EU blinks on Big Tech, scaling back GDPR and AI Act

For years, Europe wore its badge as the world's strictest tech regulator with pride. Between endless cookie banners, massive GDPR fines, and the sprawling AI Act, Brussels set the global standard for digital guardrails.

Now, the European Union is blinking. Facing stagnant economic growth and mounting pressure from both the U.S. and domestic critics, the European Commission just proposed rolling back key protections in the GDPR and delaying major parts of its landmark AI Act.

Easing data rules and pushing back deadlines

The Commission's new proposal, dubbed the Digital Omnibus, cuts right into the core of Europe's data regime. It makes sharing anonymized and pseudonymized datasets far easier and explicitly permits companies to use personal data to train AI models, provided they meet general GDPR rules.

The sweeping AI Act is also taking a hit. Rules targeting "high-risk" AI systems—those affecting health, safety, or fundamental rights—were set to go live next summer. The new proposal indefinitely delays their enforcement until official "standards and support tools" are actually ready for companies to use.

Smaller businesses get a break, too, with simplified documentation rules for AI development, a unified reporting dashboard for cybersecurity incidents, and centralized oversight under the bloc's dedicated AI Office.

For everyday users, the most noticeable change will be a major reduction in annoying cookie pop-ups. Low-risk cookies will no longer require consent banners, and users will eventually be able to manage broader permissions directly through their browser settings.

Henna Virkkunen, executive vice president for tech sovereignty at the European Commission, defended the move, arguing that rigid rules have held back European startups. She insisted this rollback gives room for local innovation while protecting rights "in the European way."

Heavy pressure and an uphill battle

This retreat didn't happen in a vacuum. Brussels has faced intense lobbying from American tech giants and Donald Trump, alongside stark internal warnings from heavyweights like former European Central Bank chief Mario Draghi, who warned that heavy red tape was suffocating European competitiveness. Right now, the frontier AI race belongs almost entirely to U.S. and Chinese players like OpenAI, Google, and DeepSeek, leaving Europe with virtually no major contenders.

Pushing these changes across the finish line will be brutal. The proposal must survive the European Parliament and secure a qualified majority among the EU's 27 member states. Civil rights groups and privacy advocates are already furious, accusing Brussels of gutting fundamental safeguards to please Big Tech.

Why it matters

Europe is finally admitting out loud what critics have said for years: you cannot regulate your way into innovation if nobody is building in your backyard.

For AI developers and founders, this is the clearest sign yet that the regulatory fever in Europe is breaking. Easing restrictions on training data and delaying costly high-risk compliance checks could save startups millions in legal overhead. Still, we wouldn't rewrite company roadmaps overnight. Given the inevitable political dogfight in the European Parliament, getting this package passed will take months, and watered-down compromises are almost guaranteed.

Strategically, the shift is a double-edged sword. Scraping away cosmetic compliance headaches like cookie banners is genuinely smart politics and good product sense. However, kicking the can down the road on high-risk AI rules risks undermining the very "Brussels Effect" Europe spent a decade cultivating. If Brussels lowers its standards without actually producing a native tech giant to challenge Silicon Valley, it risks losing both its regulatory leverage and the AI race at the same time.