digital economy regulation

According to the court, the operator of an online marketplace will have a proactive duty to identify, verify and potentially refuse publication of an advertisement generated by a user of the platform which contains sensitive personal data. The advertisement should not be published if the sensitive data was unlawfully processed (e.g. without the data subject’s explicit consent). The court also confirmed that the operator of the platform, as a data controller for personal data processed on its platform, may not absolve itself of its obligations under the GDPR by invoking the intermediary liability provisions set out in the e-Commerce Directive (eCD). These intermediary liability provisions have since been moved to the Digital Services Act (DSA).

This report gathers policy and regulatory developments at EU level covered by Cullen International’s Digital Economy and Media services during last week. It also lists events taking place this week. This is the last EU Digital & Media Weekly Report before 2026, when discussions in Brussels around the different policy and regulatory initiatives will resume after the end-of-year holiday period.

Members of the EPP, Renew and ECR groups in the European Parliament (EP) Internal Market and Consumer Protection (IMCO) and Industry, Research and Energy (ITRE) committees broadly welcomed the Digital Omnibus proposals to simplify the existing EU digital rulebook. By contrast, some parliamentarians from S&D, Greens and The Left questioned the need for simplification and the rationale behind the proposals.

EU member states expressed strong support for cutting red tape while preserving the EU’s core safeguards. From AI rules to data legislation, member states endorsed smarter simplification that strengthens competitiveness, eases compliance, and provide businesses with clear and more predictable rules. Member states also welcomed the digital fitness check as a tool for further simplification. They also emphasised the need for a balanced approach that increases EU’s strategic independence without compromising its commitment to openness to the global economy.

The Mexican government released its 2025-2030 National Cybersecurity Plan, an initiative that aims to strengthen Mexico’s cyber-resilience; standardise federal capabilities in the cybersecurity sphere and provide for cybersecurity coordination across institutions.

European executive vice-president Henna Virkkunen also asked member states to support the upcoming Digital Networks Act (DNA) during the meeting of 5 December 2025.