digital economy regulation

This edition features the Commission’s proposal for a Kids Act; the European Parliament’s adoption of a report calling for an EU strategy to protect minors online; Parliament’s call for stronger enforcement of the Digital Services Act to address systemic online risks; the provisions of the Payment Services Regulation on combatting fraud that are relevant to telecoms providers and online platforms; and an opinion by an adviser to the EU’s top court in a data protection case concerning consent to direct marketing by unidentified partners.

This report analyses the new measures, expected to be adopted in December 2026, to prevent impersonation fraud involving payment services providers (PSPs). Both telecoms operators and online platforms would be required to detect and prevent the use of their services for this type of fraud. The regulation would explicitly allow them to cooperate and share information with PSPs. Very large online platforms would have to verify that advertisements for financial services are from authorised providers. Platforms would also have to compensate PSPs for the amounts refunded to their customers in some cases, such as if they had failed to expeditiously remove the fraudulent content after becoming aware of it.

This edition features a story on the application of the Cyber Resilience Act’s reporting requirements; a new edition of the EU Timeline, highlighting key EU policy and regulatory developments foreseen until the end of 2026; and an update of the Digital Economy Trackers.

It is the second-largest fine imposed under the GDPR to date. The Dutch data protection authority found that, by suspending drivers’ accounts without human intervention, Uber subjected the drivers to decisions based solely on automated processing. Under the GDPR, such automated decision-making (ADM) is generally prohibited where it produces legal effects or similarly significantly affects the individuals concerned, subject to certain exceptions.

This edition of Cullen International’s EU Timeline highlights key policy and regulatory developments foreseen at EU level until the end of 2026.

This edition covers EU-level policy and regulatory developments tracked by Cullen International’s Digital Economy and Media services over the past week, as well as key reports published during the summer. These include an analysis of EU countries’ positions on the framework restricting high-risk suppliers under the proposed Cybersecurity Act 2 (CSA2); reports on the European Commission guidance on the Cyber Resilience Act (CRA); an analysis of core amendments to the EU AI Act, following the entry into force of the AI Omnibus; a story about the reinstatement of temporary rules on voluntary detection of child sexual abuse by messaging apps; a story about France’s Constitutional court ruling against a blanket social media ban for under-15s, with a potential impact on the Commission’s upcoming social media delay proposal; and developments in cases under the Digital Markets Act (DMA) and the Digital Service Act (DSA). It also lists events taking place this week.