Policies, Practices, and Priorities: Transatlantic Experts’ Perceptions on AI and Digital Privacy (Wave 7)
Download and Citation
Citation:
[September 2025].
Executive Summary
Wave 7 of the Transatlantic Privacy Perceptions (TAPP) Panel, conducted from September 2025 to October 2025, presents insights from 57 privacy experts across Europe and the United States on the current state of digital privacy laws, their enforcement, and organizational practices. The results point to a growing divergence in views across the Atlantic, particularly regarding regulatory effectiveness, innovation, and expectations for future developments.
Transatlantic Gap Continues to Widen
Perceptions of digital privacy laws differ between the United States and Europe. In 2025, 96% of US respondents rated the current state of privacy laws as poor or fair, and optimism for improvement dropped to 4%, down from 45% in 2024. In Europe, 58% rated current privacy laws as good or excellent in 2025. However, expectations for future progress have declined, with more respondents shifting toward a neutral or cautious outlook.
Regulation and Innovation: Opposing Views
European experts increasingly view privacy regulation as a driver of innovation in privacy-preserving technologies. In 2025, 58% reported that laws encourage such innovation, up from 41% in 2024. The trend in the US moved in the opposite direction: only 24% expressed this view in 2025, down from 50% in 2024, with most respondents selecting a neutral response regarding the effect of regulation on innovation.
Scope and Enforcement Remain Areas of Debate
In the US, a stable and large majority (92% in 2025) continue to report that privacy laws cover fewer areas than needed. European responses are more varied. While the most common view remains that laws cover fewer areas than needed, the share of respondents perceiving them as too broad has increased over time.
Perceptions of enforcement also diverged further in 2025. In Europe, around 70% of respondents consistently view enforcement as somewhat or mostly effective. In the US, the share expressing confidence in enforcement declined, with two-thirds reporting that practices are enforced only a little or not at all.
Preferences for Policymaking Levels Differ
In 2025, 65% of US respondents preferred a combined federal-and-state approach to privacy policymaking, reversing the federal-only preference recorded in 2024. In Europe, views have remained stable, with 65% favoring EU-level policymaking only and no support for a member-state-only approach.
Organizations Viewed as Underperforming on Privacy
Organizational privacy practices continue to receive low ratings in both regions. In 2025, 92% of US and 79% of European respondents rated current practices as poor or fair. Looking ahead, pessimism rose in the US (73%), while Europe saw a shift toward neutral expectations. Public agencies received the highest privacy protection ratings, followed by traditional private companies, with private AI firms receiving the lowest ratings.
1 Introduction
In the privacy arena, actors from academia, policy, law, tech, journalism, and civil society influence debates, policies, and practices. The size and diversity of sectors, regional, legal, and cultural contexts in the privacy arena presents a challenge for systematically synthesizing its members' conversations and opinions. The Transatlantic Privacy Perceptions (TAPP) project aims to help companies and policymakers learn more about current and future digital privacy concerns and how they can best be addressed through legislation and technology. To this end, it follows and analyzes developments in privacy actors’ attitudes, expectations, and concerns around current and emerging issues in digital privacy over time. It is an interdisciplinary research project in privacy, survey methodology, and complex sampling techniques at the Universities of Maryland (UMD) and Munich (LMU).
Conducted since 2022, the survey gathers insights from privacy experts across the United States and Europe to assess the state of data protection, the performance of tech companies, and the impact of artificial intelligence (AI) on privacy policies. The focus of Wave 7 of the Transatlantic Privacy Perceptions (TAPP) Panel, conducted between 17 September 2025 and 15 October 2025, is the Panel’s annual module on the current state and effects of privacy laws, regulations, and practices - particularly those related to digital privacy - within the context of respondents’ respective countries of work. Respondents are asked to reflect on how these privacy frameworks influence their business operations, highlighting both challenges and areas of progress.
Wave 7 is the TAPP trend analysis that repeats survey items previously asked in Wave 5 (September 2024) and Wave 2 (August 2023). The survey was programmed and distributed using Qualtrics, ensuring compliance with both the EU General Data Protection Regulation and the University of Maryland’s ethical standards.
2 Respondents Profile
Fifty-seven individuals provided complete or partial responses, the majority of which were returning respondents (Table 1). An additional 13 individuals began but did not complete the Wave 7 survey; we therefore exclude these individuals from analysis. Compared to the previous trend wave, the number of new respondents was lower: seven valid respondents in Wave 7 compared to 17 in Wave 5.
Table 1. Survey participation by respondent type
Of the 57 included respondents, 24 (42%) reported greater familiarity and knowledge with the privacy context in the United States (US), 24 with Europe, and seven with other regions, specifically Brazil and Canada. Due to the small number of experts from regions other than the US and Europe, we focus on the 50 respondents from these two areas only.
Figure 1. US and Europe respondents' composition by sector
In terms of professional background, the majority (56%) are from academia with an additional 20% evenly divided between non-profits / NGOs / Think tanks, and from law (Figure 1). This marks a shift towards more academic respondents; in the previous trend wave (Wave 5), only 35% of respondents were from academia, with an additional 28% of respondents evenly divided between the tech industry, and the private sector outside the tech industry. From Figure 2, we note that 46% of respondents have worked in the privacy field for more than 10 years, and none of them have worked for less than three years. This likely reflects the experience of our respondents, as the previous trend wave (Wave 5, September 2024) included nine percent with respondents of less than three years experience.
Figure 2. Respondents' composition by years of experience with privacy
3 Results
3.1 Balance of interest in digital privacy laws
The comparison of interest in digital privacy laws reveals relevant regional differences. In Europe, public perception has shown significant fluctuation (Figure 3). While the percentage of respondents believing laws favor individual users increased from 45% in 2023 to 75% in 2024, it fell again to 46% in 2025, returning to the Wave 2 (August 2023) level.
Conversely, in the US, the perception that laws favor businesses remains overwhelmingly high and consistent, at 92% in 2023, 86% in 2024, and 85% in 2025. This underscores the divergent perspectives on privacy laws on either side of the Atlantic. While sentiment in the US remains stable in its view of a business-friendly legal environment - despite the introduction of state-level consumer privacy protection - the proportion of Europeans who believe laws favor individual users has remained substantially higher than in the US across all three years (Figure 3).
Figure 3. Balance of interest in digital privacy laws
3.2 Influence of laws on the development of privacy-preserving practices and technologies
Wave 7 data also reveals a divergence in how the impact of privacy laws on innovations is perceived in Europe versus the US, with trends observed in 2024 reversing in 2025 (Figure 4). Despite a reduction in 2024 from 50% in 2023 to 41% in 2024, in 2025, 58% of the European experts think that digital privacy laws and regulations in Europe strongly or somewhat encourage innovation and development of privacy-preserving practices and technologies in organizations. Alongside this trend, the view that these laws discourage innovation continued to steadily decline, falling to 17%.
However, in the US, the optimism seen in 2024 has dissipated. The percentage of respondents who believe privacy laws encourage innovation and development of privacy-preserving practices and technologies in organizations dropped from 50% in 2024 to 24% in 2025, returning to its 2023 level. Opinion shifted dramatically towards neutrality, with the "neither encourage nor discourage" category soaring from 28% in 2023 and 14% in 2024 to 56% in 2025. In conclusion, European experts increasingly view privacy regulations as a catalyst for innovation, while the prevailing sentiment among US experts has shifted from a mix of strong opinions to one of overwhelming neutrality (Figure 4).
Figure 4. Influence of laws on the development of privacy-preserving practices and technologies
3.3 Comprehensiveness of digital privacy laws
There is a notable difference between stakeholders in Europe and the US regarding whether digital privacy laws cover the necessary areas (Figure 5). In Europe, while the belief that laws cover “fewer areas than needed” remains the most common response, it has decreased from a majority of 58% in 2023 to 43% in 2024 and 46% in 2025. Concurrently, there is a growing sentiment that the laws are either adequate or even excessive in areas: the perception that laws are too comprehensive (“more areas than needed”) has shown a steady increase over the period, growing from 14% in 2023 to 18% in 2024 and 21% in 2025, while the view that they cover “all areas needed” moved from 28% in 2023, 39% in 2024 and is 33% in 2025.
In the US, there is a stable consensus that current digital privacy laws are not comprehensive enough: the vast majority of respondents believe current laws cover "fewer areas than needed," with this view holding at 94% in 2023, 95% in 2024, and 92% in 2025. Similarly, very few respondents feel current laws are adequate ("all areas needed" registered between 4-6%), and the belief that the laws are too comprehensive ("more areas than needed") only registered a minimal 4% in 2025. This indicates a persistent and widespread demand for more extensive privacy legislation in the US.
Figure 5. Comprehensiveness of digital privacy laws
3.4 Enforcement of digital privacy practices
The data on the perceived enforcement of digital privacy practices reveals a growing divergence between Europe and the United States, with European confidence remaining stable while American confidence has notably declined (Figure 6). In Europe, a strong majority of respondents consistently express confidence that digital privacy practices are being enforced. The combined percentage of those who feel practices are mostly or somewhat enforced has remained stable at approximately 70% across all three years (73% in 2023, 70% in 2024, and 70% in 2025). While the overall confidence level is steady, there was a shift in its composition; a spike in respondents feeling practices were mostly enforced in 2024 (27%) dropped in 2025 (12%).
The perception of enforcement in the US has meanwhile dropped sharply. After two years of being evenly split—with 50% expressing high confidence (mostly or somewhat) and 50% expressing low confidence (a little or not at all) in both 2023 and 2024—there is a sharp shift in 2025. In 2025, the proportion of respondents with high confidence dropped to 34% (15% mostly and 19% somewhat). Correspondingly, the view that practices are poorly enforced became the clear majority, with 66% now believing they are enforced a little (62%).
Figure 6. Enforcement of digital privacy practices
3.5 Current and future outlook of digital privacy laws
The current state and future outlook of digital privacy laws and regulations reveal a stark chasm between European and American perceptions. A majority of the privacy experts in the European scenario view their current enforcement positively. The excellent/good rating had held strong at 58% in 2025, aligned with 59% in 2024 and 49% in 2023 (Figure 7). However, this satisfaction with the present state does not translate to future confidence.
The view from the experts in the US context is defined by near-universal dissatisfaction. Perceptions of the current state are overwhelmingly negative, with the percentage of privacy experts rating it as fair or poor holding at 96% in 2025, consistent with 91% in 2024 and 100% in 2023 (Figure 8). Effectively, almost no experts in the US context have viewed the current state of privacy laws and regulations as excellent or good over the three-year period. This negativity has now extended to the future outlook, in what is the most dramatic shift in the data. After showing some optimism in 2024 (45%) and in 2023 (38%), optimism collapsed to 4% in 2025. This sentiment was almost entirely transferred to pessimism, which surged from 41% to 81%, indicating a profound loss of confidence in the future of American privacy enforcement.
Figure 7. Current state and future outlook of digital privacy laws and regulations in Europe
Figure 8. Current state and future outlook of digital privacy laws and regulations in US
3.6 Policymaking approaches in digital privacy protection
The results of Wave 7 show that results from Europe remain relatively stable, with 65% of respondents supporting an EU-level approach only, and 35% favor a combination of both levels (Figure 9). However, in the US, 35% of respondents believe that a digital privacy policy should be established at the federal level, while 65% think it should be at both the state and federal levels. This is contrary to the results in 2024, where the opposite is true, where 64% of respondents believe that a digital privacy policy in the US should be established at the federal level, while 36% think it should be at both the state and federal levels. Therefore, no clear trend is visible here; however, it can be stated that no respondent from the US thinks it should be at the state level alone.
Figure 9. Policymaking approaches in digital privacy protection
3.7 Current and future outlook of organizational digital privacy practices
Regarding the overall assessment of organizations' digital privacy policies and practices (Figure 10), the current state remains negative in Europe for 2025 at 79% for a poor or fair rating, compared to 75% for 2024 and 76% for 2023. Similarly, while there is a small increase in very or somewhat pessimistic responses with regard to the future outlook practices, the percentage of respondents reporting very or somewhat optimistic responses has dropped from 55% in Wave 2 (2023) to 21% in Wave 7.
Figure 10. Current and future outlook of organizational digital privacy practices in Europe
In the US, 92% of respondents rated the current state of organizational digital privacy practices as poor or fair in 2025, remaining steady compared to 95% in 2024 and 91% in 2023 (Figure 11). However, pessimism regarding future practices has increased from 57% in Wave 2 (2023) to 73% in Wave 7 (2025).
Figure 11. Current and future outlook of organizational digital privacy practices in US
3.8 Stakeholder ratings of organizations’ privacy protection performance
Regardless of region, public organizations such as country statistical agencies, tax authority, and social security authority are better evaluated according to their privacy protection performance than private companies. Here, a differentiation can be made between private companies and private AI companies, which are mainly known for their AI products.
The ratings between respondents for Europe and the US show similar results across all the depicted sectors, with higher ratings for government agencies. In Europe, 22% of the respondents evaluate the privacy protection performance of public institutions as excellent, compared to 19% for the US (Figure 12a). On the other hand, 54% of the respondents from Europe and 54% from the US evaluate the privacy protection performance of private organizations as poor. Similarly, 76% of respondents from Europe and 81% from the US evaluate the privacy performance of private AI organizations as poor.
Figure 12a. Organizations' privacy protection performance ratings - September 2025
However, ratings from Wave 7 are markedly lower compared to Wave 5 results (2024; Figure 12b), for private companies and government agencies in both Europe and the US. No comparison can be made with private AI companies, as they were not part of the panel survey in 2024.
Figure 12b. Organizations privacy protection performance ratings - September 2024
For the first available comparison of private AI organizations, European respondents rate these organizations more positively overall than American respondents. Within the European context (Figure 13), Anthrophic performed better compared to its peers, with 16% of privacy experts in the European context classifying it as excellent or good, and another 50% rating it as fair. Of the other private AI organizations, only Mistral AI receives a majority positive rating, with 54% of European respondents rating it as fair compared to 46% as poor.
Figure 13. Private AI organizations privacy protection performance ratings in Europe - September 2025
However, in the US (Figure 14), perceptions show slightly more differentiation in their ratings, though the overall sentiment remains overwhelmingly negative, with no private AI companies rated as better than good, and no companies receiving less than a 70% poor rating (Anthropic). The detailed plots regarding other companies and government agencies are displayed in the Appendix.
Figure 14. AI organizations privacy protection performance ratings in US - September 2025