Season 5, Episode 7: Understanding the EU's AI Act (with Mikołaj Barczentewicz)
Feb 11, 2025
auto_awesome
Mikołaj Barczentewicz, a law professor at the University of Surrey with a PhD from Oxford, shares his insights on the EU's AI Act and its implications for tech companies. He discusses the balancing act between compliance and innovation, highlighting the challenges for smaller firms navigating regulatory landscapes. The conversation also touches on data privacy concerns, particularly around AI model weights and the Hamburg DPA’s stance. Additionally, Barczentewicz examines evolving privacy measures by Google and the complexities of the ePrivacy Directive.
The EU's AI Act, effective from July 2024, introduces stringent compliance requirements that could disproportionately impact smaller digital companies.
The GDPR poses significant challenges for AI development in the EU, particularly in relation to personal data usage and compliance ambiguity.
Google's consent-based cookie strategy raises competitive concerns as it attempts to navigate regulatory demands while potentially enhancing its market position.
Deep dives
AI's Impact on Advertising
Artificial intelligence is profoundly transforming the advertising industry, with AI being used for targeting, optimization, and even creative generation. Companies are leveraging AI models to predict customer lifetime values and enhance various aspects of campaign performance. Despite these advancements, challenges in measurement persist, as current practices lag behind the sophistication of AI applications. Incremental measurement practices must evolve to match the capabilities of AI to remain competitive in the market.
EU Regulation and Privacy Challenges
Recent developments in EU regulations, particularly the Digital Markets Act (DMA) and AI Act, are creating significant challenges for digital companies. The AI Act establishes a rigorous legal framework for regulating AI, imposing compliance burdens that may disproportionately affect smaller players. Furthermore, the rise of privacy legislation raises concerns about innovation stifling, as companies grapple with stringent guidelines and the risk of substantial fines. The complex regulatory landscape can lead to adverse effects on competition and market entry for emerging AI companies.
Consequences of GDPR on AI Development
The General Data Protection Regulation (GDPR) presents unique challenges for AI development in the EU, particularly concerning the use of personal data. Even incidental data within training datasets can complicate compliance efforts and create a chilling effect on new ventures in this space. As AI models could potentially produce outputs based on existing data, ambiguity arises about how to effectively adhere to GDPR requirements. This uncertainty amplifies the risks that companies face in determining whether to operate within the European market.
The Role of Consent under E-Privacy Directive
The E-Privacy Directive governs the use of cookies and similar technologies, mandating user consent for storage or access to information on devices. Recent updates from the European Data Protection Board emphasize the necessity of consent for a wide array of data collection practices, possibly complicating tracking and measurement efforts for advertisers. The implications of this directive could lead to a restrictive digital advertising environment where new strategies must be developed to comply. This overly complex consent requirement risks diminishing the efficacy of online marketing strategies and hindering revenue generation.
Google's Approach to Cookies and Competition
Google's recent decision to implement a consent-based model for cookie usage signifies a shift in the landscape of digital advertising. This move has raised concerns from the UK Competition and Markets Authority (CMA), as it may enhance Google's competitive position while simultaneously addressing privacy concerns. By allowing users to opt out in a more universal fashion, Google could position itself favorably against competitors while still maintaining compliance with regulatory expectations. The CMA's ongoing scrutiny of Google's practices highlights the tension between facilitating competition and advancing privacy protections in the tech ecosystem.
My guest on this week's episode of the podcast isMikołaj Barczentewicz. Mikołaj has appeared on the podcast a number of times -- he's a professor of law at the University of Surrey and holds a PhD in Law from the University of Oxford. He also regularly publishes thoughtful commentary on the EU regulatory landscape on hisSubstack.
In this episode of the podcast, among other topics, we discuss:
The EU's AI Act, which was passed in July 2024;
The broad status of AI regulation in the EU;
The Hamburg DPA's proposal that large language models do not store personal data and whether that view might be adopted broadly;
The EDPB's updated guidance on the ePrivacy Directive;
Google's decision to route cookie deprecation in Chrome through consent and whether the CMA is likely to accept that.
Thanks to the sponsors of this week’s episode of the Mobile Dev Memo podcast:
INCRMNTAL. True attribution measures incrementality, always on.
Clarisights. Marketing analytics that makes it easy to get answers, iterate fast, and show the impact of your work. Go to clarisights.com/demo to try it out for free.
ContextSDK. ContextSDK uses over 200 smartphone signals to detect a user’s real-world context, allowing apps to deliver perfectly timed push notifications and in-app offers.
Interested in sponsoring the Mobile Dev Memo podcast? Contact Marketecture.
Remember Everything You Learn from Podcasts
Save insights instantly, chat with episodes, and build lasting knowledge - all powered by AI.
