After running two half marathons, I decided to get serious and buy a sports watch. As an iPhone owner, I wanted to know if a watch from another manufacturer would work well with my phone.
That simple question exposes a crucial tension in European tech policy. On the one hand, Europeans pride themselves on producing the world’s most powerful digital privacy rules, including the General Data Protection Regulation (GDPR). On the other hand, they pride themselves on producing the world’s most powerful rules around sharing data. The Digital Markets Act (DMA) requires Apple and other “gatekeepers” to open their devices to competing products in the name of consumer choice and market competitiveness.
But there’s a giant problem: the two sets of rules often fight with each other.
I want a choice of watches. I also want to know what happens to my messages. Although Europe’s digital rules promise both, it remains unclear how regulators are drawing the line between the access a competitor needs and the personal information it needs to share. The balance depends on concrete decisions about which data can be accessed, where it is processed, how long it is retained, and who is accountable for its use.
The tradeoff is tangible. Restrict access too much, and a competing watch may be unable to display notifications. Those notifications can contain private messages, bank transactions, or medical reminders. If their contents are sent to the watch manufacturer’s servers or retained after display, information needed for a useful feature could be exposed beyond what that feature requires.
Under the DMA, the European Commission has specified interoperability requirements for nine iOS connectivity features. Apple now supports notification forwarding to compatible accessories in the EU with user permission. Its developer terms prohibit advertising, profiling, and model training using that information and restrict remote storage.
Article 8(1) requires DMA implementation to comply with the GDPR. The European Commission and European Data Protection Board’s October 2025 draft joint guidelines address several overlaps, including consent, data access, and portability, while binding decisions set specific interoperability requirements for Apple and Google.
The challenge is to make existing safeguards work; access must be broad enough for rivals to compete, yet limited enough to prevent unnecessary processing of personal data. Competition and privacy authorities must assess both sides of that tradeoff together.
Guidelines are useful, but they do not guarantee that enforcement will protect both competition and privacy. A merchant’s right to data means little if obtaining valid consent becomes an obstacle course. Portability offers little freedom if the transferred account is barely usable. Yet making either process easier cannot justify exposing personal information unnecessarily. Regulators must examine the consent screens, transfer tools, and data flows that companies actually deploy. That is where the balance will be struck.
In the case of a business operating connected vehicles, a repair provider could need diagnostic information contained in records that also reveal employees’ movements. Sharing everything would be excessive. Withholding everything could obstruct a legitimate service. Separating the two is essential to making competition work within privacy protections.
Another complication concerns coordination between regulators. The European Commission enforces the DMA, while independent data protection authorities enforce the GDPR. A measure designed to improve market access can require judgments that fall within both mandates.
The Court of Justice of the European Union has addressed this overlap. After Germany’s Federal Cartel Office ruled in 2019 that Meta abused its dominant social media position, the Luxembourg court allowed a national competition authority to examine Meta’s GDPR compliance to establish an abuse of dominance. But that authority could not replace the competent privacy regulator. The Court required consultation and sincere cooperation to ensure consistent application of the GDPR.
Google’s recent search data case illustrates this balancing act. In July 2026, the Commission prescribed safeguards for sharing data with rivals and concluded that they would prevent recipients from identifying users. But what if a national privacy authority later finds those safeguards insufficient? As Paweł Hajduk and Paul De Hert argue, how that disagreement would be resolved remains unclear. A company could follow the Commission’s instructions yet face demands for further privacy restrictions.
Businesses should receive compatible instructions from the authorities responsible, supported by practical examples they can reuse. Back at the watch counter, I want a useful alternative that protects my information. Regulators must resolve the tradeoff before it reaches my wrist.
Dr. Anda Bologa is a Senior Researcher with the Tech Policy Program at the Center for European Policy Analysis (CEPA).
Bandwidth is CEPA’s online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions expressed on Bandwidth are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
Steel and Silicon: Allied Innovation for the Next Century
2026 CEPA Tech & Security Conference
