The EU-US Data Privacy Framework is facing renewed legal scrutiny after privacy advocacy group noyb announced plans to challenge the agreement following a recent U.S. Supreme Court decision involving the Federal Trade Commission.

In a letter sent to the European Commission on June 30, noyb founder Max Schrems argued that the Supreme Court's ruling in Trump v. Slaughter undermines a central requirement of the EU-US Data Privacy Framework: independent oversight of personal data transfers between the European Union and the United States.

The case concerns the U.S. Supreme Court's interpretation of presidential authority over independent executive agencies. According to noyb, the decision means that agencies such as the FTC can no longer be considered constitutionally independent, a status the European Commission relied upon when adopting the framework in 2023.

Why the FTC Matters to the Framework

The EU-US Data Privacy Framework, formally adopted through Commission Implementing Decision EU 2023/1795, allows certified U.S. companies to receive personal data from the EU under a system deemed to provide adequate privacy protections.

EU law requires that data protection oversight be carried out by an independent authority. The FTC has been the primary U.S. regulator fulfilling that role under the framework.

In its letter, noyb said the European Commission's adequacy decision references the FTC hundreds of times and treats the agency as the key enforcement body for privacy obligations.

Schrems argued that if the FTC's independence is no longer guaranteed, the legal foundation supporting the adequacy decision may no longer satisfy EU constitutional requirements.

Potential Impact on Data Transfers

The challenge does not immediately suspend transatlantic data flows. The European Commission's adequacy decision remains in force unless it is repealed by the Commission or annulled by the Court of Justice of the European Union.

However, the development could create uncertainty for companies that rely on the framework to transfer customer and employee data between Europe and the United States.

noyb is also questioning other oversight mechanisms tied to the agreement, including the Data Protection Review Court created under Executive Order 14086 and the Privacy and Civil Liberties Oversight Board.

The organization argues that these bodies may also be affected by the Supreme Court's reasoning because their independence depends on executive or statutory arrangements that could now face constitutional challenges.

Background: A Long-Running Dispute

The EU-US Data Privacy Framework is the third major attempt to create a legal basis for EU-U.S. data transfers.

Earlier arrangements, Safe Harbor and Privacy Shield, were both struck down by the Court of Justice of the European Union in the Schrems I and Schrems II judgments.

Those rulings focused on U.S. surveillance laws and the lack of effective judicial remedies for EU citizens.

The current framework was introduced in 2023 after negotiations between the European Commission and the Biden administration.

What Happens Next?

noyb has urged the European Commission to begin planning an orderly transition away from the current arrangement rather than waiting for a court ruling.

The group says it intends to file a formal lawsuit challenging the adequacy decision if the Commission does not act.

Legal experts expect any court challenge to take several years before reaching a final judgment.

For now, the EU-US Data Privacy Framework remains valid, but the Supreme Court's decision has reopened a debate that many businesses hoped had been settled.

The Federal Trade Commission (FTC) has intensified enforcement of the TAKE IT DOWN Act, issuing warning letters to multiple online platforms and AI-powered “nudify” services over alleged noncompliance with new federal requirements aimed at removing nonconsensual intimate images from the internet. The FTC said the law, which officially became enforceable on May 19, 2026, requires covered platforms to provide users with a clear process to request the removal of intimate photos or videos shared without consent. Under the legislation, companies must remove the content and known identical copies within 48 hours of receiving a valid request. The agency confirmed it has sent warning letters to 12 companies operating so-called “nudify” tools. These AI-powered services can digitally manipulate clothed images to generate fake sexualized content without an individual’s consent. According to the FTC, the companies appeared to be violating the TAKE IT DOWN Act by failing to provide victims with a mechanism to request the removal of such content from their platforms.

FTC Says TAKE IT DOWN Act Compliance Is Mandatory

FTC Chairman Andrew N. Ferguson said the agency plans to take an aggressive approach toward enforcement, particularly in cases involving children and AI-generated abuse content. “Today we’re demonstrating just how serious we are about protecting the public, especially children, from abusive online conduct,” Ferguson said. “Platforms no longer have any excuses. They must comply with their obligations under the TAKE IT DOWN Act or face the consequences.” The FTC warned that companies failing to comply with the law could face legal action and civil penalties of up to $53,088 per violation. The TAKE IT DOWN Act was signed into law in May 2025 by Donald Trump after being championed by Melania Trump. The legislation provided businesses with a one-year compliance period before enforcement officially began this month.

FTC Launches Complaint Portal for Victims

As part of the rollout, the FTC also launched a new reporting portal, TakeItDown.ftc.gov, allowing victims and survivors to submit complaints against platforms that fail to remove nonconsensual intimate images or do not provide a proper reporting process. The portal is designed to help individuals report cases involving revenge pornography, AI-generated intimate images, and other forms of digital exploitation. FTC officials said the website will support enforcement efforts by collecting complaints directly from victims affected by noncompliant platforms. Ferguson stated that AI-generated exploitation has become an increasing concern for regulators and families alike. “In the age of AI, anyone can be targeted, and that becomes even more appalling if children are involved,” Ferguson said. “The TAKE IT DOWN Act empowers families and provides the FTC with an effective tool to protect minors against this form of abuse.”

Major Tech Platforms Also Warned

Before the enforcement deadline, the FTC also contacted several major technology companies to remind them of their obligations under the TAKE IT DOWN Act. The letters were sent to companies including Alphabet, Amazon, Apple, Meta, Microsoft, Reddit, TikTok, Snapchat, and X, among others. The agency also issued compliance guidance for businesses to help platforms establish removal procedures and meet the 48-hour takedown requirement. The FTC’s latest actions reflect growing regulatory concern over AI-generated abuse content and the increasing use of digital manipulation tools that can create realistic fake intimate images.

Rising Focus on AI-Generated Exploitation

The enforcement of the TAKE IT DOWN Act comes amid rising global concern about deepfake abuse, online extortion, and nonconsensual image sharing powered by artificial intelligence. Cybersecurity and online safety experts have repeatedly warned that AI-generated exploitation tools are becoming easier to access, allowing malicious actors to create convincing fake images with minimal technical knowledge. Regulators are increasingly focusing on how platforms respond to these threats, particularly when victims struggle to remove harmful content quickly. With enforcement now underway, the FTC signaled that companies failing to implement clear reporting and takedown processes could face significant legal and financial consequences under the new law.