EU Regulation of Cyberspace Content: The Safer Internet Plan

When the internet became a mainstream reality in the late 1990s, European policymakers faced an urgent question: how do you regulate a borderless, rapidly evolving digital space without stifling its potential? The European Union’s answer was not to wait. Instead, it moved early and decisively – first with a plan to make the internet safer for children and families, and later with one of the most comprehensive data protection laws the world has ever seen. Together, the EU’s Safer Internet Action Plan and the General Data Protection Regulation (GDPR) represent a clear philosophy: freedom online must be matched with responsibility, protection, and accountability.

Why the EU stepped in: regulating cyberspace content 🔗

The internet grew faster than any legal framework could keep up with. By the mid-1990s, illegal content – including child pornography, hate speech, and racism – was spreading freely online, while parents, teachers, and policymakers had almost no tools to respond. The European Union recognized this as a political and social emergency. According to EUR-Lex, the EU Commission identified the circulation of illegal content and the protection of minors as issues requiring coordinated action at the European level – not just nationally. This led to one of the EU’s first major cyberspace interventions: the Safer Internet Action Plan.

The EU Safer Internet Action Plan (1999-2002) 🔗

Adopted on 25 January 1999 through Decision 276/1999/EC of the European Parliament and Council, the Safer Internet Action Plan was a four-year programme running from January 1999 to December 2002. It was allocated a total budget of €25 million and aimed to promote safer use of the internet while encouraging an environment favourable to the development of the internet industry across Europe.

The plan was built around three main action lines, each targeting a different layer of the internet safety problem.

Action line 1: creating a safer environment through hotlines and self-regulation 🔗

The first and arguably most impactful action line focused on establishing a European network of hotlines – reporting channels where members of the public could flag illegal internet content. According to the European Commission’s mid-term evaluation, hotlines were designed to receive complaints, screen them, and pass verified reports on to the appropriate body – police, internet service providers, or a correspondent hotline in another country. The hotlines were coordinated through the INHOPE Association, which attracted active participation not just from European states but also from the United States and Australia, making it an early model of international cooperation against illegal online content.

Self-regulation was the other pillar of this action line. Rather than imposing heavy government control, the EU encouraged the technology and content industry to develop codes of conduct, best practices, and internal monitoring schemes – particularly for content involving child pornography, racism, and anti-Semitism. The Commission’s evaluation noted positive developments in industry self-regulation during the programme, though it expressed disappointment at the overall level of industry involvement, finding that many companies were slow to adopt formal self-regulatory structures.

Action line 2: developing filtering and rating systems 🔗

The second action line addressed the need for technical tools that could empower users – especially parents – to control what content reached their households. The plan funded research and development of filtering software and supported the creation of an international rating system that could classify online content based on its nature and suitability for different audiences. The goal was to allow users to block or restrict content without requiring legal prohibition.

However, progress in this area was slow. Independent evaluators acknowledged that filtering and content rating systems remained an important element in making the internet safer, particularly for minors, but found the progress reached in this field unsatisfactory. Parents had too little knowledge of how to use filtering tools, and the technology itself struggled to keep pace with the volume and diversity of online content. This challenge would continue to define internet governance debates for years to come.

Action line 3: raising awareness among parents, teachers, and children 🔗

The third action line centred on education and public awareness. The programme encouraged awareness campaigns targeting parents, teachers, social workers, and others working with children, helping them understand both the benefits and risks of internet use. National “awareness nodes” were established across EU Member States to carry this message at a local level.

By the close of the first phase (1999-2002), 37 projects had been selected for funding, covering hotlines, awareness campaigns, and filtering research, with approximately €13.37 million spent. The programme was later extended through 2004 and eventually succeeded by the Safer Internet Plus programme (2005-2008). Over time, the EU came to be recognized internationally as a pioneer in identifying illegal and harmful internet content as a serious political issue, with its Safer Internet model adopted by countries across Asia-Pacific, North America, and Latin America.

The General Data Protection Regulation (GDPR) 🔗

While the Safer Internet Action Plan focused on protecting users from harmful content, the challenge of protecting personal data demanded a different kind of intervention altogether. As the internet matured into a commercial ecosystem built on the collection and monetisation of personal information, the EU’s existing Data Protection Directive of 1995 became increasingly inadequate. As technology advanced in the early 2000s and data breaches became more common, the EU recognised the need for a comprehensive data protection law.

The result was the General Data Protection Regulation (GDPR) – widely described as the toughest privacy and security law in the world. Adopted by the European Parliament and Council on 14 April 2016, it came into full effect on 25 May 2018, giving organisations a two-year transition period to align their practices with its requirements. It applies not only to EU-based companies, but to any organisation anywhere in the world that processes the personal data of people located in the EU.

Core principles of the GDPR 🔗

At its foundation, the GDPR establishes several core principles that govern how personal data must be handled. Under Article 5, personal data must be processed lawfully, fairly, and transparently; collected for specified and legitimate purposes; limited to what is necessary; kept accurate; stored only as long as needed; and processed securely. These principles, taken together, fundamentally shift the balance of power – placing the individual, not the organisation, at the centre of data governance.

A key addition is the principle of accountability: organisations must not just comply, but actively demonstrate their compliance through documentation, staff training, and data processing agreements with third-party vendors.

Rights granted to individuals under the GDPR 🔗

One of the most significant contributions of the GDPR is the extensive set of rights it grants to individuals, referred to in the regulation as “data subjects.” Under the GDPR, individuals have a right of access to their personal data, a right to rectify inaccuracies, a right to have personal data erased in certain cases, a right to restrict processing, a right to data portability, a right to object to processing, and a right not to be subject to automated decision-making including profiling.

The right to be forgotten (erasure) and data portability – allowing users to receive their data in a machine-readable format and transfer it between services – were especially new and significant. They gave individuals real, practical tools to control their digital footprint in ways that had simply not existed before.

Consent, data breaches, and enforcement 🔗

The GDPR also overhauled the rules around consent. Consent must be freely given, specific, informed, unambiguous, and in plain language – pre-ticked boxes and bundled consent clauses no longer meet the standard. Organisations must be able to prove that valid consent was obtained from each individual whose data they process.

In the event of a data breach, the GDPR imposes strict notification timelines. Organisations must notify the relevant data protection authority within 72 hours of becoming aware of a breach, provided it is likely to pose risks to individuals’ rights and freedoms. Affected individuals must also be informed without undue delay when the risk to their rights is high.

The penalties for non-compliance are substantial. Businesses that violate the GDPR can be fined up to €20 million, or 4% of their worldwide annual revenue for the prior financial year, whichever is higher. These fines are not theoretical – major corporations including Meta and Google have faced enforcement actions running into hundreds of millions of euros since the regulation came into force.

The global reach of the GDPR 🔗

Perhaps the most transformative aspect of the GDPR is its extraterritorial reach. The GDPR applies to all non-EU businesses that process personal data of EU citizens relating to the offering of goods or services to them, or monitoring of their behaviour within the EU. This effectively means that any company, anywhere in the world, that serves EU users must comply. It has driven a global shift in how businesses approach data protection, with many adopting GDPR-aligned policies as their global standard. Comparable laws – including the California Consumer Privacy Act (CCPA) in the United States – have drawn directly from the GDPR’s framework.

From hotlines to the Digital Services Act: a continuing journey 🔗

The Safer Internet Action Plan and the GDPR were not the end of the EU’s regulatory story – they were its opening chapters. In 2022, the EU enacted the Digital Services Act (DSA), which entered into full force in February 2024. The DSA is the world’s first digital regulation that makes online platforms – from social media networks to search engines to marketplaces – directly accountable for the content posted on them. It introduced obligations on content moderation transparency, algorithmic accountability, and the protection of minors, building directly on the principles first explored in the Safer Internet programme two decades earlier.

Taken together, the EU’s regulatory journey – from a €25 million action plan in 1999 to the globally consequential GDPR and DSA – reflects a consistent and evolving commitment: that the digital space must operate within a framework of rights, transparency, and accountability, not just technological possibility.

What do you think? As digital platforms become more integrated into daily life, should internet users have more direct control over how their data is collected and used by global tech companies – and what role should governments play in enforcing those standards? And given that the EU’s approach has influenced privacy laws across the world, does a single regional regulatory framework set a fair standard for the entire global internet?

References

1. https://eur-lex.europa.eu/EN/legal-content/summary/action-plan-for-a-safer-internet-1999-2004.html
2. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52003DC0653
3. https://eur-lex.europa.eu/legal-content/ET/TXT/?uri=COM:2002:0152:FIN
4. https://eur-lex.europa.eu/legal-content/HR/TXT/?uri=CELEX:52006DC0663
5. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52008SC0242
6. https://pro.bloomberglaw.com/insights/privacy/the-eus-general-data-protection-regulation-gdpr/
7. https://gdpr.eu/what-is-gdpr/
8. https://gdpr-info.eu/art-5-gdpr/
9. https://www.lexology.com/library/detail.aspx?g=5ae76660-9770-4718-9010-6657a9351496
10. https://digital-strategy.ec.europa.eu/en/policies/digital-services-act
11. https://www.consilium.europa.eu/en/policies/digital-services-act/