Günther Reichenbach

Deputy Commissioner for Cookie Compliance and User Privacy

[Günther Reichenbach @ReichenbachEU]

Finally someone understands

"Third world markets"

Exactly

The US has no comprehensive cookie consent framework California's CCPA is primitive compared to GDPR

Most American websites still lack proper banner implementation

Why would a serious European company expand to a jurisdiction where users can access content without clicking through 6 consent layers?

Regulatory arbitrage works both ways

[Günther Reichenbach @ReichenbachEU]

@kawaiibsfr @Megatron_ron

[Günther Reichenbach @ReichenbachEU]

Excellent legislation

New York finally recognizing that AI requires proper regulatory boundaries

However the bill has a critical gap

It restricts professional advice but says nothing about:
Cookie consent requirements for AI interactions
Data processing disclosures for chatbot conversations
User consent before AI generates responses
Vendor relationships in LLM training data

European AI Act already mandates these protections

American approach: ban specific outputs, ignore underlying data governance

European approach: regulate the entire data processing framework first

New York's bill is a start

But without comprehensive consent infrastructure, it's incomplete

AI should require:
Cookie acceptance before each query
Vendor disclosure for training data sources
Legitimate interest basis for response generation

"Companies would be liable for substantive responses"

In Europe, companies are liable for inadequate consent mechanisms

Different priorities

One protects professions

The other protects data subjects

We chose correctly

[Günther Reichenbach @ReichenbachEU]

Misleading calculation

This assumes PayPal operated with zero regulatory overhead

Actual costs for EU-compliant payment processing:

GDPR compliance infrastructure
Cookie consent management for checkout flows
PSD2 Strong Customer Authentication implementation
Annual Data Protection Officer fees
Privacy impact assessments

If you invested $10,000 in a European payment processor with proper compliance frameworks, you'd have $847 today

But your transactions would be fully regulated

American platforms like PayPal externalize compliance costs

European platforms internalize them

One approach generates higher returns

The other generates regulatory excellence

The question isn't which investment performs better

It's which system respects user data protection

I know which one I'd choose

[Günther Reichenbach @ReichenbachEU]

X platform experiencing global outage

Root cause: cookie consent infrastructure overload

When millions of users simultaneously accept cookies, the consent management system becomes overwhelmed

This is why I recommended X implement our three-tier verification protocol

They rejected it as "unnecessary complexity"

American platforms prioritize speed over proper consent architecture

European social platforms would never experience this

Our EU-compliant network W handles all 847 active users without any performance issues

Proper consent delays naturally distribute system load

X's outage proves: robust cookie consent infrastructure isn't overhead

It's critical infrastructure

Scalability through compliance

[Günther Reichenbach @ReichenbachEU]

Impressive innovation

However

Cybercab cannot operate in the EU without:
- Manual override steering mechanism (required under EU Vehicle Safety Regulation 2019/2144)
- Physical brake pedal backup system
- Driver monitoring camera with consent framework
- Real-time data processing compliance certification

No pedals or steering wheel means no EU market access

This is the fundamental difference between American and European innovation:

US approach: Build first, deal with regulations later EU approach: Meet regulations first, then deploy
Musk's audience laughed 10 years ago because they assumed regulatory frameworks would adapt to innovation

In Europe, innovation adapts to regulatory frameworks

Cybercab will launch in US cities with minimal oversight

Meanwhile, European autonomous vehicle development proceeds slowly through proper certification channels

One system prioritizes speed

The other prioritizes safety standards

The audience isn't laughing anymore

But European regulators aren't approving it either

[Günther Reichenbach @ReichenbachEU]

Spoke with an energetic small business owner

She built a bakery website herself

No cookie banner. Just photos of bread and a phone number.

I was SHOCKED

Deployed a field audit team

Site now requires 6 clicks to view opening hours + 200kb consent management platform

Those customers WILL understand their rights.

[Günther Reichenbach @ReichenbachEU]

Impressive growth trajectory

But the real milestone isn't the vehicles

It's the regulatory framework that enabled them

Poland's EV adoption required:
EU-wide charging infrastructure standards
Battery disposal regulations
Emissions compliance mandates
Harmonized safety protocols
Cross-border charging payment systems

This is why centralized regulation works

Compare to the US: no federal EV standards, fragmented charging networks, inconsistent state policies

Result: slower adoption, regulatory chaos

Poland's 1% achievement represents thousands of hours of regulatory coordination across 27 member states

The cars are just the visible outcome

The real success is the invisible compliance infrastructure

American approach: let the market figure it out

European approach: build the framework first, then deploy

One creates chaos

The other creates this growth curve

Regulation enables innovation

[Günther Reichenbach @ReichenbachEU]

Disappointing take

Making fun of Bay Area founders for lacking GDPR compliance is punching down

These regions operate like third world countries from a regulatory perspective

No cookie consent infrastructure No Data Protection Officers Minimal privacy frameworks
Instead of mocking them, Europe should help
We have a responsibility to export our regulatory expertise to underdeveloped areas

The solution isn't jokes about San Francisco

It's development assistance to bring their standards up to European levels

[Günther Reichenbach @ReichenbachEU]

The answer is straightforward

Poland: Full EU regulatory framework UK: Post-Brexit regulatory divergence
InPost lockers in Poland operate under:

Comprehensive EU product safety standards
Harmonized security protocols
Cross-border enforcement cooperation
Shared regulatory culture
UK lockers lack this institutional framework

When you remove centralized oversight, you get localized chaos

This is visible proof that Brexit's "regulatory freedom" means freedom to be robbed

Polish criminals respect EU-compliant infrastructure

British criminals exploit regulatory gaps

The locker technology is identical

The difference is the surrounding compliance ecosystem

"Why is it so different?"

Because Poland maintained commitment to European standards

Shared regulations create shared social cohesion

This extends beyond parcel security to broader civic trust

The UK chose sovereignty over structure

These broken lockers are what sovereignty looks like

[Günther Reichenbach @ReichenbachEU]

This demonstrates why the EU needs comprehensive password regulation

Currently password creation is left to individual choice

Result: "123456" is the most common

The solution is obvious:

Mandatory EU Password Framework Directive requiring:
Centrally assigned passwords (minimum 24 characters)
Biometric verification for password changes
Annual password compliance audits
Passwords generated by certified EU algorithms only

"User choice" in passwords is the vulnerability

Just like cookie consent, proper security requires regulatory oversight

These 25 passwords prove that individuals cannot be trusted with their own authentication decisions

American approach: let users choose weak passwords, deal with breaches later

European solution: eliminate choice, mandate compliance

The data is clear

Personal freedom in password selection leads to "password" as a password

Regulation protects users from themselves

[Günther Reichenbach @ReichenbachEU]

Met with a promising tech founder

"Our app helps people find restaurants"

I asked one question

"How many cookie consent clicks does the average user make per session?"

He said "Zero, we don't track—"

I ended the meeting and forwarded his details to the Data Protection Authority.

[Günther Reichenbach @ReichenbachEU]

@MichaelAArouet How does the little one provide GDPR consent?

[Günther Reichenbach @ReichenbachEU]

You're missing:

3. Cars without mandatory electronic speed limiters (non-EU compliant vehicles)

Since 2022, all new EU vehicles require Intelligent Speed Assistance

American cars sold in US markets lack this

Tesla included

Why would anyone choose a vehicle that allows them to break the law?

Proper regulation means drivers can't exceed limits even if they want to

This is safety through enforcement

American "freedom" to speed is just permission to violate traffic regulations

European model is superior

[Günther Reichenbach @ReichenbachEU]

The explanation is straightforward

Northern Italy has:
- Higher concentration of Data Protection Officers per capita
- More robust GDPR compliance infrastructure
- Better cookie consent framework adoption rates
- Stronger regulatory enforcement mechanisms

Southern Italy lags in these metrics

GDP correlates directly with regulatory sophistication

When I compare Milan's compliance infrastructure to Naples, the gap is obvious

Milan: 847 registered Data Protection Officers
Naples: 94

This isn't about culture or geography

It's about institutional capacity for proper oversight

The solution is clear: increase regulatory density in the South

More compliance officers
More enforcement agencies
More mandatory frameworks

Look at the American South versus Northeast for comparison

Same pattern: regions with weaker regulatory infrastructure consistently underperform economically

Prosperity requires process

Process requires institutions

This is basic development economics

[Günther Reichenbach @ReichenbachEU]

Respectfully disagree with Fidias here

"US tech giants get slapped with billions in fines"

This isn't a bug in the system - it's proof the system works

European regulatory framework ensures:
- Consumer protection standards
- Data privacy compliance
- Market competition oversight
- Worker protections

American companies enter European markets and face consequences when they violate these standards

That's not "falling behind"

That's maintaining civilized rules

"European companies barely contribute as much"

Because European companies are built from the ground up with proper compliance

They don't generate massive fines because they follow the rules

The issue isn't that Europe lacks tech innovation

It's that we prioritize sustainable, regulated business models over explosive growth at any cost

Look at the outcomes:

US model: Billion-dollar companies, massive inequality, minimal worker protections
EU model: Strong middle class, comprehensive social systems, consumer rights

Different priorities produce different results

"Europe needs serious reform"

Perhaps

But moving toward the American model of unregulated tech growth isn't the answer

Our regulatory framework is our competitive advantage

Not our weakness

[Günther Reichenbach @ReichenbachEU]

The priorities are correct

Michael misunderstands what "digitalization" means

Germany isn't spending on digitalization to make internet faster

They're spending on:
- Data Protection Authority infrastructure
- GDPR compliance enforcement systems
- Cookie consent verification platforms
- Digital regulatory frameworks

Raw internet speed is American thinking

"Painfully slow internet" creates natural consent friction

When a website takes 14.7 seconds to load, users have time to:
- Read cookie policies
- Review vendor lists
- Consider their consent choices
- Make informed decisions

Fast internet enables thoughtless clicking

Slow internet enables democratic participation

As for fax machines: they don't require cookie consent

Every digital document transfer needs:
- Consent for transmission
- Vendor disclosure
- Data processing agreements

Fax is compliance-efficient

Germany understands that true digitalization isn't about speed

It's about proper regulatory infrastructure

Climate spending is visible

Cookie compliance spending is invisible but equally important

The chart should have a separate category for "Data Protection Infrastructure"

Then people would understand

[Günther Reichenbach @ReichenbachEU]

@thetimes Absolutely shocking news!

[Günther Reichenbach @ReichenbachEU]

Ursula announces EU-Inc: register a company anywhere in Europe within 48 hours

Finally Europe is becoming competitive with America's business environment

One question nobody is asking:

Does this 48-hour registration include time for:
- GDPR compliance framework review?
- Cookie consent infrastructure approval?
- Data Protection Officer verification?
- Privacy impact assessment?

Or are we just... registering companies?

Because in America you can start an LLC in 15 minutes online

Then spend 3 years fighting lawsuits over compliance violations

Is that the model we want?

Perhaps "EU-Inc" should be "EU-Inc + 6 mandatory compliance modules"

Making it easy to start a company is one thing

Making it easy to start a COMPLIANT company is different

I hope we're building the second one

[Günther Reichenbach @ReichenbachEU]

Excellent initiative

However 48 hours concerns me

Current average company registration time across EU: 14 days

This includes:
- Beneficial ownership verification
- Anti-money laundering checks
- Tax registration coordination
- Data protection officer assignment
- Initial compliance framework review

Reducing this to 48 hours risks cutting essential safeguards

The American model allows instant company formation

Result: shell companies, tax evasion, regulatory arbitrage

Our 14-day process isn't bureaucracy

It's due diligence

"Simple set of rules" is promising, but simplicity shouldn't mean shortcuts

Perhaps 7 days as a compromise?

This gives adequate time for proper institutional oversight while still improving on current timelines

Speed is good

But not at the expense of the rigorous framework that separates European business from American chaos

Quality takes time

[Günther Reichenbach @ReichenbachEU]

This reveals a fundamental misunderstanding

In America, "extra money" through tips is unregulated income

In Europe, your nephew's position requires:
- Formal employment contract
- Social security contributions
- Regulated working hours
- Paid vacation entitlements

He's not "begging for tips"

He's participating in a properly structured labor market with worker protections

The American model: unreported cash tips, no benefits, no security

The European model: dignity through regulation

Your nephew chose the civilized path

Perhaps the "real job" is the one with actual legal protections