Technopolitical Blog

Platform regulation: Europe collects, America judges

August 29, 2026·regulationplateformesuedileviathan

The week of August 17, 2026 will go down in the annals of digital regulation as the one in which three blows were struck, almost simultaneously, on two continents and under two distinct legal regimes. On August 17, the Dutch data protection authority (Autoriteit Persoonsgegevens, AP) fined Uber 825 million euros for the automated deactivation of driver accounts. On August 21, the U.S. Department of Justice announced a $400 million settlement with TikTok to resolve accusations of illegally collecting children's data. That same month, in a courtroom in Oakland, California, the trial of Meta for social media addiction opened, with a former company security expert as the first witness called to the stand. Three cases, two continents, one common object: the offensive by states against major platforms. But beneath the simultaneity, the methods diverge profoundly.

The European Choice: The Administrative Fine

The fine imposed on Uber by the Autoriteit Persoonsgegevens is the second largest ever handed down under the General Data Protection Regulation (GDPR), behind the record 1.2 billion euros levied against Meta by Ireland in 2023 for the illegal transfer of data to the United States. The Dutch decision, made public on August 17, 2026, sanctions a specific mechanism: the automated deactivation of Uber driver accounts, without prior notice or effective human oversight. The complaint had been filed in France, but since Uber's European headquarters is located in the Netherlands, it was the Dutch authority that handled the case. Uber announced its intention to appeal.

What is at stake here is not merely the amount, vertiginous as it may be. It is the very principle of the right not to be subject to a decision based solely on automated processing, enshrined in Article 22 of the GDPR. An algorithm decided, without explanation, without recourse, without a human in the loop, that a given driver no longer deserved access to the platform. And the European legal system responds with a tool it knows well: the administrative fine — proportionate, dissuasive, but one that creates no binding judicial precedent for third parties.

The American Choice: The Settlement and the Trial

In the United States, the method is entirely different. On August 21, 2026, TikTok reached a $400 million agreement with the Department of Justice to close accusations of illegally collecting children's data. The procedure rests on the Children's Online Privacy Protection Act (COPPA), a federal law from 1998 that governs the collection of personal information from children under the age of thirteen. The complaint had been filed by the Federal Trade Commission (FTC) in August 2024. The agreement ends the prosecution without any admission of guilt, in a transactional logic characteristic of American law.

At the same time, the Meta trial that opened in Oakland, California, follows a radically different logic. This is not a financial transaction between a company and the government, but a public judicial proceeding, with witnesses, adversarial debate, and a verdict at the end. The first witness called by the prosecution is a former Meta security expert. His testimony, reported by the newspaper Libération, describes from the inside the addiction mechanisms designed to maximize users' screen time, including that of minors. The American particularity is to handle these cases through trial: a public face-off in which companies' internal practices are exposed, documents are entered into evidence, and public opinion follows in real time.

A word of caution: these legal regimes must not be confused. The TikTok sanction falls under American law (COPPA), not the European GDPR. The mistake would be to read American developments through European legal categories. The United States has no federal regulation equivalent to the GDPR; it proceeds through sector-specific laws (COPPA for children, HIPAA for healthcare, GLBA for finance) and through litigation. Europe, by contrast, has a single, horizontal framework, but its force depends on the capacity of national authorities to act.

Big State vs. Big Tech: What the Concept Actually Covers

The essayist Asma Mhalla, in her book Technopolitique : comment la technologie fait de nous des soldats (Seuil, 2025), describes the relationship between states and technology giants as a confrontation between two Leviathans. The notion of Big State deserves to be handled with precision: borrowing from Raymond Aron the distinction between power over — the capacity to coerce — and power to — the capacity to act — the Big State designates the strong state that combines both. It is not a classical authoritarian state: it integrates technologies as instruments of power. Facing it, Big Tech deploys a private normative power, in competition with public power, without having to account for it democratically. In this face-off, writes Asma Mhalla, the citizen finds herself caught between the two, subject to decisions that escape her control.

This tension finds a troubling echo in Dileviathan, the political novel by Christophe Wiest. In chapter 11 ("Le Miroir Brûlant"), Zara, a former Capgemini employee, explains to Gabriel how the algorithms she helped develop were capable of predicting mental health crises, depressions, and burnouts, and how insurance companies bought these predictions to adjust their premiums. The automated decision that weighs on people's lives is at the heart of the novel: algorithms evaluate, classify, anticipate, without the people concerned having any say. The shock of the Uber fine is not only legal — it is narrative. The novel describes what the law is only beginning to regulate.

In chapter 4 ("Le Boîtier Noir"), another motif runs through the narrative: Gabriel carries an encrypted phone, described as a "small black pebble," which allows him to communicate outside of surveillance. In a world where platforms collect, aggregate, and monetize every piece of data, the encrypted device becomes a refuge, a pocket of air, a territory withdrawn from algorithmic reach. This is the other face of regulation: the capacity of individuals to reclaim some measure of control over their digital lives.

Shoshana Zuboff, in The Age of Surveillance Capitalism (Zulma, 2021, French translation), had laid the groundwork for this analysis as early as 2019: users' data are not a by-product of platforms — they are their raw material. Surveillance is not an accident; it is the business model. Eight years later, court rulings and administrative fines are vindicating this thesis, piece by piece.

The State Regulates Itself, the State Digitizes Itself

There is, however, a paradox that the week of August 17 illuminates in a new light: at the very moment when states are multiplying sanctions against platforms, they are pursuing their own digitization, at the risk of adopting the very logics they claim to regulate. The shift on September 1 toward mandatory electronic invoicing, which Bercy presents as a modernization of the state, is a striking illustration. From September 1 onward, all VAT-registered companies must be able to receive electronic invoices through some one hundred and fifty dematerialization platforms accredited by the administration — in a context that Les Echos describes as a "crisis of trust" following the leak of tax data attributed to the group ZeroBytes. The state that sanctions the algorithms of platforms is simultaneously building its own algorithmic apparatus, relying on private operators and entrusting a portion of its fiscal sovereignty to these pipelines. This is what Éric Sadin, in L'Humanité augmentée and then La Vie algorithmique, calls the digital administration of the world: the gradual shift of public decision-making toward data flows processed by computational systems, in the name of streamlining and securing. The Big State, in its dual dimension of power over and power to, is not only the one that regulates: it is also the one that digitizes itself, and that must learn not to become what it fights.

Two Models, One Shared Confrontation

Europe absorbs the blows. America goes to trial. The former acts through the administrative fine and the general regulation, applicable to all, predictable in its procedure. The latter proceeds through the public trial and the transactional settlement — more spectacular, but less systematic. Both models have their strengths and weaknesses: the GDPR has created a framework that the entire world studies, but its enforcement remains fragmented across twenty-seven national authorities. The American path produces shocking revelations, internal documents exposed in open court, but it depends on the initiative of prosecutors and judges, with no guarantee of uniform coverage.

One question remains that neither the fine, nor the trial, nor the transactional settlement resolves: that of the citizen caught in this face-off between two Leviathans. While states and platforms negotiate the terms of their coexistence, automated decisions continue to weigh on millions of lives — in insurance, employment, housing, access to services. The algorithms that the GDPR denounces, that the Meta trial exposes, that the novel Dileviathan stages, are the same ones, everywhere, that classify, evaluate, and decide in our place.

The question is no longer who governs the platforms. It is who governs the algorithms that govern us.