The EU has proposed simplifying and softening its digital regulation. This will only make the bloc more vulnerable to the coercion of America’s big tech firms.
On November 24th, EU representatives presented their US counterparts with the European Commission’s new “digital omnibus package”. Its pro-business language and deregulatory aims were not enough to please the Americans. The US commerce secretary, Howard Lutnick, was quick to dismiss the proposal outright. Instead, he linked any reduction of the 50% tariffs on European aluminium and steel to the EU weakening its Digital Markets Act (DMA) and the Digital Services Act (DSA) to ease pressure on US tech firms. As commission vice-president Teresa Ribera rightly noted, this amounts to “blackmail”. Once again—just as during the US-EU summit in Turnberry in August—Brussels has tried to appease Washington with conciliatory language and softer policies, only to discover that the US administration is not interested in negotiation but in imposing its will.
The EU’s omnibus proposal seeks to amend a broad set of EU digital regulations including GDPR, its landmark privacy legislation, the Data Act, the cybersecurity-focused NIS2 directive and the AI Act. According to the commission, the goal is to reduce administrative burdens, harmonise overlapping obligations and streamline reporting. With respect to the AI Act, the proposals would slow the phasing-in of obligations for high-risk and general-purpose systems, giving companies more flexibility in early-stage development.
The package draws on the September 2024 Draghi report, which identified red tape and regulatory fragmentation as some of the key drivers of the EU’s declining competitiveness relative to the US. Consistent with Draghi’s recommendations, and with a growing pressure from the European business community, commission president Ursula von der Leyen instructed her commissioners to simplify legislation and cut administrative burdens by at least 25% and by 35% for small and medium sized enterprises.
European firms do face overlapping obligations that consume time and money. However, to deliver on simplification, the package reduces privacy protections and AI safety regulations, effectively introducing deregulation—a long-sought goal of US big tech firms. Lutnick’s ultimatum exposes this flawed thinking, as the new omnibus will further weaken the EU’s ability to withstand US pressure.
The commission’s simplification narrative effectively accepts the core accusation from the US and its big tech: that Europe lags in innovation because it regulates too much. Yet Europe’s innovation gap is not primarily due to regulation. It is rooted in persistent internal market barriers and in the lack of mechanisms to keep European savings and skills within Europe rather than flowing to the US. Addressing these structural weaknesses—analysed thoroughly in the Draghi report—has not been prioritised. The long-discussed “28th regime,” which would allow firms to operate across the single market under one unified code, is nowhere to be seen.
This innovation-versus-regulation framing is also simplistic. Often, regulation is essential to create the market conditions and incentives under which innovation can happen. In the case of digital policies, EU and US competition authorities have repeatedly shown that it is the concentration of market power among a handful of US tech giants which stifles innovation and the entry of new players—hence the heavy fines levied on these firms and their lobbying to pressure Washington into watering down EU competition rules.
Second, by adopting a narrative aligned with big tech’s interests, the EU undermines the very feature that makes its regulatory model globally attractive: its commitment to putting social goals and fundamental rights ahead of commercial interests. Despite reassurances from French and German leaders at the recent Summit on Digital Sovereignty that the digital omnibus would not weaken digital rights, EU political groups such as the Socialists and Democrats and the Greens, experts, and civil society groups warn it dilutes essential protections under GDPR and grants companies excessive discretion in interpreting their obligations. This serves big tech, not the average European small business, which still faces structural disadvantages; and not the European citizen, whose protections risk being weakened.
The fact that the EU regulates technology should not be seen as a liability but as a proof of its strength. Around the world, it is recognised as a sign that Europe uses regulation to shape markets according to key values such as ethics, safety and fairness, rather than purely commercial considerations. Whatever Europe’s data protection regime and AI regulations flaws are, the real anomaly is that due to big tech’s lobbying power, the US still lacks an AI or federal privacy law.
Third, by focusing on “simplification”—often a veil for outright deregulation—the EU overlooks the true weakness of its digital governance: insufficient enforcement of the rules it already has. These exist to safeguard European rights to privacy and safety and protect it against US coercion. Besides, to know where to simplify the rules, they first need to be enforced.
Under GDPR, enforcement is stalled due to the central role of Ireland, where American Big Tech has headquarters and gets a more favourable treatment. Similarly, DSA enforcement is fragmented, slow and inconsistent across member states, allowing platforms such as X, Meta and TikTok to avoid meaningful accountability for the amplification of polarising content or the exposure of minors to harm. For the DMA, although the commission has a strong investigative mandate, its credibility as an impartial regulator is weakened by political considerations—particularly in transatlantic cases.
For years, US big tech has successfully lobbied Washington to avoid or dilute regulations affecting them. The result has been an unprecedented concentration of market power which, as President Joe Biden denounced in his farewell speech, has morphed into a political power that threatens democracy. For years, Europe has held its ground against big tech’s market and political power. Now with Donald Trump in the White House, the administration, together with America’s tech giants, has begun to target European regulation.
As ECFR fellow Tobias Gehrke argued regarding the Turnberry trade and investment agreements between the US and the EU, by refusing to deploy anti-coercion instruments capable of deterring hostile actions, the EU increases its vulnerability to American coercion. This is a familiar pattern: as commerce secretary Lutnick showed, far from rewarding legislative simplification, the US simply presses harder. For the Trump administration, a half-open door is not an invitation to negotiate but to force its way through.
What Europe should do
The central challenge the EU faces on digital policy is sovereignty and democracy, not regulatory complexity. As a recent op-ed by the US ambassador to the EU shows, the US government is now setting its sights on coercing the EU into scraping environmental regulations so American energy firms can make more and better deals with Europe. Clearly, giving an inch to this US administration is inviting it to take a yard.
The EU should understand that its weakness vis-à-vis the US stems not only from its huge technological dependencies—that is the lack of a European stack of technology—but also from the absence of strong legal tools, political coalitions and political will to resist pressure from both the US government and its big tech firms.
Wherever there are overlapping norms and regulatory barriers to competitiveness, simplification should be welcomed. But any simplification agenda in the digital field should be matched by a credible and robust enforcement agenda for existing or future norms. Lack of compliance puts European democracy, markets and values in danger. Big tech companies prefer to pay fines, invest heavily in lobbying and rely on Washington to shield them. Simplification alone, however well-intended, will not change this.
Balancing simplification with stronger enforcement and the design of new tools to resist US coercion would demonstrate that the EU is not compromising its values or its sovereignty. Clearer, fewer rules should in theory make enforcement easier. But the omnibus does not achieve this. And without effective enforcement and the right anti-coercion tools, Europe loses not only credibility but leverage.
About the author:
Dr José Ignacio Torreblanca is a Senior Adviser and Distinguished Policy Fellow at the European Council on Foreign Relations.