A national police force has, for the first time to my knowledge, opened a criminal investigation into the deployment of adtech surveillance to a person's device without consent. It has taken eighteen years.
On 27 April 2026 I lodged a formal complaint with Malta's Information and Data Protection Commissioner against Anthropic. The IDPC has now confirmed in writing that no Maltese citizen has any protection under the ePrivacy Directive against any tech company not established in Malta. That is a direct breach of Articles 7 and 47 of the EU Charter, of Article 19(1) TEU, and of Malta's obligations under Directive 2002/58/EC. This piece walks through the IDPC's correspondence in full, the 2009 Phorm precedent in which the European Commission opened infringement proceedings against the United Kingdom for an analogous failure, and why Malta has now made an Article 258 TFEU complaint to the Commission unavoidable.
