After the great excitement of AoIR 2025 in Rio de Janeiro, I’m now at my final stop on this conference trip, at the ZeMKI 20th anniversary conference in Bremen which promises to be an equally stimulating event. The theme here is “20 years into the future”, and we start with a keynote by the great José van Dijck. Her focus is on digital sovereignty in Europe under the current and emerging global circumstances.
This responds to the platformisation of public communication in society; public participation via platforms is possible only after signing up to one or more (US-headquartered) platforms, for instance. And this begins even in classrooms, with public schools relying on software from major corporations like Microsoft, Google, and Apple; it extends to public information, with the outsized role of Google or Bing in the online search market; and major cloud providers carve up the backbone services to support any of these activities between them.
Five companies govern the global distribution of data and algorithms – Google, Apple, Meta, Amazon, and Microsoft. They have turned public spaces into private digital environments, and control the infrastructures and data flows they rely on; what is the impact of this on European societies, and how can we safeguard public values under these circumstances? How is this affected by recent changes in the online ecosystem, with the rise of Chinese competitors like Baidu, Bytedance, Alibaba, Tencent, and Huawei.
While these two systems are ideologically far apart, they also mirror each other: in the US system, data are owned by corporations, enabling corporate surveillance, and libertarian capitalism; in the Chinese system, data are owned by the state, enabling state surveillance, and operating under and state capitalism. European societies continue to be highly dependent on American Big tech platforms and infrastructures, but COVID-19, the GenAI revolution, and the actions of the second Trump administration have all been wake-up calls encouraging the European Union to explore pathways towards reducing these dependencies.
This dependence extends across the entire technology stack: from user-facing applications (software as a service) through intermediary gatekeeping platforms (platforms as a service) to the fundamental digital infrastructure (infrastructure as a service). These are vertically integrated, with single Big Tech providers each offering a complete cloud environment across all three stack layers, based around a single sign-on user ID. Increasingly, this also includes emerging generative AI services. Such integration is controversial, and potentially conflicts with existing consumer protection and anti-monopoly legislation.
At present, American companies dominate most of these stack layers, with China increasingly pushing into these markets as well; European companies play only a very marginal role. This threatens Europe’s digital sovereignty and data safety; it hampers the autonomy of public organisations as guardians of public values; and it limits innovation, economic investment, consumer protection, and the attraction of talent in private and public sectors. Calls for digital independence are becoming louder, but mostly out of geopolitical and economic concerns related to the Trump administration and a lack of commercial competitiveness – concerns about impacts on public values should be just as prominent.
Two key values that are frequently highlighted here are privacy and security, with US rhetoric often emphasising security (e.g. from Chinese state influence) while Europe emphasises privacy (of personal and commercial data); but other values like transparency (e.g. of algorithms) and accuracy (e.g. of information), and societal values like fairness, inclusivity, autonomy, accountability, democratic control, and sustainability should be just as prominent in public debate.
Such public values are constantly negotiated between actors representing states, markets, and civil society, with multi-stakeholder organisations connecting them all. Civil society organisations tend not to control any digital infrastructures, though, so they have considerably less actionable power in such negotiations. Who should act here, then; what mechanisms (protective, like regulation; or offensive, like innovation) are available to them?
What can European states do, then? There are four key strategies available here: regulate, negotiate, invest, and stimulate. All of these are available to Europe, contrary to common clichés about its policy processes. Regulation is a well-established strength in Europe: in recent years, this includes the General Data Protection Regulation, the Digital Markets Act, the Digital Services Act, the Digital Operation Resilience Act, the Artificial Intelligence Act, and the EU Data Act and European Data Strategy, but enforcement often remains underfunded and threatened by corporate lobbying.
A second strategy is negotiation to enforce compliance with such regulation. Google, Microsoft, and Zoom have all violated the GDPR by using student data, for instance; the Dutch state has recently won a court case against them for these violations, and thereby begun to enforce GDPR compliance not only in the Netherlands, but across Europe. The introduction of Copilot as a built-in feature in Microsoft products will serve as the next battleground.
Third, Europe can invest, in both funding and principles. This means directing public expenditure towards innovation that benefits people rather than only tech companies (e.g. by prioritising sustainable AI), and thereby stimulate the development of a public infrastructure stack that prioritises interoperability, data portability, data integrity, open standards and open-source softwares, sustainability, and other desirable features. This ‘Eurostack’ can substantially boost European digital sovereignty and reduce dependence on problematic Big Tech operators.
Finally, and importantly, civil society actors can also play a critical role by promoting alternatives to Big Tech tools. These might include distributed, federated, open-source platform solutions, and various failures should be expected along the way; such tools may never completely replace the Big Tech solutions, but can show smarter and more convenient ways of operating.
The EU and its states should regulate and innovate on the basis of public values, and make them conditional for investments, to promote digital sovereignty and the infrastructures that support it; civil society should collaborate too in order to innovate, invest, and negotiate, support user experiments with alternative platforms, and develop strategies for the creation of independent, open, public technology stacks. This can cement public values in the digital infrastructures that support independent, fair, and open digital societies.
