Privacy group slams EU for changing the data rules to cater to AI

Privacy campaign group noyb said proposed EU GDPR amendments would allow AI companies to process vast amounts of personal data under a presumed “legitimate interest,” without obtaining user consent. Max Schrems characterized the proposal as a dilution of fundamental data-protection rights that could benefit companies such as Google, Meta and OpenAI, while creating material legal uncertainty. The measures could face a Court of Justice challenge, given the court previously invalidated the Safe Harbor and EU-US Privacy Shield data-transfer frameworks.

Analysis

The investable issue is not near-term compliance cost but the durability of EU training-data rights. If a broad legitimate-interest standard survives, GOOG gains a relative advantage versus smaller European model developers: its installed consumer-data graph, legal budget, and compute scale turn proprietary data access into a barrier to entry. Alphabet’s incremental AI monetization upside would likely show first in product quality and ad-targeting/agent performance rather than a discrete revenue line, making the impact diffuse but strategically meaningful over 6-18 months.

The legal pathway creates the opposite near-term outcome: an expansive rule may encourage data-set investment before judicial review, only to leave companies with model retraining, product redesign, and damages exposure if the CJEU later narrows or invalidates it. That uncertainty is more harmful to firms whose AI economics depend on EU consumer-data ingestion than to enterprise software vendors using customer-controlled data. Microsoft, SAP and Oracle are comparatively insulated through enterprise contracts and private-cloud deployments; EU-native privacy tooling and data-governance vendors benefit regardless as audit, provenance, deletion, and consent-management spend rises.

Consensus may incorrectly treat deregulation as unequivocally bullish for Big Tech. A permissive political proposal could increase the probability of a high-profile constitutional challenge, while any eventual adverse ruling would be more disruptive after companies operationalize the new standard. The key 1-3 month catalyst is legislative text and member-state alignment; the decisive 6-18 month risk is formal litigation or a preliminary CJEU referral. This is not sufficient alone to alter Alphabet earnings estimates, but it raises the left-tail regulatory discount on European AI optionality.

Key Decisions for Investors

• Maintain GOOG as a relative long versus EU consumer-internet exposure, but do not add solely on this development; reassess if final text explicitly permits training on legacy data without opt-out. Upside is strategic multiple support over 6-18 months, while downside is a later legal reversal rather than an immediate earnings miss.
• Pair candidate for regulatory-risk hedging: long SAP / short GOOG in a modest 3-6 month overlay if GOOG materially outperforms on perceived EU AI deregulation. SAP’s enterprise-data architecture is less exposed to a consumer-data ruling; invalidate the pair if SAP cloud backlog or AI-bookings commentary weakens materially.
• Monitor announcements from noyb, the European Parliament’s final position, and any CJEU referral. A formal challenge after enactment is the trigger to reduce EU AI-data assumptions for GOOG and increase exposure to data-governance beneficiaries; until then, treat legal risk as an alert, not a standalone short catalyst.
• Watch for GOOG disclosure of EU-specific AI product restrictions, opt-out rates, or incremental privacy/legal provisions at the next two earnings calls. Any quantified increase in compliance costs or reduced model functionality would falsify the view that scale can absorb the regime with limited financial effect.