Wave 5 Findings

In the privacy arena, actors from academia, policy, law, tech, journalism, and civil society influence debates, policies, and practices. The size and diversity of sectors, regional, legal, and cultural contexts in the privacy arena presents a challenge for systematically synthesizing its members' conversations and opinions. The Transatlantic Privacy Perceptions (TAPP) project aims to help companies and policymakers learn more about current and future digital privacy concerns and how they can best be addressed through legislation and technology. To this end, it follows and analyzes developments in privacy actors’ attitudes, expectations, and concerns around current and emerging issues in digital privacy over time. It is an interdisciplinary research project in privacy, survey methodology, and complex sampling techniques at the Universities of Maryland (UMD) and Munich (LMU).

Conducted since 2022, the survey gathers insights from privacy experts across the United States and Europe to assess the state of data protection, the performance of tech companies, and the impact of artificial intelligence (AI) on privacy policies. The focus of Wave 5 of the Transatlantic Privacy Perceptions (TAPP) Panel, conducted between 14 August 2024 and 11 September 2024, is the Panel’s annual module on the current state and effects of privacy laws, regulations, and practices - particularly those related to digital privacy - within the context of respondents’ respective countries of work. Respondents are asked to reflect on how these privacy frameworks influence their business operations, highlighting both challenges and areas of progress. Wave 5 repeats 15 questions from Wave 2, conducted in 2023.

This longitudinal approach allows TAPP to track shifts in opinions and observe how the regulatory landscape and attitudes toward digital privacy may have evolved over time. Additionally, with the rapid developments in artificial intelligence, we include additional questions about the EU AI Act to gauge how stakeholders are responding to this emerging regulatory framework. As AI continues to advance, understanding reactions to the EU AI Act is critical in assessing its perceived impact on innovation and privacy protection.

The survey was programmed and distributed using Qualtrics, ensuring compliance with both the EU General Data Protection Regulation and the University of Maryland’s ethical standards.

3.1 Respondents Profile Wave 5 of the TAPP survey received responses from 66 participants. In terms of professional background, 35% are from academia, and 14 % are from the tech industry while 14 % are from the private sector, but from non-tech industry (Figure 1).

Figure 1. Respondents composition by sector

Notably, 52% of respondents have worked in the privacy field for more than 10 years (Figure 2), and only 3% less than a year. The sample includes 44 participants with more knowledge about the European privacy context and 22 of the American context.

Figure 2. Respondents composition by years of experience with privacy

3.2 Balance of interest in digital privacy laws

The comparison of interest in digital privacy laws reveals relevant regional differences. In Europe, there's a notable shift towards favoring individual users over businesses. From 2023 to 2024, the percentage of respondents believing laws favor individual users rose from 44% to 75%. Conversely, in the United States (USA), the perception that laws favor businesses remains overwhelmingly high, with 92% in 2023 and 86% in 2024. This underscores the divergent approach to privacy laws on either side of the Atlantic, with Europe moving towards greater protection for individuals while the USA maintains a business-friendly stance (Figure 3).

Figure 3. Balance of interest in digital privacy laws

3.3 Influence of laws on development of privacy-preserving practices and technologies

This analysis highlights a growing perception in the USA that privacy laws are encouraging innovation in privacy-preserving technologies (Figure 4). The percentage of respondents in the USA who believe laws encourage innovation almost doubled, from 27% in 2023 to 50% in 2024. On the other hand, Europe shows a slight decline in this belief, dropping from 49% in 2023 to 41% in 2024. However, this difference primarily leaned towards neutrality, increasing from 23% to 36%, rather than discouragement, which decreased from 28% to 23%. This trend indicates a positive shift in the USA towards recognizing the benefits of privacy laws in fostering technological innovation, while Europe maintains a more balanced view.

Figure 4. Influence of laws on development of privacy-preserving practices and technologies

3.4 Comprehensiveness of digital privacy laws

There is a notable difference between stakeholders in Europe and the USA regarding whether digital privacy laws cover the necessary areas (Figure 5). In Europe, 55% in 2022, 57% in 2023 and 43% in 2024 felt the laws cover fewer areas than needed. In the USA, 100% of respondents in 2022, 94% in 2023 and 95% in 2024 felt that the laws cover fewer areas than required, suggesting a broader dissatisfaction in the US about the comprehensiveness of these laws.

Figure 5. Comprehensiveness of digital privacy laws

3.5 Enforcement of digital privacy practices

The enforcement of digital privacy practices presents an interesting contrast between Europe and the USA (Figure 6). In Europe, there's a noticeable increase in the belief that privacy practices are "Mostly" enforced, rising from 9% in October 2022 to 27% in August 2024. Meanwhile, in the USA, perceptions remain more stable with a slight increase in minimal enforcement, suggesting that privacy practices are "A little" enforced. This contrast highlights the varying levels of regulatory enforcement and public perception, with Europe moving towards stronger enforcement and the USA showing more mixed views.

Figure 6. Enforcement of digital privacy practices

3.6 Current and future outlook of digital privacy laws

Respondents generally perceive EU digital privacy laws more favorably compared to those in the USA. Figure 7 shows that the percentage of respondents rating the current state of EU digital privacy laws as good or excellent increased from 48% to 59% over the past year. Conversely, while 100% of respondents classified the USA's digital privacy laws as poor or fair in 2023, this figure decreased to 91% in 2024, with 9% now evaluating them as good or excellent.

When considering the future, optimism about the EU's digital privacy trajectory declined, with the percentage of optimistic respondents dropping from 49% to 36%. Opinions about the USA's future regulations remain divided, with 41% of respondents still expressing pessimism and 45% expressing optimism.

Figure 7. Enforcement of digital privacy practices

3.7 Policy making approaches in digital privacy protection

The pessimistic evaluation of privacy laws in the USA might be attributed to its fragmented privacy framework. As Figure 8 shows, 64% of respondents believe that digital privacy policy in the US should be established at the federal level, while 36% think it should be at both the state and federal levels. None of the respondents believe it should be determined solely at the state level, which reflects the current situation. In Europe, 3% of respondents think that privacy laws should be made exclusively at the EU member-state level, while 56% support an EU-level approach only and 41% favor a combination of both levels.

Figure 8. Policymaking approaches in digital privacy protection

3.8 Current and future outlook of organizational digital privacy practices

Regarding the overall assessment of organizations' digital privacy policies and practices (Figure 9), the current state remains negative, especially in the USA, where 95% of respondents rated it as poor or fair in 2024, compared to 91% in 2023. In Europe, 75% and 76% of respondents evaluated it negatively in 2024 and 2023, respectively.

The future outlook for organizational digital privacy is more optimistic in Europe than in the USA, though it declined from 2023 to 2024: in 2023, 55% of respondents viewed it as somewhat or very optimistic, but this dropped to 32% in 2024. Many respondents shifted to a neutral stance, with those indicating “neither” increasing from 17% to 41%. In the USA, the future outlook remains pessimistic, with 57% of respondents being very or somewhat pessimistic in 2023 and 55% in 2024, and those seeing it as somewhat or very optimistic decreased from 31% to 18%.

Figure 9. Current and future outlook of organizational digital privacy practices

3.9 Stakeholder ratings of organizations’ privacy protection performance

Regardless of region, public organizations such as country statistical agencies, tax authority and social security authority are better evaluated according to their privacy protection performance than private organizations, which include Meta, Google, Amazon, Visa, Mastercard, Apple, and Microsoft. 24% of the respondents for the USA and 18% for Europe evaluate the privacy protection performance of public institutions as excellent (Figure 10). On the other hand, 45% of the respondents from Europe and 34% from the USA evaluate the privacy protection performance of private organizations as poor. For detailed analysis for specific organizations we refer to our dynamic data visualization tool at https://privacyperceptions.org/results/

Figure 10. Organizations privacy protection performance ratings

3.10 Most important approach in protecting people’s digital privacy

In Wave 5, "enforcing rules about how data is processed, stored, and shared" emerged as the most crucial approach to protecting individuals' digital privacy for Europeans(Figure 11), with the highest percentage of respondents ranking it as their top priority (30%). However, in Wave 2, this focus on enforcement dropped to fifth place (16%, Figure 13), with the emphasis shifting to "designing and deploying privacy-preserving technology" as the primary priority (27%). In 2024, “regulating how data is processed, stored, and shared” was generally a lower priority, with 35% of respondents ranking it as least important (rank number 5) while in 2023, "giving individuals control over their data" was the least important with 34% of respondents ranking it as 5. Interestingly, in 2024, 36% of privacy experts in the USA stated that "giving individuals control over their data" is both the most important and least important aspect (Figure 12). While “giving individuals control over their data" was the least important approach in protecting people’s digital privacy in 2023 (47%, Figure 14), the most important were “designing and deploying privacy-preserving technology” and “regulating data processing, storage and sharing” with 29% of the respondents ranking them as number 1. Regional preferences also varied: in 2024, USA experts placed a higher emphasis on data control, with 36% ranking it as their top priority compared to 12% of European experts. Conversely, European experts favored technology-based solutions, with 28% ranking it number one compared to only 9% of USA experts. Processing regulations ranked consistently low for both groups, with more European experts (35%) than USA experts (23%) designating it as the lowest priority (number 5).

Figure 11. Wave 5 (September 2024) Ranking of Approaches to Protecting People's Digital Privacy in Europe

Figure 12. Wave 5 (September 2024) Ranking of Approaches to Protecting People's Digital Privacy in the USA

Figure 13. Wave 2 (August 2023) Ranking of Approaches to Protecting People's Digital Privacy in Europe

Figure 14. Wave 2 (August 2023) Ranking of Approaches to Protecting People's Digital Privacy in the USA

3.11 Impact of the EU AI Act on AI innovation

Proposed by the European Unit, the EU AI Act EU AI Act is the world’s first comprehensive attempt to regulate AI at establishing guidelines and restrictions on the development, deployment, and use of artificial intelligence within the EU.

The results indicate varied perceptions between Europe and the USA on the EU AI Act's impact on innovation. In Europe, opinions are relatively balanced, with 36% believing it will neither enable nor hinder AI innovation, while 30% feel it may hinder innovation, and 18% think it will enable it. In contrast, the USA shows a stronger inclination towards skepticism, with 41% of respondents suggesting the Act is more likely to hinder innovation, and only 5% seeing it as potentially enabling. Additionally, a notable 23% in the USA and 16% in Europe responded with "don't know," reflecting some uncertainty in both regions regarding the Act's potential outcomes. This contrast highlights regional differences in attitudes towards regulatory impacts on AI progress.

Figure 15. Impact of the European Artificial Intelligence Act on AI innovation