Simplification without disempowerment: Rethinking the Digital Omnibus Regulation

The European Commission’s Digital Omnibus Regulation Proposal represents a major attempt to streamline and rationalise Europe’s increasingly complex digital regulatory landscape. This column argues, however, that simplifying regulation in the absence of functioning digital markets risks entrenching the power of the largest digital platforms and weakening Europeans’ already limited control over their data. To create digital markets, consumers must be empowered with effective control over key personal data and the ability to negotiate terms of use of these data.

The European Commission’s Digital Omnibus Regulation Proposal represents a major attempt to streamline and rationalise Europe’s increasingly complex digital regulatory landscape. After a decade of rapid expansion – the General Data Protection Regulation (GDPR), the Digital Services Act (DSA), the Digital Markets Act (DMA), the Data Governance Act (DGA), the Data Act, the Network and Information Systems Directive 2 (NIS2) – there is a widely shared view that the acquis has become too fragmented, too difficult to navigate, and increasingly costly for innovators and smaller firms. Regulatory simplification is therefore an understandable and legitimate goal.

But in its effort to streamline this landscape, the Commission has created a serious political and legal problem. Civil society groups, including the European Digital Rights network EDRi, warn that the Omnibus would roll back core digital rights and protections, potentially triggering future challenges before the Court of Justice of the European Union. The European Ombudsman has already highlighted “procedural shortcomings” in the Commission’s suggested legislative amendments (Gross 2025).

For a policy package meant to increase trust, harmonisation, and innovation, appearing to reduce the rights of EU citizens is an unfortunate and damaging outcome.

The problem is not simplification per se. The problem is simplification in the absence of functioning digital markets – markets in which consumers have meaningful control over their personal data and can exercise agency over how digital services use it. Without such markets, simplification risks reinforcing a structural imbalance that already defines the digital economy.

But there is a middle ground, one that promotes simplification of digital regulations and strengthens EU citizens’ digital rights. We articulate this middle ground in our ‘Innovation in the Digital Economy Architecture’ (IDEA) proposal (Twomey et al. 2025).

A dysfunctional ‘digital barter’ economy

Digital services – including search engines, social media platforms, email, mobile browsers, and AI-driven content feeds – are nominally free. But they are not free in economic terms. Users supply personal data in exchange for services priced at zero, while platforms monetise this data through targeted advertising, behavioural profiling, and (increasingly) AI model training.

This is not a market transaction. It is ‘influencer-financed digital barter’: users cannot negotiate terms; they do not control inferred data generated about them; they rarely understand the full extent of extraction; and they cannot easily switch without sacrificing essential digital capabilities.

In such an environment, simplifying regulation does not strengthen competition. It locks in incumbents, reducing the frictions they face while leaving untouched the extreme informational and bargaining asymmetries that prevent consumers from exercising choice.

Empirical evidence supports this concern. For example, van der Marel and Ferracane (2021) show that regulatory changes that weaken user control or relax obligations on powerful platforms can distort market competition and reduce the contestability of digital-services markets. There is in fact a sizable body of work showing that light-touch or one-dimensional digital regulation (privacy rules, transparency duties, data portability, etc.) tends to reinforce the market power of incumbent platforms unless it is coupled with targeted pro-competition tools that empower digital consumers. For example, Dunne (2022) argues that ex post, effects-based enforcement is inherently slow and narrow, which allows incumbents to entrench their dominance before cases conclude. Generic competition rules are too coarse to address platform-specific conduct (self-preferencing, tying across the ecosystem, data leveraging). Fast et al. (2023) emphasise that consumer empowerment tools like simplified consent, privacy notices, or basic portability rights are structurally too weak in markets where platforms enjoy strong data network effects and economies of scope; multi-homing is costly; and switching and coordination problems make it hard for users to collectively discipline a dominant platform. Di Porto and Zuppetta (2021) show that pure transparency and simplified disclosure obligations tend to legitimise and stabilise platforms’ regulatory role instead of constraining it. Wu and Pang (2021) provide evidence that a uniform, ‘simple’ privacy regime without targeted pro-competitive measures inadvertently raises entry barriers, thereby strengthening incumbents and dampening the rate and diversity of innovation.

Thus, instead of enabling a more dynamic European digital economy, the Omnibus – if implemented without complementary reforms – risks:

• entrenching the power of the largest digital platforms;
• weakening Europeans’ already limited control over their data;
• undermining trust in the EU’s digital regulatory model; and
• reducing the contestability of both digital and AI markets.

Why simplification is desirable – but dangerous under current conditions

In a well-functioning market, simplification reduces unnecessary administrative burdens and frees up resources for innovation. But in a non-market environment, where consumers cannot express preferences or exercise control and where providers hold quasi-monopoly power over data, simplification becomes a tool that disproportionately benefits those who already dominate the system.

It is analogous to simplifying and harmonising the rules of indentured servitude: unless the underlying power relationships are addressed, simplification reinforces the dominance of the masters rather than elevating the position of the servants.

The EU’s declared objectives – innovation, competitiveness, and trust – require something more fundamental: the creation of actual digital markets in which exchange is governed by transparent rights, enforceable agency, and fair competition.

A ‘middle way’: Simplification with empowerment

The dilemma is unnecessary. There exists a middle way that allows Europe to simplify its digital regulations while avoiding any rollback of digital rights. This approach is articulated in the IDEA proposal.

IDEA starts from a simple principle: digital markets cannot function without empowered digital consumers. To create such markets, consumers must be empowered over two phases of their personal data:

1. Effective control over key personal data (KPD), defined as a subset of personal data that are subjected to trusted-party verification, which are held in legally recognised, consumer-controlled data repositories that serve as the authoritative, auditable source of verified personal data. Key personal data consist of those unique digital identifiers of EU digital consumers which can be clearly defined in an agreement for use between the consumers and data aggregators. They are the sort of data normally required for entering into a contract or satisfying governmental or major identity requirements. Examples would include names, personal identification numbers, personal address information, geolocations, personal telephone numbers, personal characteristics such as images, fingerprints, or handwriting, biometric data, information identifying personally owned property, and computing and communications device information. (The final list, informed in part by the data categories supported and managed in the EU Digital Identity Wallet, GDPR, and the European Digital Identity Regulation (EDIR), will emerge from a process of public consultation.)
2. Effective negotiation of terms about use of personal data: from control over access to KPD (which is the core of customer management data), being able to negotiate, through the help of expert fiduciary representatives, terms around the collection and use of data observed from their online behaviour (e.g. clickstreams, location traces, interaction patterns) or inferred about them (e.g. affinity scores, personality traits, risk categories, predicted vulnerabilities).

Europe’s digital acquis currently provides strong protections for personal data. However, rights remain limited for behavioural data and have almost no practical reach over much inferred personal data, mainly because users lack knowledge of them. The latter are the most economically valuable category of data, particularly inferred data for AI training.

The IDEA proposal therefore calls for the following:

• Explicit consumer rights over key personal data, enabling citizens also to negotiate to see and set the terms of use of data that platforms observe or infer about them.
• Collective bargaining rights through fiduciary digital representatives who can negotiate terms of data use on behalf of groups of citizens.
• Clear market rules governing the exchange of digital services and personal data, enabling consumers to express preferences and firms to compete on privacy, relevance, quality, and user alignment.
• Simplified regulation that remains consistent with consumer agency and does not force trade-offs between efficiency and rights.

Under this model, simplification and empowerment reinforce each other. A streamlined regulatory regime becomes credible and politically sustainable precisely because consumers hold the levers necessary to discipline digital service providers and enable contestable entry.

Why this matters for Europe’s strategic objectives

Europe’s competitiveness depends increasingly on its ability to develop trustworthy AI systems, foster digital innovation, and maintain high societal standards. Achieving this requires:

• consumer trust as a foundation for data availability and responsible AI training;
• flexibility and simplification to reduce compliance burdens;
• contestable markets that allow European firms – not only global incumbents – to innovate; and
• legitimacy in the eyes of EU citizens.

The Digital Omnibus, in its current form, threatens to undermine this balance. A simplification strategy that weakens rights is politically fragile, economically misguided, and strategically self-defeating.

By contrast, a simplification strategy that strengthens consumer agency can increase innovation, reduce administrative burdens, and reinvigorate the European digital ecosystem.

Conclusion

The Commission is right to pursue simplification. But simplification cannot come at the expense of citizens’ rights, trust, or agency. If Europe wants digital markets to function, it must create the conditions for markets to exist. Without empowering digital consumers, simplification will entrench the dominance of today’s platforms and stifle tomorrow’s innovators.

The IDEA proposal provides a principled, practical, and politically feasible path forward: regulatory simplification that preserves rights, creates functioning markets, and unlocks innovation. The choice is not between complexity and disempowerment. The real choice is between a digital economy designed for European citizens and one that continues to operate at their expense.

Source : VOXeu