As GDPR turns four, despite some positives, regulators are struggling with enforcement, the ad industry remains littered with potential abuses, and more
The world-leading data law changed how companies work. But four years on, there's a lag on cleaning up Big Tech.
Context & Ripple Effects
Four years into GDPR, the enforcement gap described here extends a pattern documented earlier: European authorities were constrained by limited funding, staffing and company delays in a long-running enforcement bottleneck. The concern was especially acute around Ireland's lead regulator and its willingness to pursue firms central to the local economy.
The gap matters competitively as well as for privacy. Earlier coverage found that GDPR's compliance burden had favored large technology companies over smaller firms, while the current account says data-practice risks persist in advertising.
First-order effects
- GDPR regulators remain unable to translate the law's rules into timely cleanup of Big Tech, leaving the companies facing less immediate enforcement pressure than the framework implies.
- Advertising businesses continue operating amid potential data-practice abuses, with enforcement shortcomings failing to close the identified gaps.
Second-order effects
- Smaller companies still bear comparatively high compliance costs while large technology firms retain the scale advantages previously associated with GDPR compliance.
- Regulators' resource and enforcement constraints keep attention on lead authorities' capacity and willingness to pursue the technology firms under their remit.
Third-order effects
- If enforcement continues to lag, GDPR risks functioning as a compliance burden that entrenches incumbent data platforms rather than as an equal constraint on data-driven businesses.
- The durability of privacy regulation will increasingly depend on regulator capacity and cross-border enforcement execution, not the existence of rules alone.
The trend: Privacy law is moving from rulemaking toward an enforcement-capacity test, with the outcome shaping both data protections and platform competition.