FRESHFIELDS

Datalaw

trends2026

Exploringtheinterfaceoflaw,AI,andglobaldata.

Contents

1

Theglobalsurgeindataprivacymassclaims

2

Anincreasinglyfracturedglobal

rulebookfordata,cyber,andAI

3

Whybusinessesmustrethinktheir

approachtoyoungpeople,sdata

4

Risingrisksandshiftingrulesforinternationaldatatransfers

5

AInowaboard-levelimperative

forpubliccompaniesandinvestors

6

Regulatoryconvergencegrowsacrosssectorsandborders

7

Thefragmentedgloballandscapeforanonymization

FRESHFIELDS2

FRESHFIEL口S3

Executivesummary

The2026DataLawTrends

reportrevealsaworldin

whichbusinessesconfront

anincreasinglycomplex,

multi-polarregulatory

environment.

Datalawhasbecomeaglobalfaultline:divergentrules,intensifyingenforcementandcompetingagendas

acrossjurisdictionsarefracturingwhatbusinessesonceconsideredpredictable.

FromtheexpansionofAIoversighttonewlimitsondata

transfers,childprivacyregulationsandcybersecurityguardrails,thelegallandscapeisevolvingrapidly–andnomarketisimmune.

Wherechangeisaccelerating,oldassumptionsnolongerhold.

Manybusinessesarediscoveringthatyesterday’scomplianceplaybookswon’tworkintoday’smulti-polarenvironment.

Datalawsareshapingeverythingfromriskmanagementto

growthopportunities,andstayingaheadoftheseshiftsiscritical.

In2026,datalawhasbecomeageopoliticalandcommercialchessboardfornationsandbusinessesalike.Successnowdependsonmasteringafragmentedgloballandscape.Thisreportprovidesthestrategicforesightneededtoturndivergenceandcomplexityintoacompetitiveadvantage.

GilesPratt

and

ChristophWerkmeister

GlobalCo-headsoftheFreshfieldsdataprivacyandsecuritypractice.

Thisyear’sdevelopmentsbuildonlastyear’smomentum

butcomewithnewurgency.Enforcementismoreaggressive,

regulatorysilosarebreakingdownandissues–fromalgorithmicfairnesstocross-borderdataflowsandcontentsafety

–arebroaderthanever.

Inside,youwillfind:

1.Theglobalsurgeindataprivacymassclaims

2.Anincreasinglyfracturedglobalrulebookfordata,cyber,andAI

3.Whybusinessesmustrethinktheirapproachtoyoungpeople’sdata

4.Risingrisksandshiftingrulesforinternationaldatatransfers

5.AInowaboard-levelimperativeforpubliccompaniesandinvestors

6.Regulatoryconvergencegrowsacrosssectorsandborders

7.Thefragmentedgloballandscapeforanonymization

Thisreportisyourearlywarningsystem,yourtrend-mapandyourstrategicbriefingrolledintoone.Ithelpsyouseewhat’scoming,understandwhatmattersandrespondeffectively.

Thenextchapterofdatalawisbeingwritten.

Yourguidetonavigatingitstartshere.

Datalawtrends2026

1.

Theglobalsurgeindataprivacymassclaims

FRESHFIELDS5

Theglobalsurgein

dataprivacymassclaims

Inbrief

Navigatingthecomplexlandscapeofdata-relatedlitigationhasneverbeenmorecritical.Acrossmajorjurisdictions–

includingGermany,theNetherlands,EnglandandWales,andtheUS–therulesofengagementarechanging

rapidly.Whatwereoncestraightforwardclaimsarenow

sophisticatedcollectiveactionsandbundledproceedings,drivenbynewregulationandinnovativefundingmodels.

Businessesfaceaheightenedriskofmulti-prongedattacksseekingnotonlylargedamages,butalsoinjunctionsthat

candisruptcoreoperations.Understandingtheseshiftingtrendsisessentialforproactiveriskmanagement,robustdefensestrategiesandlimitinglegalexposure.

Theglobalpicture

Fewthreatshaveescalatedwiththespeed,scaleandfinancial

menaceofmassdataprivacylitigation.Onceanicheconcern,

collectiveprivacyclaimshavebecomeaprimarydriverof

complex,high-stakeslegalbattles–threateningnotjustbalancesheetsbutentirebusinessmodels,asindividuallylowvalue

claimsbythousandsormillionsofdatasubjectscanquicklyturnintomillionsorbillionsinpotentialdamages.

Thisdevelopmentreflectsaconvergenceoffactors,including:

?anexpandingpatchworkoflawscodifyingenforceabledata

rightsforindividuals(e.g.undertheEUGeneralDataProtectionRegulation(GDPR),UKGDPRandvariousUSstatelaws);

?theemergenceofasophisticatedandwell-capitalizedecosystemofclaimantlawfirmsandthird-partylitigationfunders;

?increasedpublicawarenessandconcernregardingdatarights;

?newcollectiveactionmechanisms,suchastheNetherlands’ActonCollectiveDamagesClaims(WAMCA)andtheEU’s

RepresentativeActionsDirective(RAD);and

?theriseof‘non-attack’claims–lawsuitsarisingnotfrombreachesbutfromroutinedataprocessingactivitiessuchastheuseofad-techandtrackingcookies.

FRESHFIELDS6

Theglobalsurgein

dataprivacymassclaims

Riskofclassandcollectiveactions

Thisheatmaphighlightscertainhigh-,medium-andlow-riskjurisdictionsforclassandcollectiveactions(includingdatabreach,techandotherlitigation),basedonFreshfields’experienceandour2025ClassandCollectiveActionGuide.

①Lowrisklevel●Mediumrisklevel●Highrisklevel●Outofscope

Thischapterfocusesonfourhigh-riskjurisdictions:

Germany,theNetherlands,EnglandandWalesandtheUS.

Germany:Aneweraforcollectiveactions

Germanyisexperiencingariseincollectiveactions,particularlyinGDPRandtechnology-relatedclaims.Consumerorganizationsarenotonlyseekingdamages,butalsopursuinginjunctionsto

haltdataprocessingactivities–forcingbusinessestomount

rapidandrobustdefenses.Whilelegalinsurersremaincautiousaboutfundingindividualclaims,atrendtowardhigherGDPR

damageawardsmaychangethat.Litigationfundersarealso

enteringthefield,acquiringclaimsfromthousandsofindividualsandpursuingtheminbundledproceedings,oftenthroughspecialpurposevehicles(SPVs).

Atthesametime,defendantsaredevelopingnovelstrategies

tochallengethestandingofconsumerorganizationsandSPVs,offeringnewoptionstomanagebusiness-criticallitigationrisks.

AkeyissuetowatchistheCourtofJusticeoftheEU’s(CJEU)guidanceonwhether‘lossofcontrol’constitutesabasisfordamagesundertheGDPR.

FRESHFIELDS7

Theglobalsurgein

dataprivacymassclaims

Itsclarificationwillshapeboththeprerequisitesforandthequantumofdamages,withmajorimplicationsforcorporateriskmanagement.

Practicalimplications:Businessesmustbepreparedformulti-prongedattacks–claimsfordamagesandinjunctions,brought,ofteninparallel,byconsumerorganizations,commercialSPVsandindividualclaimants.Arobustresponsestrategyiscrucialtominimizeriskandoperationaldisruption.MonitoringCJEU

developmentsisequallycritical.

InGermany,legalstrategyisnolongerjustaboutdefendingagainstdamages–it’saboutdisruptingprofessionalplaintiffs’businessmodelstoguardagainstanincreasinglyaggressivedatalitigationlandscape.

MartinMekat

Partner

TheNetherlands:Thego-tojurisdictionformassclaims

TheNetherlandsremainsamagnetforclassactions,withnearly100activecasesonthedocket.TheDutchWAMCAiswidely

regardedasclaimant-andfunder-friendly,offeringanopt-outsystemandmonetarydamages.Successfeesforlitigation

funders–sometimesupto25percentofaclaim’svalue

–maketheregimeespeciallyattractive.

Thatsaid,legaluncertaintiesremain.Theinterplaybetween

WAMCAandtheEURADisunresolved,andquestionsaround

additionalnationaladmissibilityrulesandopt-outdamages

undertheGDPRarebeforetheCJEUinamajorcaseagainst

Amazon.Recentjudgmentssuggestcloserscrutinyofclaimantorganizations,butpendinglegislativeamendmentsmaytilt

thebalancebacktowardplaintiffs.

Practicalimplications:TheNetherlandsremainsahigh-riskjurisdictionfordataandtechbusinesses.Becauseofthe

opt-outmechanism,asingleactioncancreatemassiveexposure.BusinessesshouldcloselymonitorforthcomingCJEUdecisions

andthelegislativereviewofWAMCAtoanticipateshiftsinthelegallandscape.

TheNetherlandsconsolidatesitspositionasa

premiervenueformassclaimsintheEU.ThekeychallengefordefendantsisthesheerscaleandfinancialexposurethattheWAMCA’sopt-out

systembrings.

MarkEgeler

Partner

EnglandandWales:Adaptingtonewchallenges

FollowingtheSupremeCourt’s2021LloydvGoogledecision,

bringingdata-relatedopt-outrepresentativeclaimsinEngland

andWaleshasbecomemoredifficult:‘lossofcontrol’wasfoundnottobeenoughforadamagesclaim,andclaimantsmustshowactualfinanciallossordistress.

TheCourtofAppealreinforcedthisinPrismallvGoogle(2024),reiteratingthehighthresholdforclaimantsinanopt-out

representativeclaimtomeetthe‘sameinterest’requirement.

Inamisuseofprivateinformationclaim,thismeanteachclaimanthadtodemonstrateareasonableexpectationofprivacyover

theaffecteddata.

ItisalsoworthnotingtheCourtofAppeal’sAugust2025decisioninFarleyandOthersvPaymaster,whichfoundnodeminimis

thresholdfordataprotectionclaims(asdistinctfrommisuse

ofinformationclaims).Instead,aclaimantmustestablishthatanyharmallegedwas‘well-founded’byreferencetothefactsknown–orthatshouldhavebeenknown–tothematthetime.

Itisclear,therefore,thatdatamassclaimsremainareal

prospect.Claimantfirmscontinuetoadvertisethattheyhave

recruitedthousandsofclientsafterdatabreaches,whilerecenthigh-profilecyberattackshavedrivenmoreactivity.TheLloyddecisionhaspushedclaimantfirmsandfunderstowardGroup

LitigationOrdersandcollectiveproceedingsintheantitrust

spacetobundleclaims.Courtsarealsoshowingprocedural

flexibility,includingthroughtheuseofthe‘leadclaimant’model.

FRESHFIELDS8

Theglobalsurgein

dataprivacymassclaims

Additionally,theSupremeCourt’s2023judgmentinR(PACCAR)vCompetitionAppealTribunalmadelitigationfundingmore

difficult,rulingthatfundingagreementsbasedonapercentageofdamagesareunenforceable.However,fundersareadapting.

InJuly2025,theCourtofAppealheldthat‘multipleofinvestment’litigationfundingagreementsareenforceable,andinAugust

2025,itoverruledalowercourttobreathefreshlifeintoanothermassclaim–illustratingthefast-movingfundingenvironment.

Practicalimplications:WhiletheLloydvGooglerulingmademassdatabreachclaimsbywayofopt-outrepresentativeactionmoredifficult,itdidnotshutthemdown.Claimantfirmsarefinding

creativepathsforward,evenwhereclaimsarelowinvalue.

Businessesshouldbepreparedformoreinnovativeformsofcasemanagementandfundingarrangements.

Databreachactionsremainafocusforclaimant

firms,withrecentrulingsdrivingapushtoward

morecreativeformsofcasemanagement.Therearepotentialgainstobemadebyembracingnovelapproachesthatmayofferacheaperandquickerroutetoresolvingmassdatabreachclaims.

CatGreenwood-Smith

Partner

UnitedStates:Expansionofprivacyclassactions

TheUSispoisedforasurgeindatabreachclassactionlitigation,drivenbythreemaintrends:

First,federalcourtsareprovidingexpansiveinterpretationsof

stateprivacylaws,particularlytheCaliforniaConsumerPrivacyAct(CCPA),allowinglawsuitsovercommontoolssuchas

cookiesandpixels.ThisisacrucialdevelopmentsincetheCCPAappliestocertaincompanies,regardlessoflocation,thatcollectorprocessCaliforniaresidents’personalinformation–andit

remainstheonlycomprehensivestateprivacylawgrantingaprivaterightofactionfordatabreaches.

Second,healthcare-sectorlawsuitsareincreasinglymoving

pastearlydismissalstages,raisingsettlementpressuregiven

thestrongjuryappealofsensitivehealthdata.Newstatehealthprivacylaws,suchasWashington’s,arealsocreatingnew

avenuesforclaims,includingprivaterightsofaction.

Third,recentsecuritiesclassactionsagainsttechcompanies

haveresultedinmultimillion-dollarsettlements,withplaintiffsallegingfailurestodisclose–ormisleadingstatementsabout–databreaches.ThistrendisreinforcedbyheightenedscrutinyfromtheUSSecuritiesandExchangeCommission(SEC).

Practicalimplications:Regardlessofwheretheyarebased,

businesseswithUScustomersfaceriskfromthepatchwork

ofstateprivacylaws.Eveneverydaywebtechnologiesmay

triggerlitigation.Robustdatabreachresponseplansandcarefuldisclosurepracticesareessentialtoreduceexposure.

IntheUS,theplaybookfordatabreachlitigationisbeingrewritten.Companiesmustnowlookbeyondtraditionaldatatheftandrecognizethateven

everydaywebtechnologiesarebeingusedasanewtoolforsophisticatedclassactions.

TimHoward

Partner

Lookingahead

Theglobaldatalitigationlandscapeisbecomingmore

aggressiveandcomplex.Businessescannotafford

tobereactive–proactive,multi-jurisdictionalstrategiesareessential.

InEurope,forthcomingCJEUrulingsonGDPRdamageswillbecrucial.IntheUS,statelawsandexpansive

courtinterpretationsarerewritingtheplaybook.Global

businessesmustmonitorthesedevelopmentscloselyandbuildresilient,cross-borderstrategiestomanagetherisks.

Datalawtrends2026

2.

Anincreasingly

fracturedglobal

rulebookfordata,

cyber,andAI

FRESHFIELDS10

Anincreasinglyfracturedglobal

rulebookfordata,cyber,andAI

Inbrief

Thegloballandscapefordata,cyberandAIisshiftingfast.DeregulatorymovesundertheTrump2.0administration

areindirecttensionwiththeEU’senforcement-drivendigitalstrategy.

TheUSisbettingonaninnovation-firstmodel,whiletheEUAIActisreshapinghowcompaniesoperate.Meanwhile,theUKandcountriesacrosstheAPACregionarepursuingtheirown,oftendivergentapproaches.

Forbusinesses,theresultisafracturedenvironment

wherepolicieshaveareasthatalignandconflictacrossAIgovernance,datatransfers,cybersecurityandconsumerprotection.Navigatingthesecrosscurrentsisnowcriticaltomanagingrisk–andunlockingopportunity–inthe

digitaleconomy.

Trump’sAIreset:Innovationfirst

SinceretakingofficeinJanuary2025,theTrumpadministrationhasmadeclearitscommitmenttoAIinnovationanddesireto

removeregulatorybarriersandboostinvestmentinUS-basedAIcompanies.

Thedayafterhisinauguration,PresidentTrumpannounceda

US$500bnprivatesectorinvestmentprojectinAIinfrastructure.Thefollowingmonth,VicePresidentJ.D.VancespokeattheAI

ActionSummitinParis,outliningtheadministration’splanstoclearthewayforAIinnovationandmoveawayfromtheBidenadministration’sfocusonAIsafety.

TheactionstakenbyPresidentTrumpintheimmediateweeks

followinginaugurationconfirmedthisshift,includingthesigningofaflurryofAI-relatedexecutiveorderstoenactaninnovation-forwardapproachandtherevocationofsomeofBiden’s

executiveordersfocusedonAIsafety.

ThereleaseofanunprecedentedAmericanAIActionPlan

andadditionalrelatedexecutiveordersinJuly2025affirmedtheadministration’snewdirection.

FRESHFIELDS11

Anincreasinglyfracturedglobal

rulebookfordata,cyber,andAI

Despitethefederalgovernment’schangeinapproach,

someUSstatesaremaintainingafocusonAIsafetyregulation.Forexample,Californiarecentlypassedthe‘Transparencyin

FrontierArtificialIntelligenceAct’—anewAIlawthatisnarrowerinscopethantheEUAIActbutimposesoverlappingrequirementsrelatedtoAItransparency,governanceandincidentreporting.

TheTrumpadministration’snewapproachtoAIinnovationhasalsoledtorecentpolicyandpersonnelchangesatUSfederal

agencies.Forexample,inJanuary2025,theEqualEmploymentandOpportunityCommissionremovedBiden-eraAIguidanceontheapplicationoffederalanti-discriminationlawtotheuseofAIforemploymentdecisions.

TheDepartmentofLaborsimilarlysignaledits‘AI&InclusiveHiringFramework’maynolongerreflectcurrentpolicies.

InMay2025,soonaftertheUSCopyrightOfficepublished

areportassessingthelegalityoftheuseofcopyrighted

materialtotrainAImodels,theTrumpadministrationfiredtheheadofthatagency,whichcouldbeconstruedasarejectionofthereport’sconclusions.

USAIandfreespeech

AtthesametimetheAIActionPlanwasreleased,PresidentTrumpsignedanexecutiveorderentitled‘PreventingWoke

AIintheFederalGovernment,’whichsignaledtheTrump

administration’sothertoppriorityalongsideAmerican-led

AIinnovation:ensuringthisAIisfreefrom‘ideologicalbias.’

Whilethisexecutiveorderechoedthemesofderegulation

(‘theFederalGovernmentshouldbehesitanttoregulatethefunctionalityofAImodelsintheprivatemarketplace’),italsoemphasizedtheobligationonfederalagenciestoensuretheyareonlyprocuringAItechnologiesthatare‘truth-seeking’

anddevelopedwith‘ideologicalneutrality.’

Thisfocuson‘ideologicalneutrality’intechnologyisnotnewforPresidentTrump.Onhisfirstdaybackinoffice,hemadeclearhisaggressivestanceoncounteringperceivedcensorshipononlineplatformswhenhesignedanexecutiveorderentitled‘RestoringFreedomofSpeechandEndingFederalCensorship.’

Alsoconcerningspeechissues,combattingAI-washing,

AI-generateddeepfakesandotherAI-relatedconsumer

harmshasbeenacontinuedfocusoffederalagencieslike

theUSFederalTradeCommission(FTC)andtheUSSecuritiesandExchangeCommission,andbyCongress.

Forexample,in2024,theFTCannouncedacrackdownondeceptiveAIpractices;inlinewiththisAI-washingfocus,theFTCissuedanorderinApril2025allegingamarketingcontentcompanyhadmadefalseclaimsaboutitsAI

capabilities.InMay2025,Congresspassedthe‘TAKEITDOWNAct’tocriminalizenon-consensualpublicationofintimateimages,includingdeepfakes.

AIandothertechcompaniesfacestrong

crosswindsfromtheTrumpadministration.

ManyseeopportunityintheTrump

administration’sremovalofAIregulations.

However,companiesmusttakecaretoensure

theydonotrunafoulofrulestheTrump

administrationhassetfor‘ideologicalneutrality,’andcancontinuetoexpectscrutinyoftheir

products,includingbytheFederalTradeCommissionandstateAttorneysGeneral.

BethGeorge

Partner

ContinuityinUScyberandchildsafety

WhiletheTrumpadministrationhasdivergedfromtheBidenadministrationinnotablewayswhenitcomestoitsapproachtoAI,ithascontinuedtheeffortsoftheprioradministrationinotherareasoftechregulation.

TheexpansionofAIsolutionspresentsuniquesecurityriskexposuresthatmeritanalysis

andthedevelopmentofrelevantmitigationstrategies.

BrockDahl

Partner

FRESHFIELDS12

Anincreasinglyfracturedglobal

rulebookfordata,cyber,andAI

Forexample,theUSDepartmentofJusticeandamember

oftheFTChavesignaledthattheiragencieswillenforcerules

fromtheprioradministrationregulatingUSdatatransfersto

foreignadversaries,includingunderthenewDataSecurity

PrograminitiatedunderaBiden-eraexecutiveorderandthe

ProtectingAmericans’DatafromForeignAdversariesActpassedin2024.InJune2025,PresidentTrumpsignedanexecutive

ordermaintainingcertainfederalcybersecurityeffortsby

PresidentBiden(includingfederaleffortsaroundpost-quantum

cryptography,BorderGatewayProtocol,andadvancedencryption).

Lastly,thenewFTCchairmanhasstatedthattheagencyremainsfocusedonprotectingchildrenonline,particularlyrelatedto

socialmedia.

Forexample,inJune2025,FTCregulationsrelatedtothe

Children’sOnlinePrivacyProtectionActcameintoeffectaftertheywereproposedduringtheBidenadministration.

TheUKbetsonbalance

TheUKisforgingadistinctivepathindigital

governance:whiletheOnlineSafetyActintroducesstrictobligationsonplatforms,particularlyto

protectchildren,ourflexible,pro-innovation

approachtoAIanddatasignalsaclearambitionfortheUK.Businessesshouldpreparefora

duallandscapeofcomplianceandopportunity,

balancingregulatoryriskwithdata-drivengrowth.

RachaelAnnear

Partner

TheUKispositioningitselfasadistinct‘thirdpillar’inglobal

digitalgovernance.Whileitisnotalwaysstraightforwardto

definitivelycharacterizetheUKasoccupyingatruemiddle

groundbetweentheEUandUS,theUK’sapproachaimsto

balancecompetingpressures.ItisselectivelyaligningwithmoreprescriptiveEUruleswherelegalcertaintyandcross-border

dataflowsrequireit,whilechampioninginnovation-led,agilesupervisionathome.

Thisthirdpillarstrategyhasbeguntodeliverresults,withUS

companiesincludingMicrosoft,NvidiaandGooglepledgingover￡150bnofinvestmentintheUKduringPresidentDonaldTrump’svisittotheUKinSeptember2025.

ThisthirdpillarismostapparentintheUK’sdivergencefromtheEUonAIanddataregulation.TheUKgovernmenthasrejectedrepeatedcallsforaspecific,EU-styleAIbill.

Instead,theUKpublishedapolicypaperinMarch2025outlininganewapproachforregulatorstosupportgrowth,statingthattheUKshould‘cutredtape’and‘createamoreeffectivesystem.’

ReadChapter3

ofthisreporttolearnmoreabouttheUK’sOnlineSafetyActandwhyUKandglobalbusinessesmustrethinktheirapproachtowardsyoungpeople’sdata.

TheUK’sdigitaldivergence

Thispro-innovationapproachavoidsprescriptivelegislation,whilestillensuringthereisregulatoryoversight.Inaddition,thegovernment’sData(UseandAccess)Act2025(DUAA),whichbecamelawon19June2025,illustratesatargeted

intentiontodepartfromtheEU’sGeneralDataProtectionRegulation(GDPR)frameworkinspecificareas.

Positionedasamoreflexibleandinnovation-friendlymodel,theDUAAseekstostreamlinecomplianceobligationsandintroducemechanismsthatsupportdata-drivengrowth,withparticular

emphasisoneasingburdensforsmallandmedium-sized

enterprisesandfosteringresponsibleAIdevelopment;

forexample,byallowingtheuseofcertaincookieswithoutexplicitconsentinspecificlow-risksituations.

However,thispro-innovationapproachisnotwithoutits

challenges.TheUKgovernmentabandoneditsplanstointroduceabroadcopyrightexemptionfortextanddataminingfollowing

intensebacklashfromcreativeindustries.WhiletheDUAA

requiresthegovernmenttoprepareandpublishareportontheuseofcopyrightworksinthedevelopmentofAIsystemsand

anassessmentoftheeconomicimpactofAIandcopyright,

theissueremainsunresolved,leavingtheUKwithaclearpolicychoice:liberalizecopyrighttoalignwiththeUSapproachor

strengthenprotectionsandtransparencyobligationsforrightsholders,moreakintotheEUAIAct.

FRESHFIELDS13

Anincreasinglyfracturedglobal

rulebookfordata,cyber,andAI

OnlinesafetyisanotherareawheretheUKispursuingblendedalignmentanddivergence.TheOnlineSafetyAct(OSA)becamelawinOctober2023,althoughitsobligationshaveonlyrecentlybeguntotakeeffect–platformshavinggainedalegalduty

toprotectusersfromillegalcontentfrom17March2025

andadutytoprotectchildrenonlinefrom25July2025.

TheOSAbearsnotablesimilaritiestotheEU’sDigitalServicesAct(DSA);bothregimesadoptaprescriptivestructure,

includingproactivecontentmoderation,riskassessments

andtransparencyreporting,withsignificantpenaltiesfornon-compliance,andanemphasisonplatformaccountability.

Atthesametime,theUKhasgivenspecialprominencetochildsafety,introducingobligationsthatgobeyondtheEUmodel.

UKchoosestoconverge,diverge,compete

Inotherareas,theUKhasmovedtoalignmorecloselywith

theEU,whileallowingroomtodifferentiatewhereitwants

tomaintainanedge.Forexample,thepolicystatementfor

theproposedCyberSecurityandResilienceBillcommitsto

modernizingtheUK’scyberresilienceframeworkandensuringit‘a(chǎn)lignswhereappropriate’withtheEU’supdatedNetwork

andInformationSecurityDirective,NIS2.

Intheconsumerprotectionspace,therearealsoclearparallels

betweentheEU’sproposedDigitalFairnessActandtheUK’s

DigitalMarkets,CompetitionandConsumersAct2024(DMCCA).ThenewpowersgrantedtotheCompetitionandMarkets

AuthorityundertheDMCCAallowittotakedirectenforcementactionagainstcompaniesusingdeceptive‘darkpatterns’

ininterfacedesignorhostingfakereviews,tacklingmanyofthesamedigitalfairnessissuesidentifiedintheEU.

Thispatternofselectivealignmentandstrategicdivergence

signalshowtheUKispursuingadualobjective:mirroringEurope’spro-regulatoryinstinctswhereitservesdomesticpriorities,whileprioritizingcompetitivenessandpracticalinteroperabilitywith

globalmarkets,includingtheUS,inhigh-growthareaslikeAI.

TheEU’snextphase:Fromrulestorollout

TheEUiscurrentlynavigatingacomplexperiodindigital

governance,markedbyadrivetowardsbothregulatory

coherenceandsimplification.Whileoftenperceivedashaving

arigidframework,recentdevelopmentsindicateamoreovertlynuancedapproach,acknowledgingtheimpactofextensive

legislationoninnovationandeconomiccompetitiveness.

Followingthe2019-2024institutionalterm–aperiodofintenselegislativeactivitythatproducedlandmarkregulationssuchas