Big Tech's €151M Lobbying Rollback of EU Digital Rights

The narrative of 'simplification' is a pretext. The reality is a strategic, multi-million-euro campaign by Silicon Valley giants to dismantle the core protections of the AI Act and GDPR, cementing their market dominance.

The European Union once positioned itself as the world’s foremost digital regulator, a standard-bearer whose 'Brussels Effect' would force global compliance. That era is over. A new analysis reveals that the EU’s recent 'Digital Omnibus' package—a supposed simplification effort—is, article by article, a near-perfect mirror of Big Tech’s lobbying demands, effectively rolling back years of progress in digital rights and accountability.

The AI Act: A Self-Assessment Loophole for High-Risk Systems

The EU AI Act, hailed as a global first, is being hollowed out before its full enforcement. Big Tech’s primary win was securing a significant delay. The Commission is considering a one-year grace period, pushing the enforcement of penalties for high-risk systems back until at least August 2027, a direct concession to lobbying groups and companies like Alphabet ($GOOGL) and Meta ($META) who argued the requirements were overly prescriptive.

More critically, the final text and subsequent proposals have introduced a glaring accountability loophole. The Act already allows companies to self-assess whether their AI systems qualify as 'high-risk' and must therefore comply with transparency and accuracy requirements. The Digital Omnibus proposals now threaten to remove any possibility of public oversight of that self-assessment, essentially giving AI developers a blank check to operate without accountability.

This shift is a victory for the industry’s 'innovation' narrative, but a profound loss for developers seeking a level playing field and citizens concerned about AI-driven employment screening, credit scoring, and public safety applications. The delay in the registration of high-risk AI systems was a key goal of lobby groups like DigitalEurope, further illustrating the direct correlation between industry asks and legislative outcomes.

The GDPR’s Core: Weakening Data Protection by Redefinition

The General Data Protection Regulation (GDPR) was the EU’s greatest regulatory export. The Digital Omnibus now targets its foundational principles. One controversial proposal seeks to amend the definition of 'personal data,' specifically for pseudonymized data. The Commission intends to stop classifying pseudonymized data (where a user’s name is swapped for a code) as personal data if a company claims it cannot identify the person.

This change turns a universal rule into a subjective one, exempting vast troves of data from GDPR protection even if other actors, such as data brokers, can still identify individuals. This aligns perfectly with the demands of tech associations that have long sought to weaken the definition of personal data to facilitate easier data processing.

Furthermore, the proposals weaken protections on automated decision-making (GDPR Article 22) and, most alarmingly for the AI sector, intend to permit the training of AI models with sensitive personal data—including sexuality, political beliefs, or ethnicity—using an opt-out mechanism instead of the GDPR’s gold-standard active consent (opt-in). This allows tech companies to hoover up sensitive data for AI training, a position promoted by lobby groups like CCIA and DigitalEurope.

The Compliance War: DMA and DSA Under Siege

While the AI Act and GDPR face legislative rollbacks, the Digital Markets Act (DMA) and Digital Services Act (DSA) are under siege via compliance resistance and enforcement delays. The DMA, designed to curb the monopoly power of 'gatekeepers' like Apple ($AAPL) and Meta, has been met with fierce opposition, legal challenges, and a deliberate strategy to undermine its implementation.

Big Tech deployed its vast resources to overwhelm the regulatory process. For instance, the European Commission’s DMA unit has only about 80 dedicated employees, a number dwarfed by the combined 106 employees and 282 lawyers and lobbyists the gatekeepers field. This asymmetry of resources allows companies to distort compliance workshops and deflect criticism.

The ultimate goal is to delay and dilute. Campaigners have noted that enforcement of both the DSA and DMA has been delayed despite evidence of non-compliance, a 'tried and tested industry lobbying tactic' that buys time for dominant players to adapt or find new loopholes.

Inside the Tech: Strategic Data