Overview
- Brussels proposed targeted changes to GDPR, including a narrower definition of personal data, a new legitimate-interest basis for AI training, and clarifications on when anonymized information falls outside privacy law.
- High-risk AI obligations under the AI Act would be pushed back about 16 months to December 2027, covering uses such as biometrics, hiring and exams, health services, creditworthiness, public services and law enforcement.
- Cookie rules would be streamlined so users face fewer pop-ups, can give one-click consent, and store preferences in browser or operating-system settings, with some basic analytics no longer requiring banners.
- The package includes business relief such as lighter documentation for SMEs, limited exemptions from cloud-switching rules and a proposed European Business Wallet, with the Commission citing significant cost savings.
- Civil society groups, including 127 organizations, denounced the plan as a major rollback of digital rights, while the Commission argues it is a simplification to boost competitiveness; the proposals still require approval by EU countries and the European Parliament.