Co-constitutive complexityUnpacking Google’s privacy policy and terms of service post-GDPR

In January 2019, the French National Data Protection Commission (CNIL) imposed a financial penalty of EUR 50 million on Google for breaches of the EU’s General Data Protection Regulation (GDPR) (CNIL, 2019). CNIL found that Google’s contractual agreements were structured in a way that undermines transparency, provides inadequate information about the purposes of data processing, and lacks valid user consent for advertisement personalisation. CNIL emphasises three problematic aspects of Google’s contractual agreements: the complicated, interrelated structuring of various documents; the vagueness and general nature of the language used; and the convoluted ways of acquiring user consent. In this article, we focus specifically on the first aspect, the complex nature of Google’s interrelated document structure and CNIL’s (and the GDPR’s) requirement that this complexity is relieved. Our ambition is to both scrutinise the structure of Google’s policy landscape and to problematise their means of reducing complexity, thus accommodating CNIL. We argue that the material (inter-related) and communicative (vague and generic) articulation of Google’s policies are best understood as deliberative data politics. These data politics are embedded within a specific socioeconomic system with its own interest in keeping policies generic and complex. It further proposes that the GDPR – itself a complex legal document – may be used to produce more, rather than less, complexity, when used in regulatory negotiations by powerful actors. While the complexity of a legal instrument such as the GDPR is unsurprising, this still creates a paradox in terms of the issues which CNIL points to, such as the need for increased transparency and the demand that users – and laypeople – should be able to understand the terms and policies put forward by platforms.

The ambition is therefore to demonstrate how complexity plays out in the language and interrelated structure of Google’s privacy policies and terms of service (ToS), and how the implementation of the GDPR has enhanced the discursive complexity for users. Even though we engage with socio-legal and socioeconomic perspectives, our primary focus is on the discursive complexity of these frameworks and how the generation of such complexity creates less transparency for users, rather than providing socio-legal solutions to this problem.

Empirically, we focus on Google’s privacy policy, ToS, and the EU’s GDPR. The former is not limited to Google’s privacy policy, but further branches out into multiple Google services partly covered under the privacy policy. By critically scrutinising the intertextual relations of these documents, we lay the foundation for emphasising complexity, as well as the demand to reduce such complexity, as two opposing dynamics at stake both in relation to Google and the GDPR. To account for the political economy of Google’s policies, we consider terms such as platforms, data politics, and user rights, and how these notions clarify and illuminate the document analysis. We do this to further account for how privacy policies and ToS, produced by Google, are intertwined with an economic rationale, as well as with contestant actors such as EU regulators, whose objective of transparent practices may be interlocked in a paradoxical production of ever more discourse.

Our analysis of the intertextual relations of Google’s privacy policies and ToS and the GDPR is inspired by Norman Fairclough’s discourse theory, and the relationships between text, discourse, and social practice. The analysis is attentive to the dialectical relationships between discourse and social practice, “with how discourse figures within processes of change, and with shifts in the relationship between discourse and more broadly semiosis and other social elements within networks of practices” (Fairclough, 2003: 205). Our main focus is on how key terms change and stabilise over time, and how these compare between Google’s privacy policies and the GDPR. We are therefore particularly interested in Fairclough’s (1992: 232) notion of intertextual chains, as it is useful to “specify the distribution of a (type of) discourse sample by describing the intertextual chains it enters into, that is, the series of text types it is transformed into or out of”. This concept is useful to demonstrate the association between different documents, how discourses are constructed over time, and how some of these gain dominance and form clusters. We further evolve the notion of intertextuality to vertical intertextuality and horizontal intertextuality.

Vertical intertextuality should be understood as changes in contractual agreements and policies over time. Vertically, Google’s privacy policies date back to 9 June 1999, and there are 35 different versions to date; the current version was effective from 4 February 2021. Similarly, there are 19 versions of Google’s ToS, with the first dating back to 20 September 1999 and the most recent to 31 March 2020 (Google Privacy & Terms, 2020). Horizontal intertextuality should be understood as the intertextual relations between different kinds of documents, be they internal – for instance, Google’s privacy policy and ToS – or external, marking the intertextual relations between Google’s contractual agreements and the GDPR.

The analysis starts by accounting for the vertical intertextuality that shapes Google’s privacy policy and the GDPR. Next, it accounts for horizontal intertextuality, focusing specifically on how Google’s privacy policy and the GDPR treat the notions of third party and personal information.

The notions of personal data and personal information are often used interchangeably, although there is a preference for personal information in the American privacy literature (Cohen, 2019; Nissenbaum, 2010; Schwartz & Solove, 2014), whereas European data protection is anchored in the notion of personal data. The GDPR uses the notion of personal data, but defines it (in Art. 4) as any information relating to an identified or identifiable natural person. In this article, we use the notion of personal data when we refer to the GDPR and its legal provisions, but otherwise rely on personal information, which is also the concept used in Google’s privacy policy.

The CNIL decision will not be used directly as an object of analysis, but rather serve as an indicator of the various problems which can be identified in the discursive construction of Google’s privacy policies and ToS. Even though this article primarily focuses on the discursive complexity of policies and regulation pertaining to privacy and data protection, it will also briefly relate to the recent EU proposals for a Digital Services Act and a Digital Markets Act. First, in order to interrogate the theoretical context of our analysis, we discuss platforms, data politics, and user rights.

In Benjamin Bratton’s (2015: 41) account, the most novel challenge introduced by digital platforms is that they “are simultaneously organizational forms that are highly technical, and technical forms that provide extraordinary organizational complexity to emerge”, and “as organizations, they can also take on a powerful institutional role, solidifying economies and cultures in their image over time”. As a technical entity, a platform is characterised as a “standards-based technical-economic system that simultaneously distributes interfaces through their remote coordination and centralizes their integrated control through the same coordination” (Bratton, 2015: 42). The technical system operationalises a particular institutional program that determines the coordination of graphical user interfaces. These, in turn, set the terms for user agency within the platforms’ policies: “Platforms are generative mechanisms – engines that set the terms of participation according to fixed protocols” (Bratton, 2015: 44). It is because platforms can determine the technical conditions for user participation that they can be considered institutional models that govern the possible actions and participation of users. According to Van Dijck (2013), platforms should therefore be perceived as techno-cultural constructs and socioeconomic structures. From a techno-cultural perspective, this entails attentiveness towards how technology shapes usage and users, and what kind of content platforms allow:

Technologically speaking, platforms are the providers of software, (sometimes) hardware, and service that help code social activities into a computational architecture; they process (meta) data through algorithms and formatted protocols before presenting their interpreted logic in the form of user-friendly interfaces with default settings that reflect the platform owner’s strategic choices.

A platform like Google, for example, is structured by a design logic that generates an architectural, computational, and political program that includes strategies for organising the publics that generate information translatable to surplus value. As such, the business model is integrated into both software and hardware in ways that make Google capable of integrating additional services. The functions of the code are made available to developers through the application programming interface (Evans & Schmalensee, 2011).

This ties further into what Van Dijck refers to as socioeconomic structures, thereby directing attention towards platforms business models, ownership, and governance. Even though the governing logics of major platforms are partly accessible through ToS and privacy policies, the real effect of their status as regulatory devices, and how they chime into current regulatory frameworks at national and supranational levels, is ambiguous (Klass, 2019; Solove & Hartzog, 2014; Van Dijck, 2013). This ambiguity is closely linked to the interconnections of multinational platforms within a socioeconomic system that increasingly relies on the collection, processing, and monetisation of information. Understanding the data-based modulations within existing modes of production has led to several conceptual proposals for understanding this recent form of capitalism: platform capitalism (Srnicek, 2016), surveillance capitalism (Zuboff, 2015, 2019), and Big Data capitalism (Fuchs, 2019), to name a few. Couldry and Mejias (2019), on the other hand, argue that the value extraction from human relations into data is inherent in the process of capitalist accumulation and expansion. For this reason, they reject new qualifications of capitalism and contend that recent social developments occurring around information-based economies reflect capitalism as it has always been: “The systematic organization of life so as to maximize value, resulting in the concentration of power and wealth in very few hands” (Couldry & Mejias, 2019: 32).

The few hands of major platform providers such as Apple, Google, Microsoft, Amazon, and Facebook offer an interface which works as an access point for the consumption and production of information connecting users to their proprietary and transnational services, where granular bits of user data flow. The GDPR was developed partly in response to such data processing to update and strengthen existing rules on data processing (Hoofnagle et al., 2019), to address an increasing imbalance between platform giants and their users (Vanberg, 2021), and to ensure user rights such as right of access (Ausloos & Dewitte, 2018). In response to the GDPR, Google’s privacy policy proposes that users may control their privacy via the platform’s privacy settings, and further explain the volume and “aftermath” of the collection of user data. As we will see in the analysis of Google’s privacy policy and ToS, this “aftermath” is discursively far too multifaceted to be contained within an easily understood privacy policy and ToS. Moreover, contrary to platform-neutral settings that would allow for do-no-track, Google’s privacy settings require the user to create an account and identify themselves, which ironically allows for the collection of more personal data. In fact, even though Google claims its policies are transparent, unfolding the manifold and connected layers entangled within these policies reveals comprehensive volumes of data. Transparency is therefore unlikely to equate with intelligibility, even if Google were committed to revealing their mode of operations. As Marilyn Strathern (2000) demonstrated, transparency is not the same as knowledge, and amplified visibility in a certain domain simultaneously works to conceal other processes. Similarly, Mike Annany and Kate Crawford assert that a multifaceted assemblage such as Google cannot be made transparent simply by peering inside it, but must be understood as a system interrelated with other socio-technical systems “that do not contain complexity but enact complexity by connecting to and intertwining with assemblages of humans and non-humans [emphasis original]” (Ananny & Crawford, 2018: 974).

In further accounting for the consequences of platform practices, Ruppert and colleagues carve out the notion of data politics. They maintain that “data politics is concerned with not only political struggles around data collection and its deployments, but how data is generative of new forms of power relations and politics at different and interconnected scales” (Ruppert et al., 2017: 2). Data politics emerge from the interrelated conditions of worlds, subjects, and rights – that is, how the creation and governing of material infrastructures (worlds) is generative of politics and struggles directly affecting citizens and data subjects, and thereby also their rights. Similarly, Van Dijck and colleagues (2018) refer to data politics as complex systems of interdependencies around and between dominant platforms, and Couldry and Mejias (2019) refer to data relations and the social quantification sector as a conscious development of infrastructures focused on profiting from human life through data. Indeed, in further scrutinising Google as a dominant provider of infrastructural platforms, Van Dijck and colleagues (2018) point to its influence as a search engine, mobile operating system, web browser, social network service, app store, pay services and advertising service program, video-sharing site, geospatial information system, cloud platform provider, provider of hardware with the pre-installed Google software package, as well as its huge investments in artificial intelligence and machine learning. As a part of Google’s deliberative data politics, it attempts to reduce this “platformised” complexity by combining its services within one privacy policy, but as the forthcoming analysis will show, the policy remains a glossy surface hiding the complex data ecology influencing user experience and agency. As creators of the conditions that situate subjects with certain rights within a particular platformised infrastructure (Plantin et al., 2018), or world, platforms become key stakeholders in the politics emerging around data, and each platform represents its own politics (Gillespie, 2010). These politics are only partially found in the platform’s ToS and privacy policies, as, for instance, the performance of proprietary algorithms escapes the intention of transparency suggested in such policies.

Here, the central question pertaining to politics is how Google’s contractual agreements reflect the socioeconomic logic of the platform while responding to the standards for transparency and user rights set by the GDPR. In terms of regulation, Google’s ToS and privacy policy constitute a contractual relationship between the platform and its users, which defines and delimits their privacy rights. While Google has the power to set the terms of this relationship, they must ensure their policies and practices meet the standards set by the GDPR. As such, their ToS and privacy policy are always relative to another governing body. A key question is therefore how these policies have changed vertically from 1999 to 2021 and how they horizontally tie into increasing services and partners absorbed into the platform, and externally to the GDPR.

Contested space is often defined by struggle, in this case, a struggle over the right to define privacy rights and enforce them in specific contexts (Nissenbaum, 2010). One could argue that while GDPR, as the regulatory framework, has the authority to define and enforce privacy norms, Google attempts to deliver their own interpretation of these norms. This would, however, be a simplification of a much more complex interrelation between the two actors, as it tendentiously highlights a binary conflict while glossing over interdependencies and necessary collaborations between state, supra state, and corporate actors in constructing governmental and corporate services (Easterling, 2014). Google, for instance, has invested heavily in cloud computing operations within the European continent. It provides services to a wide variety of European businesses that the EU has a vested interest in serving with its unwavering commitment to economic growth and a business-friendly environment, as well as collaboration in other policy areas such as cybersecurity, the fight against terrorism, and the distribution of illegal content. While the main focus of this article is centred around a misalignment between Google’s platform practices and the EUs legal norms, this should not be interpreted to mean that unmitigated conflict is the only game in town. This would offer a one-sided depiction of the multifaceted interrelation between the two actors. From the viewpoint of data politics, a crucial question to be asked, then, is how citizens can claim rights when they engage with data-driven services entwined with complex power structures. What are the mechanisms in place, and how are these tailored as tools for citizens to strike back, to subvert, to take control of their data, and to affect the data streams that actors such as Google take advantage of? This are not easy questions to answer from a socio-legal and socioeconomic perspective, as the delineation between personal data and non-personal data in the GDPR is fraught with difficulty (Finck & Pallas, 2019), as well as how the GDPR affects and challenges personal data usage worldwide (Hoofnagle et al., 2019), how concretely American tech companies can fulfil the requirements of the GDPR, and how these further impact their business models (Houser & Voss, 2018).

As previously noted, our focus is less on these socio-legal and socioeconomic implications, and more on the discursive complexity of Google’s privacy policy and ToS and the GDPR, as they are likely to be seen through the eyes of regular users. As our analysis will demonstrate, the documents examined in this article represent two powerful actors that both claim to provide the individual with privacy rights – in both cases, from positions that are discursively removed from the individuals they claim to serve. Google’s framing of its users’ privacy rights as the ability to adjust privacy settings is thus carefully tailored to allow for the platform’s continuous collection and processing of data about its users (Jørgensen, 2017).

In her recent work, legal scholar Julie E. Cohen (2019) turns to the functioning of regulatory frameworks and their role in protecting and promoting human rights, such as the right to privacy. A key challenge, according to Cohen’s account, is the unaccountability of private economic power, including the tendency to rely on corporate social responsibility and defer to opaque and often privatised arrangements for the expert supervision of algorithmic processes over more stringent legal obligations. While policy-makers and international organisations can appeal to companies such as Google to adhere to privacy norms, these companies are not subject to binding human rights obligations. With opaque algorithmic arrangements, as, for instance, discussed by Pasquale (2015), Kitchin (2017), and Amoore (2020), Cohen also identifies a challenge in terms of the impenetrability of propriety algorithms and that of complex regulatory frameworks. In both cases, citizens are lost in terms of understanding their rights when using specific platforms: “Effective control of highly informationalized processes requires governance institutions capable of responding in kind, but the very process of optimizing regulatory controls to highly informationalized processes makes governance processes more opaque and less accountable to broader global publics” (Cohen, 2019: 234).

It is this discursive paradox that will be scrutinised further in our analysis, casting light on the vertical and horizontal intertextual relations which Google and the EU establish, using Google’s different versions of its privacy policies and ToS, and the GDPR, as a point of departure.

As previously mentioned, Google’s privacy policies have a relatively long history. The focus here will be on the most recent versions, as these are updated to respond to the GDPR, which came into effect on 25 May 2018. It is, however, still important to bear in mind that the latest version is an amendment which has intertextual relations to prior versions that should be regarded as agenda setters, to which newer versions respond. The first version of the privacy policy (1999) is not extensive in scope, but it entails some of the same privacy concerns to which the most recent version responds:

Google is sensitive to the privacy concerns of its users. The Internet allows individuals to explore and communicate with unprecedented ease, but it also allows websites to collect and distribute personal information with equal ease. We at Google know that many users are, understandably, concerned about such practices, and we wish to make clear our policy for collecting and using personal information.

The policy states that Google may share information about users with advertisers, business partners, sponsors, and other third parties, but only in aggregate, and not as individual users. This is not clear cut, however, as the following excerpt demonstrates:

From time to time, there may be situations where Google asks you for personal information. When we intend to use your personal information, we tell you up front. This way you can decide whether you want to give us the information or not. In case you change your mind or some personal information changes, we will endeavour to provide a way to correct, update or remove the personal data you give us.

As the CNIL ruling implies, the lack of clarity as to how data is collected and used is a recurring challenge in the history of Google’s privacy policies. Formulations such as “we will endeavour” are examples of the kinds of vagueness that has legal significance as a low level of commitment, compared to, for example, formulations such as “we are obliged to” or “we will endeavour by all means”. This ambiguity as to what actually happens with user data also relates to the clause on Google and cookies: “Most browsers are initially set up to accept cookies. You can reset your browser to refuse all cookies or indicate when a cookie is being sent. However, note that some parts of Google may not function properly if you refuse cookies” (Google Privacy & Terms, 1999: para. 7). The generic language about what data is collected, and what is shared, is a recurrent element in Google’s long list of privacy policies. Discursively, these do, of course, change over time and become more capacious, particularly the post-GDPR versions. Even though Google maintains that it has responded adequately in the latest update, the need to share data across the ever-growing ecosystem of Google services is fundamental to their business model and therefore remains stable throughout the different privacy policies. It is important to note that in 2012, Google made significant changes to its privacy policies, as one common policy was adopted across all of its services. This was a controversial move seen through the lens of EU regulators, as it allowed Google to use personal data from one service for another service. Google claimed this would provide users with greater transparency, but as our analysis on horizontal intertextuality demonstrates, different services and external partners are still widely integrated into the structure and function of Google’s policies, making it anything but simple. This adds not only to the discursive complexity, but also to the structural complexity of, particularly, post-GDPR Google policies.

The most recent privacy policy is more detailed in accounting for the different services and platforms to which the policy applies. Still, the text is similar in its indeterminate formulations. The services the policy mentions are only a handful of the services and platforms Google actually operates. Phrases such as “include” and “platforms like” are indicative of uncertainties which leave users on unsure ground in terms of the scope of the data collection across different platforms, and thus the reach of the policy. The current policy also retains vague rhetoric when explaining why Google collects information on users:

We collect information to provide better services to all our users – from figuring out basic stuff such as which language you speak, to more complex things like which ads you’ll find most useful, the people who matter most to you online, or which YouTube videos you might like. The information Google collects, and how that information is used, depends on how you use our services and how you manage your privacy controls.

The policy furthermore provides information on how to manage privacy controls. While providing such information, the policy at the same time admonishes that if users limit Google’s access to this information, the services and platforms will not function properly. This is a very similar wording – from the first policy to the most recent one – and demonstrates discrepancies in the transition from policy to practice, as, for instance, users’ acceptance of cookies becomes a repetitive, habitual, automated user practice in order for services to actually work.

While our focus in the remainder of this article is the latest versions of Google’s privacy policy, these excerpts demonstrate certain vertical intertextual stability through different versions. This is also true regarding Google’s ToS, for instance, in terms of rights management. The latest version of Google’s ToS (effective from 31 March 2020; Google Privacy & Terms, 2020) responds most directly to the GDPR. It is more detailed and explains key concepts more thoroughly than former versions. For example, in relation to content and licences, concepts such as “worldwide”, “non-exclusive”, and “royalty free” are specifically explained. The structure is different, but essentially, the content remains the same.

By demonstrating the textual affinities in this manner, we wish to account for the vertical relationships between the different versions of Google’s privacy policy and ToS. What these reveal are convoluted patterns of generic formulations and scope, as well as iterations of the importance of protecting users’ privacy rights. At the same time, the formulations determining who owns the data and how users can expect their data to be utilised by Google have been consistent for 20 years. This is aligned with Peslak and colleagues’ (2020) longitudinal study of Google privacy policies, which indicates that the complexity of Google’s policy has increased over time and that it has discursively evolved to a more personalised and friendlier document by using more positive and enjoyment-laden words. They also note that Google has further obfuscated their privacy policy by adding links to other pages.

Judging by this, CNIL’s financial penalty to Google for inadequate information and lack of transparency about their data processing practices comes as no surprise. To the contrary, it testifies to the importance the GDPR places on the individual’s ability to understand and consent to the processing of their personal data. Ironically, the process which paved the way for the GDPR, and the actual text which constitutes the regulation, is itself tremendously complicated. While complex processes and language are to be expected when deliberating legal documents, they still constitute intricacies difficult for citizens, users, and laypeople to grasp. When these interrelated convolutions between the GDPR and the Google policy language meet, citizens have no way of deciphering how they relate to each other, nor to their right to privacy and protection of personal information.

The vertical intertextual process leading up to the GDPR can be analysed using similar methods as for Google’s privacy policy and ToS. In its vertical intertextuality, the GDPR reflects the former regulatory framework, the Data Protection Directive of 1995 (Hoofnagle et al., 2019). The directive established rules and conditions for a citizen’s right to data protection, while supporting the free flow of personal data between EU member states. The socio-legal context of the GDPR is the rapid technological developments which have brought new challenges for the protection of personal data both in terms of the digital economy and social life, as argued by the Commission in the preamble to the GDPR (EUR-Lex, 2016: 2). So, while there are vertical intertextual relations with former regulatory frameworks dealing with personal data, there are also vertical intertextual relations within the EU concerning the making of a new regulatory framework. The Commission acts as the organ which proposes regulations, taking on the role of agenda-setter, whereas the other EU bodies react to the proposal submitted by the Commission. However, it is not just the Commission’s voice which characterises the proposal, as it follows detailed prescriptions in terms of public consultations, impact assessments, and consultations with stakeholders, companies, industry actors, civil society actors, powerful lobbyism, and so on. This part of the process alone lasted more than two years, involving several preparatory papers and complex deliberations between stakeholders representing different interests (Laurer & Seidl, 2020).

Once a proposal is put forward, the EU’s formal path to legislation is further activated and, in this case, involved a number of opinions, for example, from the European Data Protection Supervisor and the Economic and Social Committee. In all, there were over 20 deliberations within the Council of the European Union or its preparatory bodies, two readings by the European Parliament, and a Commission position on the European Parliament’s amendments. It would exceed the scope of this article to go further into these processes,

See Valtysson (2018) for a study that demonstrates the discursive discrepancies that unfold in the institutional negotiation of specific EU programmes.

In this article, we have examined the co-constitutive complexity between Google’s privacy policies and ToS and the GDPR. Motivated by CNIL’s financial penalty against Google, we were curious to examine how Google’s privacy policies address their users’ right to transparency stipulated by the GDPR, and how they reconcile the GDPR’s demand for transparency with the data collection imperative of their business model. Our analysis demonstrates that the vertical and horizontal, and external and internal intertextuality of Google’s privacy policies and ToS undermine users’ ability to understand and foresee the types of data processing to which they consent. This complexity has increased over time, and the post-GDPR versions are particularly dense, despite the GDPR’s efforts to the contrary.

This article also demonstrates that the GDPR is itself a complex document with its own vertical and horizontal, and external and internal intertextuality, making it challenging to understand for general users and laypeople. This complexity hampers users’ understanding of how their rights are secured, not only as data subjects, but as citizens. The EU objectives of clear and understandable policies and transparent data processing practices, therefore, seem far away – if they are even achievable. While this may be an unwanted, but unsurprising, side-effect of a comprehensive piece of EU regulation, it counters the very purpose of the regulation. The CNIL decision points to the conflict between specific Google practices and the GDPR; however, it remains an open question to which extent Google is capable of complying with the GDPR while retaining its data-driven business model and the complex and interrelated format of its privacy policy. From a socioeconomic perspective, Google’s power resides within its dominant position in the supply chain of information, which is central to the very functioning of platforms. Google’s privacy policy and ToS represent only a fraction of what constitutes Google’s operations as a whole, and even though Google has been required to respond to the GDPR, our analysis demonstrates that whereas the vertical intertextuality has remained relatively stable, the horizontal intertextuality has increased in complexity. This indicates the limitations of the GDPR as a normative corrective to the kind of complexity Google enacts. While the GDPR has required Google to reconsider its terms and policies, to make them clearer and more understandable to users, the discursive complexity of Google’s privacy policies have in fact increased. In the process of accommodating GDPR’s demand of increased transparency, Google has thus made the policies even more obscure to general users of their services. This is what we refer to as Google’s deliberative data politics, thus stressing contractual complexities as an integral part of the platform’s business model, and as such, serving a specific (and strong) socioeconomic purpose for Google.

Our analysis illustrates the enormous tasks that lie ahead in providing EU citizens with transparency and privacy rights in the current regime of data politics and data capitalism. Arguably, the GDPR – despite good intentions – cannot truly address the fundamental power imbalance between giant platforms such as Google and individual users. As previously mentioned, new regulatory proposals such as the EU’s Digital Services Act and the Digital Markets Act seem better suited for a fight, as they address the challenges that complex interrelated services such as Google pose to competition and a fair market (Digital Markets Act), as well as to users’ fundamental rights (Digital Services Act). The latter focuses particularly on the duties of platforms in relation to illegal content, but also demands increased transparency and human rights risk assessment according to company size and potential impact on user rights. As such, the policy discourse around Digital Services Act and Digital Markets Act takes the infrastructural role of giants like Google as its starting point, yet the proposals have only now started their long journey through the EU’s negotiation process, and it is too early to anticipate their effect on users’ ability to understand and claim privacy rights.