The European Commission will loosen certain AI and privacy regulations, with civil society groups saying that our fundamental rights have been sold off in favour of AI innovation and economic competitiveness.
Last Wednesday, European Commission officials presented the much-anticipated Digital Simplification Package, also known as Digital Omnibus, proposing to "simplify" (or deregulate) AI regulations, such as delaying stricter rules on its use in “high-risk” areas until late 2027.
They also announced the easing of certain rules on cookies and enabled greater use of data, as part of changes to the General Data Protection Regulation (GDPR), which would allow major Big Tech companies like Google, Meta and OpenAI to use Europeans’ data to train their AI models.
It has infuriated digital rights groups and many privacy-oriented citizens, who claim a loss of fundamental rights, with the EU also serving US tech interests at the same time.
Meanwhile, tech lobby groups have said Wednesday’s changes to the AI Act, GDPR, the e-Privacy Directive and the Data Act, among others, are not "bold enough".
By loosening certain regulations, the European Commission maintains it has struck a balance in forwarding its competitiveness agenda – while also still not completely torching its privacy protections.
"There will be many stakeholders who are saying that this is not enough," EU commissioner for tech sovereignty Henna Virkkunen told reporters during the announcement. "And some say maybe that there's too much, so I think that we have a balanced package."
‘Not small edits’
Yet, with more reforms expected, civil society and digital campaigning groups believe the European Commission is chipping away at personal data protections (safeguarded under GDPR and the AI Act), rather than blowing them up all at once.
"From a digital rights perspective, this looks like the biggest rollback of EU digital protections in a generation," the European Digital Rights Initiative (EDRi)’s policy advisors Blue Duangdjai Tiyavorabun and Itxaso Domínguez de Olazábal, told The Brussels Times.
"Our reaction is one of deep concern. The Digital Omnibus turns a promise of simplification into a deregulation package that lowers safeguards in the GDPR, the ePrivacy rules and the AI Act."
They believe that, instead of fixing weak enforcement and focusing on good implementation, the proposal rewrites core concepts: what counts as personal data, how consent works on devices, lower protections from the most egregious AI harms, and allowing AI systems to hoover up data while relying on "legitimate interest".
On 19 November 2025, European Commissioners Henna Virkkunen, Valdis Dombrovskis, Michael McGrath give a press conference on the digital simplification package. Credit: EU
"These are not small edits. They reshape how data protection, privacy and fundamental rights work in practice. It is done through a fast track process with no full fundamental rights impact assessment, no evidence and no actual democratic oversight," they explain.
With the call to "unlock" Europeans’ personal data for AI training, the EU has argued it is helping small businesses in Europe digitally innovate by "cutting red tape".
Big business
Tech lobby organisations such as Digital Europe, representing the likes of Amazon, Apple, Google, Meta and TikTok, are calling for "better alignment across AI, data and cyber rules will support competitiveness and protect Europe’s industrial base."
They reacted to Wednesday’s announcement by saying it was an "important first step and signal" that Europe intends to match its competitiveness agenda with concrete measures.
In Digital Europe's latest membership survey – most of which are large multinational companies – only 8% say they "feel positive" about Europe’s trajectory, compared with 30% two years ago, whilst 45% point to a "worsened" business environment.
Indeed, another leading tech lobby group, the Computer & Communications Industry Association (CCIA), whose members also include Amazon, Apple, Cloudflare, Google, Meta and Uber, responded to the Digital Omnibus announcement by calling on the European Commission "to be bolder" in simplifying the EU’s regulatory landscape for digital and tech.
Innovation for who?
However, the Brussels-based EDRi believes that the main winners will be these large, data-rich firms – many of which are US-based platforms, as well as a handful of dominant EU players. The new plans will gain broader grounds to track people, repurpose data and train AI with fewer constraints, they say.
"For small and medium companies, the story is different. They have invested for years in tools and staff to comply with the current GDPR and ePrivacy framework," say Tiyavorabun and Domínguez de Olazábal. "Now they face a moving target, more loopholes for giants with big legal departments, and less legal certainty. That does not support fair competition."
Another aspect which has irked campaigners is the narrowing of the definition of personal data, as more information would then fall outside the GDPR’s remit altogether.
Intrusive tracking on phones and browsers will soon become easier due to the new flexibility around cookies and consent, with model training being allowed under the "legitimate interest" consent option in the cookies banner.
Campaigners from People vs Big Tech, WeMove Europe, and EDRi launched four mobile billboards driving across Brussels, calling on Ursula von der Leyen to stand up to Trump and Big Tech, and defend Europe’s digital laws, on Wednesday 19 November 2025.
Yet EDRi is stressing that if AI training relies on "legitimate interest", people’s posts, photos, or voice data will be handed to massive tech companies without meaningful choice.
The delay of the AI Act is also a "lose-lose situation", which they stress will create uncertainty for business, while delaying people’s access to fundamental protections against AI harms in high-risk scenarios.
"The combined changes in GDPR and the AI Act open the door to exposing people to the most harmful AI systems by weakening core protections of the AI Act against prohibited AI systems," explain Domínguez de Olazábal and Tiyavorabun.
"Fundamental rights such as privacy, data protection, non-discrimination and freedom of expression depend on clear limits to data use. This package weakens those limits at several points in the chain. The result is more room for profiling and opaque automated decisions, and fewer effective tools for people to challenge them."
Trump & lobby pressure
The European Commission has been widely accused of having caved to US President Donald Trump and his administration, with claims that Big Tech has "weaponised" the Trump administration to force through changes that are very favourable to their industry, lowering privacy protections closer to the US model.
The watchdog Corporate Observatory Europe (CEO) has filed a complaint to the Ombudsman, accusing the European Commission of having worked directly with tech lobbyists in its digital rule changes.
CEO’s recent research also revealed that the tech industry was now spending a record €151 million on lobbying the EU. It represents a 33.6% increase since 2023, and a 55.6% increase since 2021. This is the highest level of lobbying expenditure ever recorded for the tech sector in Brussels.
Trump and von der Leyen address reporters after reaching a new transatlantic trade deal at Trump’s Turnberry resort in southwest Scotland on July 27, 2025. Once hailed as a “good deal,” it now underscores the EU’s struggle to assert strategic autonomy amid growing U.S. dominance. Credit: Brendan Smialowski / AFP
"External pressure from the US and from large platforms is obvious. They have pushed for years for looser data protection and for more flexible rules on AI and online tracking. This package trades fundamental rights for big business interest,” continue EDRi’s Domínguez de Olazábal and Tiyavorabun.
By lowering its standards to suit dominant platforms, the EU is risking dependence by losing both protection for people as well as leverage in digital policy worldwide. They call for a strong, rights-based framework as the best defence against that outcome, and this reform weakens that defence.
However, lobby groups such as Digital Europe and CCIA have suggested that there are going to be more reforms of the EU’s digital regulations – and the European Commission has not ruled it out.
CCIA Europe’s Head of Policy and Deputy Head of Office, Alexandre Roure, say that CCIA look forward to the Commission “moving into a higher gear with more ambitious, all-encompassing review of the EU’s entire digital rulebook, and urges Member States and the European Parliament to back even bolder simplification measures.”
How to simplify
With the Commission’s proposal still set to be debated with the European Parliament and EU leaders, Digital Europe says that it "looks forward" to working with Europe’s political leadership in the negotiation phase, in order to secure Europe’s position as a global leader in trusted digital innovation."
They are calling for a focus on the business-to-business angle, "as this is where Europe’s digital strengths lie."
Digital Europe wants the EU to do more to incentivise voluntary data sharing under the Data Act. It also wants to apply cloud switching exemptions to all contracts going forward, and ensure real simplification of cybersecurity reporting.
A photo illustration of the EU's GDPR. Credit: EU
However, digital rights advocates agree that the rules can be improved, but not at the expense of fundamental rights. "You do not need weaker rights for innovation. You need clear rules, strong regulators and support that makes compliance realistic for smaller actors," explain Domínguez de Olazábal and Tiyavorabun.
For example, EDRi's experts believe that strengthening data protection authorities so they can enforce the GDPR and ePrivacy rules in a consistent, predictable way "would help honest firms and deter free riders".
Second, maintaining the implementation timeline of the AI Act would reduce legal uncertainty for small businesses and the Commission's credibility.
Furthermore, the EU should provide practical tools for small businesses: clear templates for records, impact assessments and notices. Sector-specific guidance. Standard settings in software that follow data protection by design.
Related News
- Meta served with 'cease and desist' notice for using Europeans' data for AI training
- EU wants fewer cookies but some warn of 'biggest attack on digital rights'
- Secret EU plans to allow Big Tech to train AI with our personal data
Finally, they are calling for an alignment enforcement of the GDPR with the Digital Services Act and the Digital Markets Act, so gatekeepers "do not use their power to impose surveillance-based models" on smaller players.
"What drives EU competitiveness is stable rules, strong enforcement and a market where smaller firms have room to compete."
"If Europe wants an innovative digital sector, it needs predictable regulation, public investment in privacy-preserving technology and support for companies that build trustworthy products. A level field does far more for growth than shortcuts for the biggest players," EDRi's experts conclude.
