the cease and desist order of today's decision.” It is notable that the UK is 

 a parallel investigation and is actively seeking feedback regarding this new policy.

The fine is significant due to its long delay and size. Despite the DMA setting out a 

 for non-compliance decisions, the proceedings have far exceeded this. The long delay has prompted outcry from industry and civil society alike. A recent open letter 

 Commission President Ursula von der Leyen to more effectively enforce the DMA, and an 

 by 18 organizations specifically called for a non-compliance decision to be made for the Google Search case.

It remains unclear why the decision has taken so long. Teresa Ribera, the Commissioner in charge of competition, has 

 that the cases are “complicated”, with 

 indicating that regulators have tried to give Google more time to propose compliance solutions. However, the DMA has come under 

Early reactions to the fine have mostly been positive, with many acknowledging the fine’s delay and some criticism of the size of the fines. The European Consumer Organization released a 

 in support of the fine but warned that the Commission must not hesitate to impose further sanctions. Thomas Höppner, a competition lawyer and DMA litigator, 

 the decision’s delay but noted that the decision opened the door to what could become the most significant improvement in the quality of online search in two decades.

However, Johannes Reck, CEO of GetYourGuide 

 that “a fine alone” will not change Google’s long history of harmful practice, encouraging the Commission to impose “recurring fines that make compliance the better deal.” Max Bank, EU Competition Lead at Rebalance Now, in a statement to Tech Policy Press, said the fine was “the right decision” but encouraged “structural remedies, including requiring Google to divest its advertising business.” Bank also warned against delaying decisions “driven by fears from Washington”, as this “only leaves Europe vulnerable to coercion."

Google now has the chance to appeal the decision, with regulatory dialogue expected to continue. As indicated in the 

, the Commission is monitoring Google’s recent proposals for compliance with the Search ruling, and the Commission will consider Google’s new Play Store terms. However, Google could face periodic penalty payments of up to 5% of its average daily worldwide turnover if its proposals are deemed non-compliant and a new solution is not found within 60 days.

On July 1, just hours before the holiday weekend, the Federal Trade Commission (FTC) 

 its “Proposed Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems.” The statement complies with 

, which directed the FTC, within 90 days of the EO, to publish a statement that “must explain the circumstances under which state laws that require alterations to the truthful outputs of AI models are preempted by the Federal Trade Commission Act’s prohibition on engaging in deceptive acts or practices affecting commerce.” Despite being a part of the administration’s cross-agency push to decrease AI regulations, the FTC’s statement articulates a fairly aggressive theory of regulating AI models under the Commission’s deception authority and does not meaningfully argue for any implied preemption theory freeing companies from state laws regulating artificial intelligence.

The Trump administration has tried a variety of mechanisms to rid AI companies of state consumer protection laws. These efforts hit their 

 one year ago, on July 1, 2025, when the Senate voted 99 to 1 to remove the White House’s poorly conceived and likely unconstitutional 10-year moratorium on state AI regulation enforcement. Following this legislative failure and an 

 to insert the same moratorium into a defense spending bill, President Trump attempted to accomplish industry’s goals through Executive Order 14365, “

Ensuring a National Policy Framework for Artificial Intelligence

Executive Order 14365 states that “it is the policy of the United States to sustain and enhance the United States’ global AI dominance through a minimally burdensome national policy framework for AI.” The Order identifies the “patchwork of 50 different regulatory regimes” as antithetical to a national policy, and announces a variety of preemption-focused actions to address state AI regulation:

A DOJ task force that will challenge state AI laws for, among other things, “preempt[ion] by existing Federal regulations.”

An FCC “proceeding to determine whether to adopt a Federal reporting and disclosure standard for AI models that preempts conflicting State laws.”

An FTC policy statement that “must explain the circumstances under which State laws that require alterations to the truthful outputs of AI models are preempted by the Federal Trade Commission Act’s prohibition on engaging in deceptive acts or practices affecting commerce.”

A legislative recommendation for a “Federal policy framework for AI that preempts State AI laws that conflict with the policy set forth in this order.”

The order takes aim in particular at the (now repealed and replaced) Colorado law that allegedly required AI companies to “embed ideological bias within models.” (The original Colorado law did not expressly require companies to “embed ideological bias,” but it did require 

measures to protect against algorithmic discrimination

The pretext of the FTC’s role in the executive order is that a law like Colorado’s 

 the AI model to deceive consumers and thus actually conflicts with the FTC Act’s prohibition against deception. The order directed the FTC to issue a formal policy statement within 90 days articulating an implied preemption theory that would render laws such as the Colorado law unenforceable. The two-part mandate of this executive order is to assert the application of the FTC Act to AI models and to make a case for state-law preemption.

Immediately upon the announcement of the executive order, 

 that the FTC Act did not conflict with any state laws, including Colorado’s. In addition, the Colorado statute was subsequently 

 to clarify that the various federal and state civil rights laws would be the yardstick on which AI systems would be measured to prevent bias in housing, employment, lending, and other critical decisions. Thus, when the March deadline for the FTC’s order came and went, some observers simply assumed that the Commission and White House had agreed that with the Colorado law repealed, the policy benefits of a potential statement no longer outweighed its legal dubiousness.

Then, on July 1, 2026, almost four months after the 90-day deadline, the FTC released its “Proposed Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems.” The statement begins by explaining the significance of AI in the modern economy and the current administration’s goal of “removing regulatory barriers that impede AI innovation.” The statement then explains that the Commission polices the marketplace against deceptive acts or practices, whether implied or express. Finally, the statement articulates that the Commission has the ability to use its deceptive practices authorities in areas of new technologies, including AI systems.

Throughout the statement, the Commission repeatedly sensationalizes that AI companies with hidden agendas plan to indoctrinate unsuspecting users with progressive ideology. The statement asserts that “AI technologies should not be used to silence or censor lawful expression of dissent.” The statement further speculates that an AI “company could be tempted, for example, to abuse consumer trust by training a model surreptitiously to produce ideologically motivated distortions in a response to a factual question, such as to correct what the developer believes are ‘historical injustices’ in the facts.” The statement reads like the FTC intends to sue companies for deceptive practices if the output of their AI models includes liberal ideology.

But, the legal analysis in the statement applies the deception prohibition of the FTC Act to statements 

 AI models. The statement does not threaten to sue if an AI model makes a statement that the FTC believes to be imbued with a liberal agenda. Instead, the statement stands only for the anodyne proposition that the deception prohibition of the FTC Act applies to claims about AI chatbots. The FTC can sue if a company expressly or impliedly represents that its chatbot will not have a liberal agenda, when in fact the company instructed the chatbot to have a liberal agenda. But, under this theory, to the extent that a company wanted to make their chatbot “woke,” as the FTC suspects is rampant, they are free to do so, provided they do not make representations—express or implied—to the contrary.

To be clear: although the statement does not claim that liberal AI outputs are 

 deceptive, it does make the case that all AI models impliedly claim that they will not skew liberal. According to the statement, AI companies promote themselves as accurately “distill[ing] all of human knowledge to solve problems, large and small, in furtherance of users’ given objectives.” The statement claims that this an implicit representation that the output will be free of bias. In order to overcome this implied claim of ideology-free output, the AI company would have to clearly and conspicuously disclose its ideological intent: “[S]uch a disclaimer would have to be adequate to shift consumer expectations that would be based otherwise both on companies’ explicit representations and on the inherent value proposition of AI systems as tools to solve human problems.” Thus, the statement sets the table for being able to sue AI companies if they intentionally insert misleading ideology in their model outputs and omit a disclaimer clarifying their intent to do so.

The statement’s heavy reliance on the implied representation and omitted disclaimer exposes a doctrinal issue at the nexus of the FTC’s unfairness and deception authorities. In the seminal unfairness case 

, the Commission rejected staff’s “pure omission” deception theory based on staff’s argument that offering a product implied a basic level of safety, explaining: “[W]e could not declare pure omissions to be deceptive without expanding that concept virtually without limits.” Instead, the Commission permitted a pure omission unfairness count based on the injuries to consumers from fuel geysering. Likely because Chairman Andrew Ferguson is 

, the statement declines to advance an unfairness theory, and instead must rely on the type of broad theory of implied statement similar to that which the International Harvester opinion rejected.

The statement forcefully asserts the FTC’s robust regulatory authority in the AI space. Although its focus is the phantom threat of ideology-imbued AI output, its analysis is equally applicable to a broad array of implied claims by AI companies. For example, users might reasonably expect:

(a) that AI will use personal information only for the purposes for which the user provided it,

(b) that AI will have only the users’ best interests in mind as make product recommendations (and not the interests of paid partners or advertisers),

(c) that users’ data is reasonably secure from misuse, and even

(d) that AI will advise users based only on training data that it lawfully acquired.

To the extent any of these are reasonable expectations, AI companies must comply with them, or clearly and conspicuously disclose their intent to do otherwise. The FTC has staked out a broad, aggressive approach of implied claims in order to police deceptive practices by AI companies.

The posture of this statement regarding AI models that threaten users with supposedly progressive ideology appears to be a departure from Chairman Ferguson’s previous reluctance to apply the FTC Act to AI models. Chairman Ferguson 

 from a referral of a complaint against Snap, the parent company of Snapchat, to the Department of Justice. Although neither the FTC nor the DOJ has made public the complaint against Snap, around the same time state attorneys general in 

 took action against Snap for deceiving consumers by “insisting My AI was safe and age-appropriate” and “designed with safety in mind.” According to these complaints, Snap’s My AI chatbot in fact would offer advice on “how to hide alcohol and drugs from a parent” and also suggested “ways for the 13-year-old to have sex with an adult.” The complaints allege that Snap’s express and implied representations of the safety of the My AI chatbot were deceptive in light of this output.

In his dissent from the FTC’s referral, Chairman Ferguson stated that “I can say that the complaint’s application of Section 5 of the Federal Trade Commission Act is not only wrong as a matter of statutory interpretation, but is also in direct conflict with the guarantees of the First Amendment.” Although it is impossible to know how exactly Chairman Ferguson disagreed with the non-public complaint, it’s difficult to square his dissent with the Commission’s AI statement. The complaints from Utah, Texas, and Arkansas present very straightforward applications of deception law: Snap made statements that its AI model was safe for children, but in fact it was not. To the extent the FTC’s complaint was anything like these allegations, it would appear that Chairman Ferguson is more motivated to wield the FTC Act against AI products that output progressive ideology than AI products that harm children.

(Of course, it’s entirely possible that there is an explanation here. One of the problems with the Commission no longer having minority Commissioners is that there is no member of the opposing political party to either criticize—or, alternatively, validate—the Commission’s actions.)

For whatever reason, he has staked out a much more aggressive position on pursuing deceptive practices actions by AI companies. This Commission and future Commissions can build on this statement to aggressively police this new technology.

Notably, the statement does not spend much time on preemption. Because there is no express preemption, the statement must rely on conflict preemption: “A state law that requires an AI firm to deceive its consumers obviously conflicts with Section 5’s express purpose of protecting consumers from such conduct.” The statement implicitly acknowledges that 

 is inapplicable, because an AI company can comply with the FTC Act simply by disclosing its compliance with the previous version of the Colorado law. This leaves only the other type of conflict preemption: obstacle preemption.

The statement makes clear that it is endorsing obstacle-type conflict preemption with its citation of 

. This theory applies preemption where the state law creates an “obstacle to the accomplishment of the full purposes and objectives of Congress.” The “purposes and objectives” approach of obstacle-type conflict preemption has been significantly narrowed in subsequent cases addressing 

, and at least one conservative justice has 

 the complete abandonment of the “purposes and objectives” approach. The Statement’s invocation of 

 suggests Chairman Ferguson’s willingness to take up a more aggressive approach to implied preemption than most conservative legal scholars.

Even a broad reading of the purposes and objectives approach to implied preemption is difficult to satisfy here, since any entity subject to the original Colorado law could comply with it without undermining the FTC Act. As a result, the statement backs down from any strong preemption argument. For close followers of the FTC, how the Commission handled this assignment is of interest because it pitted Chairman Ferguson’s background as a serious lawyer with a record advocating against federal preemption as Virginia’s solicitor general, where he 

described obstacle preemption as “an incoherent doctrine

,” against his unfailing loyalty to and eager coordination with the Trump Administration, which had asked him to advance this spurious preemption theory. His resolution of this conflict conspicuously retreats into the passive voice: “although the FTC Act does not expressly preempt state law, state law is impliedly preempted to the extent it conflicts with a federal regulatory scheme.” In other words, the Commission avoids saying that the FTC Act preempts anything (“state law is impliedly preempted”) and does not even say that any state laws actually conflict with a regulatory scheme (“to the extent”).

Ironically, the FTC’s statement seems to have accomplished the opposite of minimizing the regulatory burden on AI companies. It stakes out an aggressive approach to policing implied representations by AI companies. But even when doing so, it fails to argue meaningfully for preemption of any state laws. Although this FTC is unlikely to pursue AI companies with a heavy hand, it certainly has created the road map for aggressive enforcement.

Over the past decade, the European Union has built an extensive 

. The General Data Protection Regulation was followed by the Data Governance Act, the Digital Markets Act, the Digital Services Act, the Data Act and the AI Act. These instruments established the legal rules governing the collection, use and sharing of data, the operation of digital markets and services, and the development and deployment of systems driven by AI.

The framework is now entering a period of both expansion and revision. While the EU continues to introduce new technology legislation (

Action Plan on Cybersecurity and Artificial Intelligence

 proposal is reopening central parts of the existing data-protection acquis, including the GDPR.

This double push creates a governance challenge. New legislation increasingly relies on concepts and safeguards developed elsewhere in EU law. Altering a foundational instrument can therefore change the operation of the wider framework, even where an amendment is confined to a single regulation.

The Commission presents simplification as a route to 

. The difficulties surrounding the digital acquis also stem from uneven implementation, fragmented enforcement and unresolved interactions between instruments. Reopening foundational rules risks weakening rights without resolving those problems.

The quality of regulation cannot be measured by the number of 

. Legal certainty, coherence, effective enforcement and the protection of fundamental rights are equally important. The distribution of the remaining burdens also matters. Lifting a controller’s documentation duty may make violations harder for individuals, particularly workers, to prove. Reduced transparency may require supervisory authorities or courts to reconstruct facts that controllers were previously required to record. Narrower legal definitions may exclude certain activities from regulatory scrutiny.

The Digital Omnibus illustrates this dynamic. It reopens several parts of the GDPR, including the 

definition of personal data, the rules on special categories of data, transparency duties and procedural safeguards

 develop their positions, these provisions may take different forms in the final compromise. The level of protection will depend on how they operate together. Rights may remain formally recognized, yet their scope or 

The GDPR is a foundational instrument of the European digital acquis. Its definitions, principles and safeguards are incorporated into, or interact with, legislation governing AI, digital markets, platform work and other data-driven activities. Changes to the definition of personal data, transparency, accountability, automated decision-making or access to remedies may therefore have consequences well beyond the GDPR.

 illustrates how changes to the GDPR could affect the practical exercise of rights established under another instrument. It sets out specific rules on the processing of personal data by automated monitoring and decision-making systems, transparency, human oversight and human review of decisions taken or supported by those systems. The Directive adds more specific and additional protections alongside the GDPR, and its data-protection concepts are interpreted in light of GDPR definitions. Restricting GDPR safeguards concerning access, transparency or automated decision-making would not formally repeal those protections. It could, however, narrow the supplementary information and evidentiary routes available to persons performing platform work and their representatives when seeking to understand or challenge algorithmic management practices.

The same pattern appears elsewhere in the data acquis. The Digital Omnibus would repeal the 

Free Flow of Non-Personal Data Regulation

, transferring relevant provisions into an amended Data Act. This consolidation increases the importance of the distinction between personal and non-personal data, because that classification determines which rights, obligations and enforcement mechanisms apply. Narrowing the GDPR definition of personal data could alter the application of the consolidated data framework and remove some processing activities from the protection of the GDPR.

 provides another example. It uses concepts derived from EU data-protection law and applies alongside the GDPR where AI systems process personal data. Changes to the treatment of personal or special-category data could alter whether processing connected with AI systems falls within the GDPR and how overlapping obligations apply.

A selective codification of CJEU case law

European Data Protection Board and the European Data Protection Supervisor

 supports measures that improve harmonization, consistency and legal certainty. However, it identifies serious concerns about several proposed GDPR amendments. It also notes the absence of a full impact assessment and the limited consideration given to possible adverse effects on fundamental rights.

The proposed amendment to the definition of personal data illustrates the problem. The Commission presents the change as reflecting recent CJEU case law on pseudonymization and identifiability, particularly the judgment in the case 

. The EDPB and EDPS urge the co-legislators not to adopt the amendment. In their view, the amendment

generalizes part of the Court’s reasoning in a fact-specific judgment without adequately reflecting either the circumstances of the case or the wider jurisprudence on identifiability. They warn that it would significantly narrow the concept of personal data and create legal uncertainty.

The Court’s judgment contains two linked findings: (1) identifiability must be assessed from the position of the entity concerned; and (2) information that is not personal for that entity may become personal when disclosed to a recipient with means reasonably likely to identify the individual and, in that situation, indirectly for the entity making it available

 The Digital Omnibus draws on the first finding but appears 

, may produce a rule narrower than the case law claims to reflect.

The consequences extend well beyond this amendment. The definition of personal data determines the material scope of the GDPR. For the entity concerned, information falling outside that definition is no longer subject to the Regulation’s principles, rights, accountability requirements or supervisory mechanisms. The amendment would narrow the material scope of EU data protection law and could affect other EU acts that rely on the GDPR definition. The EDPB and EDPS also warn that a substantial change could create fragmentation with the 

 and with third-country laws largely aligned with the GDPR’s current definition.

The proposal raises an institutional question. It would insert a new Article 41a into the GDPR, empowering the Commission to specify the means and criteria for determining whether data resulting from pseudonymization no longer constitute personal data for certain entities. The EDPB and EDPS recommend deleting the provision and preserving the role of independent supervisory authorities, subject to judicial control, in applying the GDPR’s definitions.

A new derogation for sensitive data in AI development

The proposed derogation for the incidental and residual processing of special categories of personal data in AI development raises a different concern. The EDPB and EDPS recognize that such processing cannot always be avoided during the training, testing and validation of AI systems. They nevertheless recommend limiting the derogation to genuinely incidental and residual processing, requiring documented efforts to remove sensitive data where possible, excluding data supplied through prompts during deployment, and maintaining safeguards throughout the AI lifecycle.

A narrowly framed derogation may be justified in exceptional circumstances. It should not evolve into a general legal basis for retaining sensitive data whenever compliance becomes difficult or costly.

Foundational legal concepts are not legislative variables

The effectiveness of the GDPR depends on how its substantive and procedural safeguards operate together. They determine whether information falls within the Regulation, which processing is permitted, what must be documented, what individuals can access and contest, what authorities can investigate, and what courts can review.

The Digital Omnibus risks altering essential parts of this protective structure. A narrower definition of personal data could place some processing beyond the GDPR’s reach, leaving data minimization, purpose limitation and accountability inapplicable. A broader derogation could permit special-category data processing that would otherwise be prohibited. Changes to transparency, access rights and procedural safeguards may make processing less visible and infringements harder to prove. In sum, the catalogue of rights may remain intact, but the conditions for exercising them may be significantly weakened.

In conclusion, it is likely that the Digital Omnibus will not remove legal burdens and costs but simply redistribute them. When companies that process personal data have fewer obligations to document and disclose their activities, the associated costs and uncertainty do not disappear. They are transferred to individuals, regulators, and courts, which must do more to detect unlawful processing and pursue remedies.

If that becomes reality, the European data protection ecosystem will be severely damaged, even if the legal framework remains formally unchanged. The key test will be whether, despite the Omnibus, the legislation still makes it possible to identify and challenge unlawful processing. The challenge for the

 is therefore not so much how to simplify Europe’s digital rules, but how to ensure that the foundations that make those rules enforceable remain intact.

Mark Scott is a contributing editor at Tech Policy Press.

As the Brussels Bubble heads into the August break, a storm is brewing around Ireland’s role in the European Union’s digital agenda.

Earlier this month, the country took over the 

 of the Council of the European Union, or the body that represents the national governments of all 27 countries. The role is akin to chairing a board meeting. Dublin helps organize the Council’s agenda, chairs most Council meetings and negotiations, and is expected to be a neutral actor in representing the interests of all EU governments.

"Ireland is seen by other member states – and rightly so – as a pro-European country and an honest broker,” 

 António Costa, the standing president of the European Council, during a recent visit to Dublin.

The Irish Council presidency comes as Brussels is shifting gears from building its digital rulebook to prioritizing AI-powered economic growth to keep pace with China and the United States. The EU is negotiating its so-called 

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe