The EU and the US agree to a new deal on data transfers after EU judges threw out two previous pacts over privacy concerns; Meta had threatened to leave the EU
The European Union and the US sealed a new deal on data transfers after EU judges threw out two previous pacts partly over fears …
Context & Ripple Effects
This deal closes a three-year legal gap. The 2016 Privacy Shield framework was struck down by EU judges over surveillance concerns, leaving transatlantic data flows in limbo until the EU and US signed a preliminary pact in March 2022 to store Europeans' data on US soil after promised American surveillance changes.
That preliminary agreement moved through a draft approval published in December, but the pressure kept mounting: in May the EU hit Meta with a record €1.2B GDPR fine and ordered it to stop US transfers and delete stored data — the dispute behind Meta's threat to leave the EU entirely.
First-order effects
- Meta gets a legal basis to resume sending European user data to the US, defusing both the deletion order hanging from its €1.2B fine and its threatened EU exit.
- Thousands of other US firms that depend on transatlantic data flows regain an official transfer mechanism after years of operating on uncertain legal footing.
Second-order effects
- Privacy campaigners are expected to mount a fresh legal challenge against the pact — the same route by which two predecessors were invalidated — so companies face renewed risk of another abrupt invalidation.
- Rival platforms and cloud providers that invested in EU-only data storage to hedge against transfer uncertainty now compete against firms that can revert to cheaper US-based infrastructure.
Third-order effects
- If EU judges invalidate this third pact too, the recurring court-driven cycle points toward structural fixes rather than patched agreements: deeper US surveillance-law reform or forced regional data residency for major platforms.
- The pattern pushes data governance toward jurisdiction-by-jurisdiction compliance regimes, raising the cost of operating globally and advantaging firms large enough to maintain parallel infrastructures.
The trend: Transatlantic data governance is cycling through successive patchwork pacts as EU courts keep invalidating them over US surveillance practices, steadily pushing global platforms toward regionally siloed data operations.