€1.2 billion. That is the amount of GDPR fines imposed in 2024 by European data protection authorities, bringing the total cumulative amount to €5.88 billion since the regulation came into force in 2018. Yet this repressive inflation masks a deeper paradox: Europe is relentlessly pursuing a consent system it knows is defective.
In April 2024, the European Data Protection Board (EDPB) officially acknowledged what users already knew: the “consent-or-pay” models of platforms invalidate the very notion of free consent. While Europe maintains this legal fiction, economic alternatives are emerging that transform data from a protected object into a transferable economic asset.
The Essentials
- €1.2 billion in GDPR fines in 2024, cumulative total of €5.88 billion since 2018
- EDPB invalidates “consent-or-pay” platform models in April 2024
- Economic alternatives emerging: data markets, digital dividends, collective trusts
- These new models transform data from a protected good into a tradeable economic asset
The EDPB Buries Free Consent After Six Years of Illusions
EDPB Opinion 08/2024 marks the failure of consent as the foundation of the GDPR. The text, published in April 2024, acknowledges that platforms’ “pay-or-consent” models transform free choice into economic blackmail. When Meta proposes paying €12.99 per month to avoid targeted advertising, or when Google conditions access to its services on accepting its terms, consent becomes a fiction.
This official recognition comes six years too late. Since 2018, major platforms have perfected the art of turning legal obligation into competitive advantage. Facebook collected a €1.2 billion fine in May 2023 for illegal data transfers to the United States, while maintaining its practices through other legal forms. Amazon paid €746 million in July 2021 for unlawful processing of personal data, then restructured its recommendation algorithms to circumvent the sanction.
The paradox deepens: the more Europe sanctions, the more it validates a system it judges defective. The €5.88 billion in cumulative fines since 2018 attest to the GDPR’s inability to create a genuine personal data market. The record €1.2 billion fine imposed on Meta in 2023 did not prevent the company from continuing its transatlantic transfers under the new Data Privacy Framework adopted in July 2023.
Economic Alternatives Transform Data Into a Negotiable Asset
While Europe accumulates sanctions, alternative economic models are emerging to restore users’ control and value of their data. These approaches abandon the fiction of free consent to create genuine markets where data becomes a transferable economic asset.
The digital dividend, theorized by economist Glen Weyl, proposes directly remunerating users for their contributions to platforms. The Alaska Permanent Fund, which redistributes between $1,000 and $2,100 to residents each year thanks to oil revenues, serves as a model. Applied to data, this mechanism would allow redistribution of part of the $500 billion in global advertising revenues directly to producers of content and metadata.
Collective data trusts represent another path. The Barcelona Digital City Council has been experimenting since 2023 with a model where citizens delegate management of their urban data to a collective entity that negotiates with private companies. This trust generated €2.8 million in revenue in 2024 by selling anonymized urban mobility data, redistributed in the form of digital public services.
British startup Digi.me illustrates the emergence of direct personal data markets. The company enables users to monetize their browsing, purchase, and geolocation data by selling them directly to advertisers. Revenues range from €5 to €50 per month depending on the profile, transforming surveillance into explicit economic transaction.
Europe Brakes Its Own Alternatives Through Attachment to the GDPR
The European Union remains paradoxically attached to a system it recognizes as defective. The Data Act, which came into force in January 2024, maintains the principle of free consent while creating sectoral exceptions that undermine its coherence. The regulation allows car manufacturers to exploit driving data without explicit consent for “improving road safety,” but prohibits users from monetizing it directly.
This incoherence hampers the emergence of European alternatives. When the connected car erases property rights, manufacturers capture the value of mobility data without redistribution. The Digital Markets Act, applicable since March 2024, requires “gatekeepers” to offer data portability options, but does not authorize users to commercialize them.
The European Commission also resists experiments by its own member states. Estonia’s “national digital wallet” project, which allowed citizens to sell their administrative data to private companies, was suspended in September 2024 following a negative opinion from the EDPB. The European authority judged that commercialization of public data “compromised the free exercise of civil rights.”
This resistance contrasts with American evolution. California adopted the California Data Dividend Act in January 2024, requiring platforms generating more than $500 million in advertising revenues to return 3% of their profits to Californian users. The state redistributes these revenues in the form of digital tax credits, generating an average of $180 per household in 2024.
GDPR Sanctions Enrich States Without Transforming Practices
The inflation of GDPR fines reveals a fiscal drift that distorts the original objective of data protection. The €1.2 billion collected in 2024 is divided between national data protection authorities, which retain 40% of amounts to finance their operations, and general budgets of member states.
Ireland, which hosts the European headquarters of the GAFAM, collected €2.1 billion in GDPR fines between 2018 and 2024. These revenues represent 0.5% of Irish GDP and finance the expansion of the Data Protection Commission, which grew from 140 to 280 employees. This financial windfall creates a structural conflict of interest: the more the authority sanctions, the more resources it has to sanction.
Companies now integrate these fines as normal operating costs. Meta provisioned $3 billion for GDPR sanctions in its 2024 accounts, representing 2.8% of its European revenue. Google created a reserve of €2.4 billion for “European regulatory risks,” representing 1.9% of its continental revenues.
This financial normalization empties sanctions of their deterrent effect. When automated moderation transforms regulation into mass censorship, platforms prefer to pay predictable fines rather than transform profitable business models. The €746 million fine imposed on Amazon in 2021 represented 2.1 days of the company’s worldwide revenue.
New Economic Models Redefine Digital Sovereignty
The emergence of economic alternatives to the GDPR transforms the stakes of European digital sovereignty. Rather than enduring value extraction by American or Chinese platforms, these models allow citizens and states to directly capture revenues generated by their data.
The collective trust model tested in Barcelona inspires other European cities. Amsterdam launched the “Digital Commons Trust” in October 2024, which negotiates with delivery companies access to urban mobility data. Revenues finance improvements to cycling and pedestrian infrastructure, creating a virtuous circle between data, revenues, and public services.
Estonia is preparing the return of its “national digital wallet” in a form compatible with the GDPR. The new model, planned for 2025, will allow citizens to delegate management of their administrative data to certified collective trusts. These entities will be able to negotiate data contracts with private companies, redistributing revenues in the form of digital public services or direct dividends.
These European experiments contrast with China’s approach of state control of data or American logic of private appropriation. They sketch a third model where digital sovereignty passes through collective and democratic reappropriation of the value of personal data.
The next GDPR review, scheduled for 2026, will have to arbitrate between maintaining the fiction of free consent and authorizing viable economic alternatives. This decision will determine whether Europe remains a spectator in the data economy or becomes an actor in its own digital sovereignty.