EU Legislators Seek to Make Data Protection 'by Default'

30 October 2026

The European Union is advancing data protection from concept to implementation: new regulations aim to embed privacy by default across technologies from personal devices to e-commerce platforms. By 2025, data protection could become a core engineering requirement rather than a compliance add-on.

GDPR’s “by Design” Compliance Baseline

The General Data Protection Regulation (GDPR) established "data protection by design," requiring companies to prioritize privacy during product development. The regulation mandates "technical and organizational measures" to safeguard consumer data, emphasizing early-stage integration for any data processing activity.

The GDPR holds data controllers and processors accountable for compliance - they cannot delegate their fundamental responsibility to protect consumer information.

With many global digital platforms resisting rather than embracing these principles, the EU is strengthening enforcement. The goal is to position data protection as the foundation of digital services from initial engagement through transactions, not as a secondary consideration.

Media Service Exemptions and Payment Overhaul

The European Commission's 2025 Digital Simplification Proposal represents a significant escalation. It requires clear, actionable consumer consent at the browser and application level where most digital interactions begin. The proposal states that personal data processing on devices—including smartphones, smart appliances, and computers—will fall exclusively under GDPR oversight, consolidating consent requirements where previously two frameworks applied.

The plan further directs standardization bodies to create specifications for machine-readable user data preferences—a more precise requirement than existing "technical measures" language.

A six-month adaptation period will precede stricter enforcement. Once implemented, websites and mobile apps must honor automated signals conveying user preferences.

Notably, media service providers are exempt from respecting these automated consumer signals. Whether this creates a privacy sanctuary in media platforms or reflects special treatment remains debated.

Payment Services Prove the Point

The most rigorous application of data-by-default principles emerges in upcoming payment services regulation. By 2026, the payment industry will face stringent compliance obligations.

The draft payment services legislation requires data access primarily through dedicated open banking APIs. Payment service providers automatically participate unless specific exemption clauses apply without introducing unacceptable risk.

Consumer protections are particularly robust. Financial accounts cannot discriminate against legally resident EU consumers based on nationality or residence.

This framework explicitly guarantees data access through standardized APIs while prohibiting discriminatory barriers. Security provisions include strong customer authentication protocols, transaction monitoring, and defined liability structures—ensuring accountability for data handling.

Marketplaces, APIs and Core Digital Objectives

Marketplaces face new requirements under the Digital Services Act. By 2026, they must disclose seller details including banking information and tax identifiers. Account verification processes gain legal force as "directly applicable" requirements.

Engineering and product teams now wield substantial compliance influence. The emphasis on machine-readable preferences, API standardization, access equality, and anti-discrimination transforms digital components into legally mandated compliance platforms—for payments, registrations, and user profiles alike.

Will this institutionalize privacy as an inherent digital property? Or will it create friction where consumer protections constrain automation—perpetuating endless "Accept Cookies" dialogs?

Europe's regulatory approach creates opportunities for platforms specializing in compliant infrastructure. The advertising sector's post-GDPR pivot from ad-reliant models to premium content demonstrates such adaptation. Most digital operators now face significant legal, technical, and supply chain adjustments to meet these evolving standards.