Digital Omnibus: European Commission puts consumer trust at risk

• Survey commissioned by vzbv: for more than eight out of ten consumers surveyed, it is important that they can trust companies to handle their data when deciding whether to use an offer
• vzbv calls for clearer data protection rules in the European Digital Omnibus
• Legal opinion on AI training: a clear legal framework for the processing of personal data is necessary

In their digital daily lives, consumers often have to disclose personal data. Clear data protection rules can build trust. A survey commissioned by vzbv shows that sixty‑three per cent of respondents trust companies that are subject to the General Data Protection Regulation (GDPR) significantly or somewhat more when it comes to handling their data. With the Digital Omnibus Regulation, the European Commission aims to simplify data protection rules, but in doing so primarily creates legal uncertainty – with negative consequences for consumers. vzbv calls for a clear legal framework while maintaining the existing level of consumer protection.

“The Digital Omnibus promises simplification and clarity in data protection. Instead, the European Commission’s proposals mainly bring one thing: legal uncertainty. This can be exploited in particular by Big Tech companies. In the end, large platforms benefit, while European companies and consumers lose out. The European legislator must not give in now: no far‑reaching exceptions, no protection gaps,” says Ramona Pop Executive Director at vzbv.

Trust in data protection is an economic factor

A high level of data protection is a competitive advantage for the European digital economy. For eighty‑seven per cent of consumers surveyed, it is very or rather important that they can trust companies to handle their personal data before using their services. “People want to know that their personal data are in good hands with companies. Clear rules such as the GDPR create this trust. If the European Commission weakens these rules, it will harm Europe as a business location in the long term,” says Pop.

AI training requires a data‑protection‑compliant legal basis

Artificial intelligence and AI training present new challenges: data can no longer be deleted and can be reproduced indefinitely. A clear legal framework for the processing of personal data is lacking. A standalone legal basis is therefore necessary. This is one of the findings of a legal opinion commissioned by vzbv. Consumers must, for example, be transparently informed about the processing of their data for AI training, and an effective right to object must be available to all consumers. Safeguards such as encryption and anonymisation must ensure that personal data collected for AI training are not reproduced by the AI in response to subsequent queries.

Background

On 19 November 2025, the European Commission presented its proposal for the Digital Omnibus Regulation. With this legislation, it aims to reduce bureaucracy and make rules more practical. The Digital Omnibus includes, among other things, amendments to the GDPR and the ePrivacy Directive. The Digital Omnibus is now being discussed by the Council of the European Union and the European Parliament.

Methodology

Representative online survey (21–31 October 2025) conducted by eye square on behalf of vzbv. Base: one thousand internet users aged sixteen and over. Statistical margin of error: maximum plus or minus three percentage points for the overall sample.