On June 19, 2025, the French Data Protection Authority (“CNIL”) published two recommendations for AI developers. The first recommendation covers reliance on the GDPR’s legitimate interest legal basis for developing an AI model. It provides examples of legitimate interests that can justify the use of personal data for AI development.
Continue Reading CNIL Publishes Recommendations on Legitimate Interest as a Legal Basis for AI Training
Digital Fairness Act Series: Topic 2 – Transparency and Disclosure Obligations for AI Chatbots in Consumer Interactions
AI chatbots are transforming how businesses handle consumer inquiries and complaints, offering speed and availability that traditional channels often cannot match. However, the European Commission’s recent Digital Fairness Act Fitness Check has spotlighted a gap: EU consumers currently lack a cross-sectoral right to demand human contact when interacting with AI chatbots in business-to-consumer settings. It is still unclear whether and how the European Commission is proposing to address this. The Digital Fairness Act could do so, but the Commission’s proposal is only planned to be published in the 3rd quarter of 2026. This post highlights key consumer protection considerations for companies deploying AI chatbots in the EU market.
AI Chatbots Cannot Be the Only Contact Channel
Under EU law–particularly the Consumer Rights Directive (“CRD”) and the eCommerce Directive–consumers must have access to traditional communication channels such as the trader’s postal address, telephone number, and email address. The Court of Justice of the EU has made clear that consumers must be able to contact traders directly, quickly, and effectively (Case C-649/17). While chatbots can assist, they cannot replace mandatory human contact options.
AI Chatbots as Supplementary Communication Channels
The CRD requires traders to disclose their primary contact details before concluding a contract, but does not prohibit offering AI chatbots as additional communication tools. Where chatbots enable consumers to retain durable records of their interactions – including timestamps – traders should inform consumers about that. Durable records are defined as information stored in a medium accessible and unalterable for future reference, such as emails or downloadable files.
In any event, certain communications, such as the acknowledgment of a consumer’s right of withdrawal, must be provided in a “durable medium,” ensuring consumers have a stable and accessible record of important contractual information.
Human Oversight and the Right to Human Intervention
Continue Reading Digital Fairness Act Series: Topic 2 – Transparency and Disclosure Obligations for AI Chatbots in Consumer InteractionsCJEU Rules on Fairness of Remuneration Clause in Sports Contract
On March 20, 2025, the Court of Justice of the European Union (“CJEU”) ruled on the fairness, under EU consumer protection law, of a contractual clause allocating a percentage of an athlete’s income to a professional services provider (Case C‑365/23 [Arce]). This ruling sets an important precedent and strengthens the protection afforded by consumer protection law to minors who enter into professional service contracts, whether in sport or elsewhere.
Background
The case was referred to the CJEU by a Latvian court. It concerns a contract whereby a company undertook to provide career support services – including coaching, training, sports medicine, sports psychology, career guidance, club contracts, marketing, legal services, and accounting – to a basketball player, who was a minor at the time and therefore represented by his parents. In exchange for the company’s services, the athlete agreed to pay 10% of any net income (plus VAT) he would receive over a period of 15 years from the signing of the contract. At the time of signing the contract, the athlete was not a professional. Some years later, however, he became a professional athlete. When the athlete refused to pay the percentage to the company, the company sued him to enforce the contract. The Latvian courts asked the CJEU, whether it could assess the fairness of this long-term financial commitment under the Latvian legislation implementing Directive 93/13/EEC on unfair terms in consumer contracts (“UCTD”).
Application of the Unfair Contract Terms Directive
Under the UCTD, a contractual clause in a business-to-consumer contract (not negotiated by the consumer) is unfair if it causes a significant imbalance in the parties’ rights and obligations under the contract, to the detriment of the consumer. The CJEU ruled that the UCTD, as transposed into Latvian law, applies to the contract between the professional services provider and the athelete because the athlete was not yet engaged in professional sport at the time the contract was signed. The status of “consumer” must be assessed at the time of the conclusion of the contract. Consequently, the athlete was a “consumer” within the meaning of the UCTD. The CJEU ruled that the UCTD applies even if the individual later embarks on a professional career.
Continue Reading CJEU Rules on Fairness of Remuneration Clause in Sports ContractConsumer Watchdogs Turn Their Attention to the Online Gaming Industry
On March 21, 2025, the European Commission announced that the Consumer Protection Cooperation Network (“CPC-N”) had initiated enforcement proceedings against an online gaming company, for allegedly violating EU consumer protection laws and engaging in practices that could pose a particular risk to children. The gaming company now has one month
Continue Reading Consumer Watchdogs Turn Their Attention to the Online Gaming IndustryGerman SA Checks Whether Online Retailers Allow Consumers to Make Purchases Without Creating an Account
In January 2025, the German Supervisory Authority of Hamburg (“HSA”) examined the practices of online retailers based in Hamburg as to whether they allowed consumers to make purchases without creating a user account. This was mentioned in a press release issued by the HSA regarding a ruling by the Hamburg Higher Regional Court confirming a HSA’s decision that online retailers may, in certain circumstances, require consumers to create a user account. This, in turn, follows the guidance published by the German supervisory authorities (“German SAs”) in 2022 (in German), which stated that online retailers generally may not require consumers to create a user account in order to make a purchase.
Background: German SAs’ Guidance
According to the German SAs, there may be practical reasons for consumers to create an account for online purchases (e.g., to keep relevant information for future purchases), but it cannot be assumed that they are always interested in doing so. Therefore, consumers should be able to shop online without creating an account.
With respect to the processing of the consumer’s account information (e.g., username, password, order history), the German SAs take the view that the creation of an account is generally not necessary for the performance of the purchase contract so that the online retailer generally may not rely on this legal basis (Article 6(1)(b) GDPR). However, the German SAs also recognized that there may be situations where online retailers may require consumers to create an account, for example, specialized dealers for certain professional groups. In any case, the online retailer must limit the processing of the personal data to the extent necessary in order to comply with the data minimization principle (Article 5 (2) (c) GDPR). For example, if a consumer chooses not to create an account, the online retailer should only collect and further process the data necessary to fulfill the order and should delete the data after that fulfillment, unless the online retailer is required by law to archive the data.
In the absence of “contractual performance” as a legal basis (see above), the online retailer requires the consumer’s consent (Article 6(1)(a) GDPR) for the processing of his or her data in connection with the creation of an account, according to the German SAs. As this consent must be freely given, the consumer should have the choice to make a purchase with or without a user account. Consumers that choose not to create a user account should not suffer any disadvantages; in particular, the online trader should not make it more difficult to place an order or reduce the level of security for the protection of personal data.
For consumers who choose to create an account, online retailers may only use account information (such as order history) for advertising purposes if they obtain separate consent from the consumer. They also need separate consent to retain consumers’ payment information for future purchases.
Continue Reading German SA Checks Whether Online Retailers Allow Consumers to Make Purchases Without Creating an AccountEuropean Health Data Space Published
On March 5, 2025, the Regulation on the European Health Data Space (“EHDS”) was published in the Official Journal (see here). The text enters into force on March 25, 2025, however it only becomes applicable in a staggered manner over several years.
The section on secondary use of the
Continue Reading European Health Data Space PublishedEDPB highlights the importance of cooperation between data protection and competition authorities
On 16 January 2025, the European Data Protection Board (“EDPB”) published a position paper, as it had announced last year, on the “interplay between data protection and competition law” (“Position Paper”).
In this blogpost, we outline the EDPB’s position on cooperation between EU data protection authorities (“DPAs”) and competition authorities (“CAs”) in the context of certain key issues at the intersection of data protection and competition law.
Key takeaways
- In the interest of coherent regulatory outcomes, the EDPB advocates for increased cooperation between DPAs and CAs.
- The Position Paper offers practical suggestions to that end, such as fostering closer personal relationships, mutual understanding, and a shared sense of purpose, as well as more structured mechanisms for regulatory cooperation.
- The EDPB is mindful of the Digital Markets Act’s (“DMA”) significance in addressing data protection and competition law risks.
Summary of the Position Paper
The EDPB first outlines certain overlaps between data protection and competition law (e.g., data serving as a parameter of competition). The EDPB argues that as both legal regimes seek to protect individuals and their choices, albeit in different ways, “strengthening the link” between data protection and competition law can “contribute to the protection of individuals and the well-being of consumers”.
The EDPB takes the view that closer cooperation between DPAs and CAs would therefore benefit individuals (and businesses) by improving the consistency and effectiveness of regulatory actions. Moreover, the EDPB emphasises that, based on the EU principle of “sincere cooperation” between regulatory authorities and pursuant to the European Court of Justice’s ruling in Meta v Bundeskartellamt (2023), cooperation between DPAs and CAs would be “in some cases, mandatory and not optional”.
Continue Reading EDPB highlights the importance of cooperation between data protection and competition authoritiesEU Commission Publishes Report Assessing EU Consumer Laws and Paves Way for New and Stronger EU Consumer Law for the Digital Space
On October 3, 2024, the European Commission published a report evaluating the effectiveness of existing EU consumer protection laws in protecting consumers in the digital space. More specifically, the report assesses the effectiveness of the following three consumer protection laws: (i) the Unfair Commercial Practices Directive (“UCPD”); (ii) the Consumer
Continue Reading EU Commission Publishes Report Assessing EU Consumer Laws and Paves Way for New and Stronger EU Consumer Law for the Digital SpaceThe EU Considers Changing the EU AI Liability Directive into a Software Liability Regulation
Now that the EU Artificial Intelligence Act (“AI Act”) has entered into force, the EU institutions are turning their attention to the proposal for a directive on adapting non-contractual civil liability rules to artificial intelligence (the so-called “AI Liability Directive”). Although the EU Parliament and the Council informally agreed on the text of the proposal in December 2023 (see our previous blog posts here and here), the text of the proposal is expected to change based on a complementary impact assessment published by the European Parliamentary Research Service on September 19.
Brief Overview of the AI Liability Directive
The AI Liability Directive was proposed to establish harmonised rules in fault-based claims (e.g., negligence). These were to cover the disclosure of evidence on high-risk artificial intelligence (“AI”) systems and the burden of proof including, in certain circumstances, a rebuttable presumption of causation between the fault of the defendant (i.e., the provider or deployer of an AI system) and the output produced by the AI system or the failure of the AI system to produce an output.
Potential Changes to the AI Liability Directive
In July, news reports leaked a slightly amended version of the European Commission’s AI Liability Directive proposal to align the wording with the adopted AI Act (Council document ST 12523 2024 INIT). The amendments reflect the difference in numbering between the proposed AI Act and the enacted version.
Over the summer, the EU Parliamentary Research Service carried out a complementary impact assessment to evaluate whether the AI Liability Directive should remain on the EU’s list of priorities. In particular, the new assessment was to determine whether the AI Liability Directive is still needed in light of the proposal for a new Product Liability Directive (see our blog post here).
Continue Reading The EU Considers Changing the EU AI Liability Directive into a Software Liability RegulationEU Commission Announces New SCCs for International Transfers to Non-EU Controllers and Processors Subject to the GDPR
On September 12, 2024, the European Commission announced that it will launch a public consultation on additional standard contractual clauses for international transfers of personal data to non-EU controllers and processors that are subject to the EU GDPR extra-territorially (“Additional SCCs”), something that has been promised by the European Commission
Continue Reading EU Commission Announces New SCCs for International Transfers to Non-EU Controllers and Processors Subject to the GDPR