The area where social media has undoubtedly been most actively regulated is in their data and privacy practices. While no serious critic has proposed a flat ban on data collection and use (since that would destroy the algorithms that drive social media), a number of important jurisdictions including the European Union and California have imposed important restrictions on how websites (including social media) collect, process, and disclose data. Some privacy regulations are clearly justified, but insofar as data privacy laws become so strict as to threaten advertising-driven business models, the result will be that social media (and search and many other basic internet features) will stop being free, to the detriment of most users. In addition, privacy laws (and related rules such as the “right to be forgotten”) by definition restrict the flow of information, and so burden free expression. Sometimes that burden is justified, but especially when applied to information about public figures, suppressing unfavorable information undermines democracy. The chapter concludes by arguing that one area where stricter regulation is needed is protecting children’s data.

Generally, where the US prioritises freedom of expression as enshrined in the First Amendment to the US Constitution, the EU favours the right to privacy. The freedom to impart and receive information is an important component of freedom of expression. The right to erasure (‘right to be forgotten’) as articulated by the Court of Justice of the EU in its 2014 Google Spain judgment, whereby search engines must delist certain results upon requests from EU data subjects, and its subsequent implementation, show transatlantic divides over the right to freedom of expression vis-à-vis data privacy rights. In an attempt to combine fundamental rights concerns, permissive principles of jurisdiction, and questions of connection and reason, the research suggests a way for the EU to exercise jurisdiction regarding the right to erasure that will lessen transatlantic conflicts. Specifically, delisting should not be limited to EU country-specific websites that can easily be circumvented by going to a non-EU version of the same site, but nor should it be implemented globally, thereby subjecting the whole world to EU law. This approach can be applied in future situations where US and EU values, interests and laws on data protection and the freedom of expression collide.

Since the CJEU’s ruling of May 2014 in the Google Spain case (also known as the Costeja case), the “right to be forgotten” on the internet has been hotly debated in Europe and beyond. The Court in Strasbourg has been reluctant so far in upholding erasure or anonymisation of news archives (or parts of them), but it suggested that ‘less restrictive measures’ might be tolerable. The latter arguably enables one to tailor approaches to what the balancing requires in individual cases.