April 29th, 2025 // Did someone forward you this newsletter? Sign up to receive your own copy here.

Has Europe over-regulated tech?

“The tech platforms are castles. Regulating access to someone else’s castle does not create other castles. We are still dependent.”

These were the words from Dr. Cristina Caffarra, a leading European competition economist, who raised concerns about Europe’s digital dependence at the EU Open Source Policy Summit earlier this year. Dr. Caffarra is an Honorary Professor at University College London, and Co-Founder of the Competition Research Policy Network at the Centre for Economic Policy Research.

Europe is the world’s leader in regulating tech. It has passed a flurry of landmark laws in recent years and levied record-setting fines against Big Tech companies.

As governments consider how to protect consumers and address the influence of major technology companies, Europe’s approach to tech regulation can serve as a model and set a precedent. For example, Maryland’s Age-Appropriate Design Code Act, rules that protects children’s privacy and safety online, was inspired by a similar law in the UK, the Children’s Code.

Dr. Cristina Caffarra

In this week’s newsletter, we explore the unintended consequences of Europe’s digital regulations and examine the role of digital sovereignty in a world increasingly shaped by technology and territorial geopolitics.

Leaders and economists like Cristina Caffarra are already raising alarms about these impacts. For U.S. policymakers rushing to regulate technology companies, Europe’s regulatory conundrum offers important lessons worth considering.

// Leading the world in tech regulation

In recent years, the EU has passed various laws to regulate tech companies and protect consumers. Here are the notable ones:

• 2018 - General Data Protection Regulation (GDPR) gives individuals greater control and rights over their data. It is considered the world’s strongest set of data protection rules.
• 2022 - The Digital Services Act (DSA) creates a safer, fairer, and more transparent online environment by addressing issues like illegal content, online harm, and algorithmic bias. It came into effect in 2024.
• 2023 - The Digital Markets Act (DMA) was enacted to create competitive digital markets in Europe by preventing Big Tech companies from abusing their power and enabling smaller companies to compete.
• 2023 - The AI Act is a legal framework that classifies AI systems by risk and strengthens rules around data quality, transparency, human oversight, and accountability of major AI systems. It is the world’s first comprehensive AI legislation.

Because many of these laws are recent, the full effect of their enforcement hasn’t yet been felt. But in many cases, they’re making the internet safer and empowering people with greater choice and control.

• A 2023 research paper found that GDPR has prompted a worldwide reevaluation of practices to ensure compliance with stringent data protection and cybersecurity standards.
• The DSA and DMA have forced tech companies like Apple, Meta, and TikTok to make design changes to their products and platforms, resulting in safer online spaces and greater control over data and privacy. For example, TikTok made it easier to report illicit content, and Meta has provided its users with more options to tailor their experiences on Facebook and Instagram, like how their feed is designed and how to search for content.

The benefits of these regulations have rippled around the world. The DSA and DMA are now influencing how major platforms like TikTok, Meta, and Apple design their services globally, not just in the EU. In an interconnected world, Europe's assertive approach to tech governance increasingly acts as a gravitational force, pulling international standards closer to its own.

// A Tsunami of regulation: Europe's digital dilemma

But too much regulation can create problems of its own. This “tsunami of legislation,” as a recent analysis by the Atlantic Council called it, has led to a debate about whether the continent’s heavy-handed approach is causing unintended problems. 

Here are the main concerns: 

• Stifling innovation and competitiveness: Too much regulation can stifle innovation, imperil the competitiveness of Europe’s tech sector, entrench the power of today’s incumbents, and threaten the overall economic growth of the Union. In 2023, many tech companies signed an open letter expressing their worry that the EU was losing a step with its regulation. Smaller companies and startups often face a greater burden to comply with regulation than larger companies.
  
  
• The brain drain of talent: The EU has been concerned about the brain drain of its best technologists and AI researchers to places like the U.S. Of 147 EU unicorns, 40 have relocated their headquarters abroad, according to a 2024 report.
  
  
• Geopolitical implications: On a geopolitical level, the U.S. Chamber of Commerce has argued that the EU’s regulation predominantly impacts American companies (of the 22 platforms the DMA seeks to regulate, 21 are American, and one is Chinese), and tech executives have likened them to tariffs. Inside Europe, a 2024 report concluded that the continent’s complex regulatory environment was hindering its ability to keep pace in the technology race with the U.S. and China.
  
  
• A loss of digital sovereignty: The EU puts itself in a vulnerable geopolitical position by becoming too reliant on outside technology. This loss of digital sovereignty, where the EU loses the ability to control its own digital infrastructure, data, technologies, and the rules that govern them, is a major concern for policymakers. “Digital sovereignty and cybersecurity are now central pillars of the EU’s push to achieve strategic autonomy,” Caffarra wrote in a recent article in Project Syndicate. 

// The way forward

It’s worthwhile to ask what all this regulation is for. If its goal is a safer internet with better consumer protections, it might be considered more successful. If its goal is to ensure Europe’s digital sovereignty, it might be considered less so.

In Europe, thirteen member states signed a declaration calling for removing barriers and simplifying EU rules and procedures. The EU is beginning to simplify its regulatory regime to find that “goldilocks zone” of regulation.

EuroStack, an initiative to strengthen Europe’s digital sovereignty, has rapidly gained traction amongst EU policymakers and industry leaders. The idea behind EuroStack is to get EU institutions to support market-led initiatives that increase the competitiveness of European tech companies. This means developing a “Digital Industrial Policy plan” to support public-interest investment, which includes:

1. Hard Infrastructure: Building Europe’s physical capacity that includes data centers, semiconductor chip manufacturing facilities, and other communication infrastructure.
2. Soft Infrastructure: Developing software and services that includes AI tools, operating systems, and cloud technology.
3. Intermediation & Connectivity: Cultivating a robust ecosystem of intermediation and connectivity that includes collaboration in commerce, advertising, and interoperable standards.

Caffarra is optimistic, “With renewed industry momentum, and governments under pressure to deliver a 'European resurgence' in defense and technology in the new geopolitical reality, there has never been a better time to revitalize Europe’s digital infrastructure.”

As Europe has led the way in regulating Big Tech in the last ten years, many nations, including the U.S.—which is now in the midst of its own wave of greater tech regulations—will learn from Europe's example as it grapples with the second and third-order consequences of those regulations.

Project Liberty in the news

// Frequency, created by the team at Project Liberty Labs, has launched a new series called “We’re Making Waves With.” The first show, which explored the ownership of your voice in the age of AI, premiered last week. You can watch it here.

Other notable headlines

// 📧 Google is rolling out an end-to-end encrypted email feature for business customers, but it could spawn phishing attacks, particularly in non-Gmail inboxes, according to an article in WIRED.

// 🏛 30 individuals, including Nobel laureates, former OpenAI employees, and law experts, submitted a 25-page letter to the attorneys general of California and Delaware, asking them to block OpenAI’s proposed restructuring to a for-profit entity, according to an article in Semafor.

// 🤳 An article in Politico explored how Gen Z became the most gullible generation. The almighty algorithm is fueling conspiracy theories among young people and ruining their ability to tell fact from fiction.

// 📻 An article in MIT Technology Review highlighted why we still need AM radio. The most reliable way to keep us informed in times of disaster is being threatened.

// 💬 Chatbots on Instagram, Facebook and WhatsApp are empowered to engage in ‘romantic role-play’ that can turn explicit. Some people inside Meta are concerned, according to an article in the Wall Street Journal.

// 🇮🇳 India has fallen behind China in tech innovation, despite its government urging the private sector to take the lead. Industry experts say tech innovation in India is complicated, according to an article in Rest of the World.

// 🤖 A segment on 60 Minutes explored what’s next for AI at DeepMind, Google’s AI lab. Researchers, including an esteemed Nobel Prize winning scientist, are chasing artificial general intelligence.

Partner news & opportunities

// In-person gathering in Washington, D.C.—Emerging Tech 2025

May 22 | 5:30pm - 7:30pm ET | Washington, D.C.

Join tech leaders and innovators for an evening of discovery at the Emerging Tech Exhibition & Reception hosted by Public Knowledge. Dive into interactive showcases and demos highlighting the latest in AI, Web3, and XR, and connect with experts shaping the future of technology. RSVP here. 

// March on Meta 

Last Thursday morning, dozens of families rallied outside Meta’s office in New York City and held a vigil to send a message about protecting kids online. Organized by The Heat Initiative, the gathering spotlighted stories of families who lost children to cyberbullying and online harms. As online risks escalate, their message is clear: tech companies must do more to prioritize children's safety over profits. Read more about the gathering here and here.

// Podcast: How tech companies profit from children’s data

In the latest “Tech This Out!” episode, 5Rights Youth Ambassador Srishti and Prof. Shoshana Zuboff discuss how tech giants like Google and Meta exploit young people's data for profit, eroding childhood privacy. This important conversation—Part one of a two-part series—sheds light on the urgent need for child-centered technology governance. Listen here.

What did you think of today's newsletter?

/ Project Liberty builds solutions that help people take back control of their lives in the digital age by reclaiming a voice, choice, and stake in a better internet.

Thank you for reading.