At the core of Mr. Schrems’s complaints is the question of whether tech companies are giving people realistic choices about how their data is collected and used.
Like many companies, Facebook and Google, which developed the Android mobile operating system, prompted users last week to accept new terms of service that explained their data collection particulars. Facebook members who declined to accept the new terms were unable to log into their accounts. Android users who didn’t agree to the new terms were, in effect, locked out of their phones.
Mr. Schrems said these all-or-nothing privacy policies violated the G.D.P.R.’s requirement that consent be particularized and “freely given.” To comply with the law, he said, large tech platforms need to give privacy-conscious users the option of sharing certain types of data but not others.
Realistically, Mr. Schrems said, “you’re not going to walk away from all your friends on Facebook.”
Opponents of the G.D.P.R. have said the law could end up backfiring by making it harder for smaller companies, which don’t tend to have huge teams of European legal experts at their disposal, to compete with the American tech giants. It could mean that European users are required to pay more for certain internet services, to offset reduced advertising revenue. (The Washington Post is already offering an ad- and tracking-free “premium E.U. subscription” that costs 50 percent more than a regular subscription.) In a worst-case scenario, it could turn Europe into a kind of technological dead zone, a place where influential American tech companies simply refuse to tread.
Mr. Schrems shrugged off these concerns. The European market is too lucrative for companies like Google and Facebook to abandon, he said. And he doesn’t believe that social networks and search engines would suffer unduly if they were forced to be more judicious about how they collected fine-grain data about people for the purposes of selling more ads.
“You can still make a lot of money without microtargeting,” he said.
Mr. Schrems’s quest is far from finished. Regulators could decide not to pursue investigations, expensive litigation could drag on for years, and Silicon Valley companies are furiously adding lobbyists to try to influence the nascent rule-making process.
But if these types of complaints succeed — and it’s not entirely crazy to think that they could, given the current antipathy toward American tech giants and the satisfaction that European officials might take in kneecapping a few of them — it could be a watershed moment for large tech companies.