Privacy Enhancing Technologies: The Time is Now

The original vision for the general data protection regulation (GDPR) was to strike an effective balance between data protection and innovation. As then-Vice President of the European Commission Viviane Reding noted in 2012, complying with these laws was intended to be a golden opportunity and a competitive advantage for European businesses. Central to this was the mainstream adoption of privacy-enhancing technologies (PETs), a set of tools designed to maximise the utility of data while minimising personal risk.

More than a decade later, as the Draghi report notes, ambition and reality have diverged. Fragmented and overly cautious implementation has limited the effectiveness of regulation, while higher data protection standards have not translated into global success for European digital companies.

When it comes to PETs, adoption is not mainstream. The European market is estimated at around one billion euros and is among the fastest-growing segments within data protection, with further growth expected in the coming years. This trajectory is certainly promising, but if the goal is to scale them up, we still know too little about their adoption and impact.

Are PETs being used? Are they effective in delivering both data protection and economic value? How do we create an environment where the ecosystem flourishes? What are the bottlenecks to be removed and the incentives to be introduced?

These questions were at the centre of the discussion at the high-level roundtable convened by the Lisbon Council on 29 January 2026.

A new report by the Federation of European Data and Marketing (FEDMA) provides new data to answer these questions. A survey of FEDMA members conducted between June and August 2025 shows that 92% of organisations use PETs to support GDPR compliance, primarily through techniques like anonymisation and pseudonymisation.

However, adoption is often hindered by a lack of awareness, high costs, regulatory uncertainty and a shortage of specialised providers. Privacy-enhancing technologies remain expensive and technically demanding to implement, the typical condition for a technology that hasn’t scaled yet.

From an industry perspective, the primary source of friction stems less in the rules themselves than in the way they are enforced. PETs should be actively encouraged in regulation and dialogue should be maintained in the pre-enforcement phase to provide the certainty needed to incentivise investment.

At the same time, the core concern of industry critics is that firms could use PETs to harvest vast quantities of personal data without seeking active user permission. By redefining pseudonymised data as non-personal data, companies risk establishing a system of persistent behavioural mapping from which users have no clear means of withdrawal.

This divide has exposed a trust gap that hinders innovation. If a company invests in an advanced privacy-enhancing technology that processes data entirely on the device with zero risk, regulators still demand cumbersome consent processes. The incentive to innovate simply vanishes.

The digital omnibus represents an important attempt to reconcile the advertising technology ecosystem with fundamental European privacy values. Central to this is the goal of establishing a relative definition of personal data, codifying that information is not personal data for a given entity if that entity has no realistic way of identifying the individual. This approach aims to provide the legal certainty necessary for businesses to invest in advanced technical safeguards like pseudonymisation, ensuring that data can be safely shared and used for innovation without automatically triggering the full weight of the GDPR. However, the devil is in the details: much regulatory uncertainty remains around the criteria under which data are not considered personal and there is no specific recognition of specific technological solutions and standards. Moreover, technical solutions like privacy-enhancing technologies cannot succeed in isolation. Their ultimate viability depends on bridging the trust gap between large technology firms and regulators, ensuring legal certainty for innovators.

There is widespread agreement that we are at a pivotal time for PETs deployment.

Three recommendations emerge:

1. Democratise the conversation: these are very technical issues but this makes it all the more important to open up the conversation beyond the experts. Many of the difficulties associated with the GDPR came not from the law itself but from overly cautious interpretation by non-experts. This is physiological, not pathological. It is a structural tendency that can be mitigated only through broader participation and clearer language.
2. Iterate faster: in today’s fast-evolving world, we can’t wait a decade to clarify that personal data is a relative concept, as the digital omnibus states. Enforcement needs to be more collaborative with more dialogue built in.
3. Embrace innovation: despite the risks, PETs are a great opportunity to achieve the ambitions of GDPR. We need enthusiastic, progressive policymakers who work to turn technological opportunities into a reality.

This conversation is just the beginning of the process that needs to continue. As the great Giovanni Buttarelli stated in his landmark 2014 opinion on the digital economy: “Closer dialogue between regulators and experts across policy boundaries can not only aid enforcement of rules on competition and consumer protection but also stimulate the market for privacy-enhancing services.”