r/eulaw

Just as US-EU trade tensions seemed to be cooling, a new flashpoint has arrived.

Trump has threatened a 100% tariff on any country imposing a digital services tax on American companies, and made clear it would supersede any existing trade agreements. This comes less than two weeks after the EU approved a deal designed to cut tariffs on US goods.

The tactic has worked before. Canada repealed its 3% digital services tax after a similar ultimatum to keep trade negotiations alive.

But the EU is a different beast. France already has a DST in place and has previously said it won't bow to US pressure. Germany and Belgium are planning their own versions. The core disagreement, whether large American tech companies pay enough tax on European revenue, has been running for years with no resolution in sight.

For ecommerce sellers operating across borders, this isn't abstract. A 100% tariff on goods from major EU trading partners means higher sourcing costs, more expensive imports, and consumers on both sides paying more for everything.

A few things worth discussing:

Do you think EU countries will back down the way Canada did, or is this a different situation entirely? If these tariffs do go into effect, which product categories do you think get hit hardest?

Want more ecommerce news like this? Subscribe to our weekly newsletter at https://ecomwatchnews.substack.com/ where we cover everything you need to stay ahead in the ecommerce space.

I'm sharing this here as it relates to the transparency of automated decisions affecting digital rights in the EU.

On 15 August 2026, a new EU policy proposal was submitted: The Ranking Restriction Information Right (RRIR).

The proposal asks whether, when an automated system materially restricts the visibility of a website or information source, the affected website owner should be informed that the restriction occurred and given a general category of the reason.

The proposal does not seek disclosure of proprietary algorithms, ranking signals, thresholds or anti-spam mechanisms.

Submitted to: European Commission, European Parliament (PETI and IMCO), Coimisiún na Meán (Ireland), and CNMC (Spain).

Submitted by: Marin Popov

Read the full proposal: https://1euroseo.com/wp-content/uploads/2026/08/The-Ranking-Restriction-Information-Right-Version-1.0-15-August-2026.pdf

I just got this email from Amazon, though not sure which Amazon sent it. I'm based in the EU (Ireland to be specific) and always have been, never used Amazon outside of the EU. I'm just curious, is this first point legal in the EU? Mandatory forced arbitrations (as opposed to going to court).

Hi everyone,

Over the past few months, we’ve been auditing our infrastructure stack with a strong focus on compliance (GDPR, NIS2, DORA) and data sovereignty in Europe. One topic that keeps coming up in discussions with DPOs and security teams is the conflict between European privacy frameworks and the US CLOUD Act.

Most people understand that storing customer data or databases in AWS Frankfurt or GCP Netherlands doesn’t fully shield it from US extraterritorial warrants if the parent entity is US-based. However, the implications for the DNS layer and Edge Security (WAF/DDoS protection) seem to be underdiscussed.

Here are a few specific pain points we identified:

1. GDPR Article 48 vs. CLOUD Act: GDPR Article 48 explicitly bars recognizing non-EU court orders unless based on international agreements (like MLATs). US-parented vendors facing a CLOUD Act warrant for metadata or edge logs find themselves in a direct legal catch-22.
2. DNS Query Metadata: Resolving authoritative DNS for EU enterprise domains via US-regulated infrastructure generates query logs and traffic patterns that fall under the scope of non-EU jurisdiction.
3. TLS/SSL Key Processing at the Edge: Reverse proxy WAFs inspect decrypted HTTPS traffic at the edge. Even with "EU Data Residency" toggled on, the cryptographic keys and unencrypted payloads pass through systems governed by US parent entities.

Because of this, we've seen a growing shift toward building a 100% EU-sovereign stack ensuring that the parent entity, Anycast DNS network, WAF, and hosting are fully EU-owned and operated (e.g., platforms built like NovaMX or independent European infrastructure providers) to eliminate extraterritorial reach entirely.

I recently wrote a detailed breakdown on the legal mechanisms and architectural requirements for a CLOUD-Act-free DNS/WAF stack for those interested in the deep dive: Why the US CLOUD Act Endangers European DNS (And How a 100% EU Stack Solves It)

Curious about how other teams here are approaching this:

• Are your compliance/legal teams actively auditing DNS and WAF providers for CLOUD Act exposure?
• Is your organization keeping hybrid/US providers for edge security, or moving to native EU providers to satisfy NIS2/DORA sovereignty requirements?

Would love to hear how other sysadmins and network engineers are navigating this!