How Europe Lost the Web

A recent Foreign Affairs essay argues that Europe, in its decade-long campaign to civilize the internet, has fragmented the open web rather than protected it. The argument is correct. It is also not new. It is the oldest pattern in the catalog, running on fresh hardware.

The European Union did not build the internet. It is, however, the jurisdiction most determined to govern it — and it has done so by treating a borderless packet-routing system as if it were a territory with edges. Every major regulation of the past decade follows from that single category error. And category errors, repeated at the scale of a continent, don't stay small.

i · the compliance moat

Start with the artifact you touch every day: the cookie banner. It is the most-clicked object in the history of computing, and almost nobody clicking it has any idea what they are consenting to. That is not a malfunction. The banner is what happens when a privacy principle — real consent, freely given — gets translated into a mandate and then implemented by a billion websites optimizing to make you click "accept" and go away. The General Data Protection Regulation, in force since May 2018, aimed to give people control over their data. Its most visible legacy is a reflex: consent theater, performed daily, understood never.

That's the gentle version. The structural version is worse, and it runs in the opposite direction from the stated intent.

GDPR was sold partly as a check on surveillance-capital giants. What it actually did was build them a moat. Compliance is expensive — legal teams, data-protection officers, audit trails, consent infrastructure. A company with Google's or Meta's revenue absorbs that cost as a rounding error. A three-person startup or a mid-sized European competitor treats it as an existential tax. Studies of the post-GDPR ad-tech market found exactly what the mechanics predict: the dominant platforms held or gained share while smaller vendors were culled. Regulation aimed at the incumbents entrenched them. This is regulatory capture without the bribery — capture by structure, where the rule itself does the consolidating that a lobbyist used to have to pay for.

Then there's the bluntest signal of all. When GDPR took effect, hundreds of American news sites — the Los Angeles Times, the Chicago Tribune, a long roster of regional papers — simply geo-blocked European visitors rather than comply. They didn't fight it. They put up a wall and walked away. The "open internet" got a new feature that day: a region of the planet where part of the web returns an error page. The regulation meant to protect Europeans from data exploitation also protected them from reading the Arizona Daily Star. Both outcomes flow from the same design.

ii · the border that wasn't there

The deeper problem is jurisdictional. The internet's native logic is end-to-end and topological: packets route around damage, and "damage" includes control. There are no borders in the protocol stack. There are only nodes and the links between them. Trying to impose the shape of a legal jurisdiction onto that substrate is like legislating the tide schedule. You can pass the law. The water keeps its own counsel.

So Europe kept passing laws, each reasonable in isolation, each adding a wall.

The "right to be forgotten," born from the Court of Justice's 2014 ruling against Google in the Costeja case, established that a European could compel a search engine to delist lawful, truthful information about them. A coherent privacy instinct — and a direct collision with the network's indifference to borders, since the information stays online everywhere the EU's writ doesn't run. The 2019 Copyright Directive's Article 17 effectively mandated upload filters, pushing platforms to pre-screen everything users post — a censorship architecture built, sincerely, in the name of artists' royalties. Schrems II, in 2020, invalidated the legal bridge for transatlantic data flows, leaving every company moving data across the Atlantic in a state of managed illegality. And the recurring "chat control" proposals would mandate client-side scanning of private messages, which is to say: break end-to-end encryption to look for the bad thing, and trust that the hole you drilled will only ever be used by the good people.

Each of these is defensible on its own terms. Surveillance capitalism is a real harm; the EU is not hallucinating it. The point is not that Europe's regulators are villains. The point is that the aggregate of jurisdiction-shaped rules applied to a jurisdiction-less system produces precisely one outcome regardless of intent: fragmentation. The splinternet. A web where your rights, your access, and your encryption depend on which side of an invisible line your packets were born.

Brussels has a name for its own version of this story — the "Brussels Effect," the idea that EU rules become global defaults because it's cheaper to comply everywhere than to maintain two systems. That's the optimistic frame: Europe exporting standards. The pessimistic frame describes the same mechanism: Europe exporting fragmentation, and the rest of the network choosing walls over compliance whenever walls are cheaper. Both frames are true. Only one of them is on the brochure.

iii · the enclosure

Here is where the pattern stops being about technology and starts being about something much older.

This is enclosure. The English landlords who fenced the commons across the eighteenth and nineteenth centuries also had reasons — efficiency, improvement, the prevention of overgrazing. The commons was, in fact, sometimes mismanaged. And the cure was to convert a shared resource into bordered, owned, governed parcels, which is exactly what is happening to the web one directive at a time. The same logic recurs every time a state encounters a network it did not build and cannot fully see: license the printers, nationalize the spectrum, fence the field, scan the messages. The commons gets parceled in the name of protecting the people who used it freely.

Coherenceism has a phrase for the error: force over alignment. You can position yourself with the grain of a system — a surfer reading the wave — or you can impose your will against its structure and wipe out. Europe chose force. It treated a self-routing global commons as a territory to be administered, and the territory did what self-routing systems always do when you push against their topology: it routed around the obstruction, and the obstruction became a wall, and the open web became a little less open on every side of it.

The grim part is that the alternative was available. A regulatory approach grown from the network's own logic — privacy guarantees implemented at the protocol layer, interoperability mandates that increase exit rather than raise walls, rules that scale down to the startup instead of up to the incumbent — would have aligned with the substrate instead of fighting it. That's harder. It requires understanding the system before governing it. Tollbooths are easier. They always are.

So the forecast writes itself. More directives are coming, each well-intentioned, each adding a wall, each entrenching the giants it names as gatekeepers and culling the challengers it never mentions. The "Brussels Effect" will keep getting cited as a triumph by the people building the moat. And somewhere a teenager will hit an error page where a website used to be, and not even know that the open web was once the default — that the walls were added later, by people who were trying to help.

The empire didn't break the road. It just kept building tollbooths until the road wasn't worth taking.