Hi all, Honestly, on age verification, it feels like everybody and their aunt have published a position or a proposal. The debate is now a cacophony. Meanwhile the parliament is trying to fix open government data in the Digital Omnibus. Also, the Commission has presented its Tech Sovereignty package, which includes an “open source first” principle for public sector software built with public funding.
Dimi === Digital Omnibus & Open Data === Reminder: the digital omnibus wants to simplify personal data provisions and open government data laws. The Legal Affairs (JURI) committee has published its draft report <https://communia-association.org/wp-content/uploads/2026/06/JURI-PA-789142_EN.pdf> on the Digital Omnibus. The section most relevant to us concerns open government data. JURI's amendments 57–60 seek several things, including to protect non-discriminatory re-use, interoperability and the use of standard and open licences. The issue with the Commission proposal is that it suggests public sector bodies use non-standard licenses for very large enterprises, which would be incompatible with the open licences we use. Wikimedia Europe, Creative Commons and Communia have a position on this <https://communia-association.org/wp-content/uploads/2026/02/One-pager-Digital-Omnibus.pdf> . — Communia’s assessment <https://communia-association.org/2026/06/22/juri-tries-to-save-open-government-data-but-gets-the-solution-wrong/> of JURI's approach is that it identifies the right problem but gets the solution wrong. The concern is that the amendments, while well-intentioned, could inadvertently restrict the ability to combine and re-use public sector information across borders and sectors — particularly if they are read as permitting fragmented licensing practices in the name of addressing imbalances linked to the economic power of very large market actors. — On the Council side, national ambassadors tried to hammer out a final negotiating position on 26 June, but a block of them, led by Germany, is of the opinion that the simplification efforts don’t go far enough, so the Irish Council Presidency will have to take over from Cyprus and try to find a way forward. === CSAM Directive & Regulation === Two separate but easily confused files have reached important milestones this month, so it is worth reminding ourselves which is which. — The Directive on combating the sexual abuse and sexual exploitation of children and child sexual abuse material <https://law-tracker.europa.eu/#> (a.k.a. CSAM Directive) is a criminal law instrument setting minimum standards for offences and penalties related to child sexual abuse for EU countries. There will be increased minimum penalties and the period during which offences can be prosecuted will be longer, according to the agreement reached between the Council <https://www.consilium.europa.eu/en/press/press-releases/2026/06/22/combatting-child-sexual-abuse-eu-agrees-stronger-criminal-law-rules-and-enhanced-support-to-victims/> and the Parliament <https://www.europarl.europa.eu/news/en/press-room/20260622IPR45906/combating-child-sexual-abuse-agreement-on-updated-rules>. We passively followed this legislative procedure, as it is not addressed at platforms, but some of the language may have been relevant for our projects. Both institutions technical teams will now finalise the legal text, then they need to vote on it formally and it will proceed to be published in the Official Journal. Member states will then have three years to transpose the directive into national law. — The CSAM Regulation is the far more contested proposal dealing with platform obligations to detect, report and remove CSAM, including the question whether chat messages should also be scanned. The final political trilogue was scheduled yesterday. As a reminder, here’s Wikimedia’s initial position <https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14352-Protection-of-minors-guidelines/F3496424_en> on this. — Last night, alongside watching football I presume, Parliament and Council spent six hours trying to hash out their differences, but a deal was not reached. Both houses now have the protection of end-to-end encryption in their positions, which is a positive change as compared to the initial proposal and interim versions. From what we hear, negotiators are still trying to distinguish between public and non-public content and hence draw the line on what must be scanned and how. We also expect that age-verification will be part of the final text, but as a voluntary and optional measure. NB: What a segue to the next section! === Age Verification === The cacophony mentioned in the introduction is real. Here is an attempt to impose some order on it. — The Commission's expert panel on child safety <https://commission.europa.eu/topics/digital-economy-and-society/protecting-children-online/special-panel_en> online held its final meeting on 16 June, examining three surveys. The panel's chairs, Maria Melchior and Jörg Fegert, will now produce a recommendation due on 13 July. The direction, according to people involved, is not a simple recommendation for age restrictions but something more holistic. The emphasis from industry, civil society and EU capitals alike has been on the need for EU-wide measures to avoid fragmentation. — Germany's independent expert commission presented its recommendations <https://www.bmbfsfj.bund.de/bmbfsfj/expertenkommission-veroeffentlicht-handlungsempfehlungen-290226> on 30 June, and avoided making a clear recommendation on a minimum age. Instead it set out two options: introduce a minimum age of 13 with graduated protection standards up to 18; or no minimum age but targeted restrictions on specific functions and services depending on their risk level. Crucially, the German experts explicitly said that "national go-it-alone solutions should be avoided." — At the international level, the G7 published common principles for protecting minors online emphasising that data protection principles — including proportionality, data minimisation and purpose limitation — must be observed in any age verification mechanism. The European Commission went out and publicly welcomed <https://digital-strategy.ec.europa.eu/en/news/commission-welcomes-g7-agreement-common-principles-protecting-minors-online> this. Interestingly, the data protection authorities of the G7 countries also met <https://www.cnil.fr/en/emerging-technologies-and-protection-children-g7-data-protection-authorities> during the summit. — Back in Europe, Estonia's Digital Minister Liisa-Ly Pakosta broke with the D9+ coalition's joint call for EU-wide age verification <https://gouvernement.lu/dam-assets/images-documents/actualites/2026/06-juin/08-margue-d9/document/final-d9-ministerial-declaration.pdf>, calling the "just ban" approach "a little bit populist" and arguing for education alongside proper DSA enforcement. Czechia continues to oppose strict bans, despite signing the above declaration. Also noteworthy: Italy's Prime Minister Meloni said that a ban risks "partially transferring the problem onto families" and that governments should instead put more pressure on platforms to take their responsibilities seriously. — On the national legislative front, the picture is fragmenting rapidly — which is precisely what the expert panel and industry are warning against. Sweden published its government report proposing a ban on under-15s accessing platforms that allow users to discover, connect and communicate with the general public. Crucial for us is that Wikipedia is explicitly excluded <https://www.regeringen.se/contentassets/d1b21d5210774bfba9797e08883c9633/sou-2026_35_pdf-a_webb.pdf> (p. 200): "digital encyclopedias, such as Wikipedia, which are based on content shared by end users... fall outside the law's scope of application." The reasoning is that this "corresponds to the interest of not restricting freedom of expression and information more than necessary". This is an argument worth citing elsewhere. Also a shoutout to Wikimedia Sverige and Eric Luth, who never got tired to explain Wikipedia and its sister projects to policymakers. — Austria is also set to publish a new age verification law. It is expected to take a different approach, based on audio-visual and media regulation. It will focus on platforms with specific functionalities such as autoplay and streaks rather than a blanket ban, and with privacy-preserving requirements for the verification mechanism itself. We are waiting for the actual legal proposal. Stay tuned. — The UK is preparing to announce a ban <https://www.gov.uk/government/news/social-media-to-be-banned-for-under-16s-in-landmark-government-move-to-givekids-their-childhood-back> on under-16s accessing certain social media, alongside restrictions on livestreaming, disappearing messages and functions enabling communication with adult strangers. — Two significant judicial developments this month will shape how national age verification laws can be applied across borders. The CJEU's Grand Chamber ruled <https://curia.europa.eu/site/upload/docs/application/pdf/2026-06/cp260087en.pdf> on 16 June in joined cases WebGroup Czech Republic and NKL Associates and Coyote System that member states may impose age verification obligations on platforms established in other member states — but only if they first request that the member state of establishment takes action, and also notify the Commission and that member state in advance, except in cases of urgency. This narrows but does not eliminate the country-of-origin principle. — The second part of the ruling is potentially more far-reaching: the Court held that a platform which uses an algorithm to determine under what conditions and in what order content is shown exercises control over that content and therefore cannot claim the hosting liability exemption. Legal scholars are divided on how broadly to read this — LSE's Martin Husovec called it an "overruling of a decade of settled case law”. Others caution against over-interpretation. Either way, this judgment will certainly generate further litigation. === Copyright Consultation === Wikimedia Europe submitted its contribution <https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/18172-Report-on-the-review-of-the-2019-EU-rules-on-copyright-and-related-rights-in-the-digital-single-market/F33504239_en> to the Commission's targeted consultation on the Copyright in the Digital Single Market (CDSM) Directive review ahead of the 25 June deadline. The consultation covers four issues: challenges for creators linked to AI; online piracy of live events; sound recordings of third-country nationals; and the scope of the scientific research exception. — We focused on questions one and four, skipping the middle two. AI and copyright we shared that the current framing of the issue sees the challenge primarily in terms of rightholders' difficulty in controlling and licensing as well as in securing remuneration for their works and that this does not capture the situation of the open, non-profit projects and infrastructure curated by human volunteer contributors. We suggested that share-alike principles and public domain safeguards could be ways to avoid commercial lock-in of the commons. — As WMEU is a member of COMMUNIA, I want to also share their contribution <https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/18172-Report-on-the-review-of-the-2019-EU-rules-on-copyright-and-related-rights-in-the-digital-single-market/F33503949_en>. Our responses regarding the scientific research exception are largely based on their work. Among others, we suggest improving cross-border access to scientific research and to introduce a EU-level secondary publishing right for publicly funded research. === Communication on European Tech Sovereignty === As opposed to some fears, the European Commission has published its Communication on European Tech Sovereigntly <https://digital-strategy.ec.europa.eu/en/policies/eu-tech-sovereignty> and a EU Open Source Strategy <https://digital-strategy.ec.europa.eu/en/policies/open-source-strategy> is indeed part of the package. Now, I have seen my share of communications and strategies in Brussels, and many just get forgotten after a bit, so I am not exactly holding my breath. — More concretely, the package comes with two legislative proposals, Chips Act 2.0 and a Cloud and AI Development Act (CADA). If adopted the new rules would give governments across the EU much more leeway in preferring local companies in public tenders. This would be achieved by introducing four levels of sovereignty. The lowest level demands that “data must be stored physically in the EU” (level 1), the scale then goes up to “provider must be owned and controlled within the EU” (level 3) and “complete control over the entire software supply chain” (level 4). I expect a lot of back-and-forth about which level applies to which public sector activity, e.g. law enforcement, military, public health, education. — Relevant for us is that CADA introduces an "open source first" mandate. Any software built with public funding must be openly available for reuse. This is something that some countries already have and the results are OK but not overwhelming. Perhaps scaling it to the EU level will help. The act would further allocate over €2 billion toward maintaining shared, open-source critical digital infrastructures. According to the proposal this funding will be targeted at "frontier” AI, industrial AI, and specialised AI models tailored specifically for European public service and industrial needs. ===END=== -- Wikimedia Europe ivzw
_______________________________________________ Publicpolicy mailing list -- [email protected] To unsubscribe send an email to [email protected]
