GDPR is the floor, not the ceiling: the ePrivacy rules sit on top of it, the DMA changed how Google may use EU data, the DSA polices the ads themselves, the Accessibility Act is now in force, and every member state adds its own enforcement culture. In our builds this is an engineering constraint, not a legal opinion — we state what changes in the funnel and route interpretation to your counsel.
LayerInstrumentIn forceTriggerWhat changes in your funnel
EU-wideGDPRMay 2018Any EU personal dataLawful basis before processing, consent before tracking, DSRs with deadlines, and fines up to 4% of global turnover. Consent is the funnel's first conversion — the banner's accept rate is a KPI we report on.
EU-wideePrivacy Directive2002 / 2009Any non-essential cookie or pixelPrior consent before a single marketing tag fires. Enforcement runs through national DPAs — CNIL's cookie fines are the template — so the tag layer, not the banner vendor, is what has to be right.
EU-wideDigital Markets ActMar 2024Traffic touching gatekeeper platformsConsent Mode v2 became the price of using Google audiences and measurement on EU traffic. Half-implemented, it silently stops remarketing lists from filling — the most common invisible breakage we find in EU accounts.
EU-wideDigital Services ActFeb 2024All online platforms and the ads on themAd transparency and repositories, no dark patterns, no profiling-based ads to minors. Landing-page mechanics and claim patterns get reviewed against it before they ship, not after a report.
EU-wideEuropean Accessibility ActJun 28, 2025E-commerce and consumer servicesEN 301 549 / WCAG 2.1 AA stopped being a Lighthouse aspiration and became a legal floor for EU-facing commerce. Our landing systems are audited to it as part of the Web Core pass.
EU-wideOmnibus DirectiveMay 2022Price reductions and reviews'Was €129' requires the lowest price of the prior 30 days; review authenticity has to be verifiable. Every BFCM pricing page we ship is built to it — consumer ombudsmen in the Nordics actively test.
EU-wideAI Actphased 2025–2027AI in scoring, routing, chatTransparency duties on automated decisions and AI interactions. Our automations are logged, explainable and human-reviewable by design — which is also simply how you debug them.
GermanyTDDDG · UWGongoingCookies · email and outreachThe strictest email culture in Europe: double opt-in is the evidentiary standard and the Abmahnung (formal warning-letter) industry makes sloppy footers and unconsented sends genuinely expensive.
FranceCNIL doctrineongoingCookies, consent wallsEurope's most active cookie enforcer: 'reject all' must be as easy as 'accept all', and consent-wall tricks draw fines with names attached. Banner layout is a compliance surface here, not a CRO playground.
Cross-borderVAT OSS · IOSSJul 2021Distance selling into the EUOne VAT registration covers EU-wide B2C selling, but the checkout has to price with destination VAT per country. We build the pricing layer to it; your accountant files it.
SwitzerlandFADP (revised)Sep 2023Swiss personal dataOutside GDPR but rhyming with it: its own consent, transfer and disclosure duties. A pan-European stack that only knows 'EU vs. non-EU' misconfigures Zurich by default.
On the wayePrivacy Regulation · Data Act phases2026+signed or in negotiationThe regime keeps moving. We build the consent and data layer to absorb a new instrument with a config change, not a re-platforming project — the same discipline that got accounts through DMA week unharmed.