EU Privacy Law Faces Overhaul as Big Tech Seeks Expanded Data Access

As of November 10, 2025, the European Commission is proposing significant changes to the EU's landmark General Data Protection Regulation (GDPR) as part of a broader effort to simplify various technology, environmental, and financial regulations.

The proposed "Digital Omnibus" would allow major tech companies like Google, Meta, and OpenAI to use Europeans' personal data to train their AI models based on the legal basis of "legitimate interest." Additionally, companies may be exempted from the GDPR's ban on processing special categories of personal data, such as health or political information, in order to "not disproportionately hinder the development and operation of AI."

Privacy activists have strongly condemned these proposed changes, warning that they would "gut" the GDPR and flout existing EU case law. Max Schrems of the privacy group noyb called it "a massive downgrading of Europeans' privacy 10 years after the GDPR was adopted." The group has previously filed successful complaints against tech giants that have resulted in billions in fines.

Other critics, such as the European Digital Rights association, have slammed a proposal to merge the ePrivacy Directive (the "cookie law") into the GDPR, arguing it would undermine protections for personal data on devices and connected services.

The Digital Omnibus proposals will now need to be negotiated with EU member states and the European Parliament in the coming months before any changes can be implemented.