The European Commission today presented two sweeping Digital Omnibus proposals that threaten to severely weaken the foundation of digital protection and human rights in the EU. According to digital civil rights organization EDRi, the move represents an unprecedented deregulation of crucial rules such as the General Data Protection Regulation (AVG), the ePrivacy Directive and the AI Act.
These proposals are not unexpected. A week ago, leaked documents appeared via Politico and Reuters already showing that the Commission was preparing far-reaching relaxations under the guise of "administrative simplification." These documents revealed that companies would be allowed to use personal data, including sensitive data, for AI training based on a "legitimate interest." It also revealed that the Commission was considering revising definitions of personal data and moving cookie rules into the AVG. Organizations such as noyb and EDRi warned even then of a major decline in privacy protection.
The leaking of these plans immediately led to criticism from a broad coalition of civil society organizations, trade unions and human rights organizations. The Dutch Legal Committee for Human Rights (NJCM) pointed out that the Digital Omnibus not only simplifies but also structurally weakens the protection of citizens. According to the NJCM, the EU thereby gives too much space to Big Tech's lobby and to actors who oppose a fair, secure and democratic digital landscape.
With the Digital Omnibus and the Digital Omnibus for AI, the European Commission is introducing a restructuring of the digital regulatory framework. Although presented as a simplification, important safeguards appear to be weakened in practice. One example is moving a key ePrivacy provision on device access into the AVG. This allows companies in certain cases to read data from devices without prior consent. The new "privacy signal," which should allow people to easily refuse consent, will not be implemented for another two years and also does not apply to many media platforms.
Furthermore, central parts of the AVG are being rewritten. The definition of personal data will be narrowed. Companies are given more leeway to use sensitive data for AI training. Rules around automated decision-making are also relaxed. These changes increase the risk of discrimination and make oversight more difficult. Minority groups are therefore at greater risk of profiling and monitoring. At the same time, both companies and governments are given more opportunities to collect and process personal data with less transparency and less control.
The Digital Omnibus for AI additionally weakens fundamental safeguards from the AI Act. Suppliers and developers of AI systems can evade core transparency and documentation obligations in certain circumstances. The introduction of obligations for high-risk systems is also delayed, with no clear indication of when they might still take effect. This creates a situation where citizens have fewer options to protect themselves from harm by AI systems.
The concerns raised during the leaked plans - especially that risky algorithms will be less rigorously monitored - appear to be confirmed by this.
Civil rights organizations, including EDRi, warn that the proposals mainly benefit large technology companies and certain member states betting on industrial interests. The Commission uses fast-track legislative routes, leaving little room for democratic control or extensive consultation. Legal experts pointed out last week that Omnibus I, previously approved by the European Parliament, may violate EU law because it weakens sustainability obligations.
The NJCM emphasizes that fundamental principles are eroded when sensitive personal data are less protected. The organization points out that characteristics that can be inferred by AI - such as political beliefs or ethnicity - actually require extra protection. The NJCM also considers the possibility of basing AI training on a "legitimate interest" a dangerous change of direction, especially as AI systems increasingly impact autonomy and self-determination.
Civil society organizations are calling on the European Parliament and member states to stop this weakening of privacy, AI and environmental protection. According to these organizations, the EU does not need fewer rules, but more commitment to enforcement and consistent policies. Moreover, the Digital Fitness Check, launched in parallel with the Omnibus, could have major implications for all EU laws with a digital component. EDRi argues that it is "open season" on digital rights and warns of a point of no return.
The current course of deregulation appears to be working its way into future legislation. The planned Digital Fairness Act of 2026 should modernize consumer rights and oversight of digital platforms, but it is uncertain whether this will lead to strengthening or further eroding protections. EDRi and other organizations therefore advocate for a strong human rights-based digital rule of law, with robust enforcement and clear democratic control. They stress that innovation should not be used as an argument to weaken basic protections for citizens.
