digital economy regulation

In its negotiating mandate, the Council introduces significant changes to the Commission’s proposal, notably rejecting the revised definition of personal data in favour of more targeted rules on pseudonymisation. Regarding the use of personal data in AI development and operation, it maintains the possibility of relying on legitimate interests while tightening the conditions for processing special category data (e.g. health data). It preserves rules governing cookies under the e-Privacy Directive, expanding consent exemptions and reducing the period before consent can be requested again if it was refused. Regarding the EU single-entry point for reporting security incidents, the Council favours national entry points over the Commission’s proposed solution.

This edition features the Council’s position on the Digital Omnibus proposal; the European Parliament’s indicative timetable for the Cloud and AI Development Act; a stakeholder discussion on the proposed Kids Act and its interplay with the forthcoming Digital Fairness Act proposal; the Commission’s launch of formal proceedings against Booking.com under the Digital Services Act (DSA); a dialogue between very large online platforms and digital services coordinators on out-of-court dispute settlement under the DSA; and a new Commission’s support study on financial scams on digital platforms. No relevant events were identified this week.

At an event organised by Cullen International, the European Parliament's co-rapporteur for the proposed Cloud and AI Development Act (CADA), Diego Solier (ECR, Spain), outlined an ambitious legislative timetable, with a draft report expected by 10 November 2026. He identified cloud sovereignty requirements as a key issue in the legislative negotiations and expressed openness to simplifying the four-level framework. The European Commission clarified how the framework would work in practice, including safeguards against third-country interference and implications for public procurement.

Speakers discussed proposed rules to protect minors online and how far the forthcoming Digital Fairness Act should extend beyond the scope of the EU Kids Act.

This edition features, among others, an EU General Court decision upholding Stripchat’s designation as a very large online platform under the Digital Services Act; a Cullen International cheat sheet on the EU Kids Act proposal and a report examining the interplay of the proposal with the AI Act; the launch of a European Commission pilot EU repository for online political advertisements; an EU Board of Media Services workshop on audience measurement; and a European Data Protection Board statement on data protection challenges posed by smart glasses. It also lists events taking place this week.

The guidelines address how data protection requirements apply to online platforms when implementing their obligations under the Digital Services Act (DSA). They provide practical guidance on specific activities undertaken by online platforms, such as content moderation, recommender systems and targeted advertising, and show that compliance with the DSA does not automatically ensure compliance with the GDPR. The DSA imposes stricter rules on the processing of personal data than the GDPR in some cases, notably by prohibiting targeted advertising based on profiling using special categories of personal data.