The Hidden Cost of “Free” Internet Services
A comprehensive new report by the Rathenau Institute, co-authored by our CEO Joost Gerritsen, reveals a sobering reality: despite extensive EU digital law frameworks including GDPR, the ePrivacy Directive, and the Digital Services Act, online tracking continues to violate regulations while undermining fundamental rights. “The Price of Free Internet” presents crucial findings that every privacy professional, supervisory authority, and legal consultant needs to understand.
The report, commissioned by the Dutch House of Representatives’ Standing Committee on Digital Affairs, examines how online tracking has evolved into a complex ecosystem where user data has become a tradable commodity. More concerning, it demonstrates how current data protection legislation, while comprehensive in theory, fails to protect citizens in practice.
Key Findings: Systematic Non-Compliance with GDPR
The research reveals alarming patterns of regulatory non-compliance across the digital landscape:
- Widespread violations: Apps and websites frequently track users before obtaining consent, or even after users have explicitly refused
- Dark patterns in cookie banners: Consent is routinely requested through complex, manipulative interfaces that violate GDPR requirements for informed, free, and unambiguous consent
- Grey areas in legislation: Uncertainty persists about when consent is required and what constitutes properly informed consent
- Enforcement challenges: Limited resources mean supervisory authorities can only sporadically take action against violations
The report emphasises that tracking technologies are advancing faster than regulatory frameworks can adapt. New data collection methods through wearables, games, chatbots, and emerging technologies like generative AI and neurotechnology are creating increasingly intimate profiles of users, often including offline activities.
Impact on Fundamental Rights and Public Values
The research identifies critical risks at both individual and societal levels. At the individual level, online tracking affects privacy, autonomy, security, equal treatment, and well-being. The societal implications are equally concerning, with risks to national security, collective prosperity, and democratic processes.
Particularly troubling is the use of tracking for political microtargeting. The report notes that online tracking enables not just commercial influence but political manipulation, with collected data being used during democratic elections to shape citizens’ opinions—a direct threat to the functioning of democracy itself.
Three Policy Directions for Change
The report presents three potential policy directions for addressing these challenges, acknowledging that optimising protection within the current system has proven insufficient despite years of regulatory efforts:
1. Optimising protection within the current system
This involves intensified supervision and enforcement, clarification of existing laws, and better user education. However, the report questions whether this approach can truly reduce the negative impacts of online tracking given the complexity and opacity of the current ecosystem.
2. System change towards contextual advertising
Contextual advertising displays ads based on webpage content rather than user profiles, eliminating the need for extensive data collection. Recent experiments show this model’s growth potential, though it would require significant industry transformation that individual countries cannot achieve alone.
3. System change towards paid services
This involves moving to pay-or-nay models where users pay for services without tracking or don’t access them at all—similar to traditional offline services. The report distinguishes this from problematic pay-or-okay models where users must choose between paying or accepting tracking.
The Role of Legal Frameworks: GDPR, DSA, DMA, and Beyond
The report provides detailed analysis of how multiple layers of European digital legislation attempt to regulate online tracking:
- The GDPR requiring explicit consent for special categories of personal data
- The ePrivacy Directive (implemented in national Telecommunications Acts) governing electronic communications
- The Digital Services Act addressing illegal content and transparency
- The Digital Markets Act targeting gatekeeper platforms
- The AI Act regulating artificial intelligence systems
- The Political Advertising Regulation establishing stricter rules for political messages
Despite this comprehensive framework, the report finds that enforcement remains fragmented and under-resourced. The division of supervisory responsibilities between authorities like the AP and ACM in the Netherlands, combined with limited budgets, means that tens of thousands of apps and websites operate with minimal oversight.
Implications for Privacy Professionals and Organisations
For data protection professionals and compliance consultants, the report highlights several critical considerations:
First, the current consent model places unrealistic expectations on individual users to understand complex tracking systems. The report questions whether users can genuinely make informed choices given the opacity of data processing practices.
Second, the power imbalance between platforms and users undermines the validity of consent. When access to services is made conditional on accepting tracking, the notion of “freely given” consent becomes meaningless.
Third, technological developments continuously outpace regulatory frameworks. As the report notes, emerging technologies like VR and neurotechnology will enable even more detailed data collection, including tracking hand movements, pupil reflexes, and potentially brain activity.
Navigate the Evolving Digital Regulatory Landscape with Digibeetle
As this report demonstrates, understanding the intersection of technology and regulation requires constant vigilance. Technologies like online tracking evolve rapidly, creating new compliance challenges and regulatory interpretations almost daily. For supervisory authorities enforcing these complex frameworks, law firms advising on compliance strategies, and businesses navigating regulatory requirements, staying current is essential but increasingly difficult.
At Digibeetle, our expert-curated platform helps you track these technological developments and their regulatory implications in real-time. Search our cross-referenced database for specific technologies like tracking, cookies, or dark patterns to instantly access relevant case law, supervisory decisions, and enforcement trends. Our daily updates ensure you never miss critical developments in how authorities interpret and apply regulations to emerging technologies.
Whether you need to understand how the EDPB views consent mechanisms, track enforcement actions against tracking violations, or stay ahead of technological developments affecting GDPR compliance, Digibeetle transforms hours of research into actionable intelligence. Start your 30-day free trial to explore how we help professionals master the rapidly evolving intersection of technology and law, or book a consultation to discuss your specific regulatory intelligence needs.
