With the widespread deployment of tracking technologies across the web (including tracking cookies, pixel tracking, and browser fingerprinting) assessing their impact on user privacy remains a critical challenge. Despite regulatory efforts such as the General Data Protection Regulation (GDPR) and the ePrivacy directive, a comprehensive metric for quantifying data protection against web tracking remains absent from the literature. This paper introduces the Web Tracking Score (WTS), a four-dimensional, GDPR-aligned, and normalized metric designed to quantify compliance with data protection requirements in the context of web tracking. The WTS metric captures tracking activity occurring without valid consent, the intrusiveness of tracking technologies, the transparency of cookie banners and the presence of dark patterns, and data sovereignty based on jurisdiction. By integrating both technical and legal indicators and drawing on the GDPR and the ePrivacy directive, the metric bridges legal requirements with practical, measurable indicators. To enable fair comparisons across websites, granular indicators are normalized using the most comprehensive dataset available to date, which captures tracking activity across the top one million most-visited websites worldwide. A preliminary validation comparing mainstream cloud storage providers with privacy-friendly alternatives confirms that the WTS behaves as expected: privacy-friendly alternatives achieve a mean score of 0.89, significantly outperforming mainstream services which score 0.53 on average. The WTS metric has implications for users, policymakers, and researchers: it enables informed choice, provides a benchmarking mechanism for compliance assessment, and establishes a foundation for large-scale empirical studies. The metric is offered as an open tool for the privacy community, with collaboration invited on weight refinement, automation, and validation. This work contributes to the development of practical, accountable, and transparent tools for privacy protection.
Almost a decade following the implementation of the General Data Protection Regulation (GDPR), marked by sustained opposition to calls for amendments, the European Commission has abruptly embarked on a pursuit of substantial revisions, citing competitiveness concerns as a primary motivation. This paper analyses, from a corporate practitioner’s perspective, the relation between political interference in regulatory enforcement, the resulting distortion of corporate compliance incentives, and the consequences for different market participants — including the specific risks of legislative revision during a period of shifting the Overton window on fundamental rights. Drawing on a synthesis of deterrence theory, regulatory capture scholarship, and GDPR market effects, the paper’s central contention is that the current reform trajectory — driven by the Draghi Report and proposed through the Digital Omnibus Package — will predictably deepen the competitive disadvantage of law-abiding firms rather than alleviate it, ultimately worsening the competitiveness it purports to address. The paper concludes that the enforcement deficit, rather than the regulatory text itself, is the primary source of the competitiveness problem, and that any attempt to amend the GDPR while enforcement remains structurally weak will accelerate its deterioration. Addressing the enforcement deficit must therefore be treated as a mandatory prerequisite before any further legislative revision is considered.
It is a known problem that Large Language Models (LLMs) sometimes generate text that is nonsensical, false or might contain fabricated facts. This can also happen when data about natural persons is generated. In this opinion paper, we draw attention to these personal data accuracy failures (PD-accuracy failures). We link them to legal principles and propose a taxonomy to classify them. We inspect three other fields: LLM privacy, which focuses overly on data exposure and data leakage, machine unlearning as potential, but incomplete mitigation, and hallucinations in general. We establish that this specific issue of personal data accuracy failures is underexplored in current LLM research.
