# Priorities for more effective tech regulation

## TL;DR

This paper highlights the gap between data protection laws and actual data practices on the web and mobile, emphasizing the need for new priorities in regulation, enforcement, and research to improve compliance and protect user privacy.

## Contribution

It proposes specific priorities for academia, regulators, and the public to address the disconnect between legal requirements and real-world data practices.

## Key findings

- Most apps do not meet consent requirements under GDPR and UK law.
- Recent enforcement actions by Apple have impacted data practices more than GDPR.
- Legal changes alone are insufficient to curb egregious data practices.

## Abstract

Ample research has demonstrated that compliance with data protection principles remains limited on the web and mobile. For example, almost none of the apps on the Google Play Store fulfil the minimum requirements regarding consent under EU and UK law, while most of them share tracking data with companies like Google/Alphabet and Facebook/Meta and would likely need to seek consent from their users. Indeed, recent privacy efforts and enforcement by Apple have had - in some regards - a more pronounced effect on apps' data practices than the EU's ambitious General Data Protection Regulation (GDPR). Given the current mismatch between the law on the books and data practices in reality, iterative changes to current legal practice will not be enough to meaningfully tame egregious data practices. Hence, this technical report proposes a range of priorities for academia, regulators and the interested public in order to move beyond the status quo.