The European Data Protection Board wrote to the European Commission on 31 July 2026 asking it to examine whether a US Supreme Court judgment delivered on 29 June has undermined the legal foundation of the EU-US Data Privacy Framework, the adequacy decision that allows thousands of American advertising, measurement and marketing technology companies to receive personal data from Europe without additional safeguards.

The letter is short. It runs to two pages, carries the European Commission registration reference Ares(2026)7540711 dated 31 July 2026, and is signed by Anu Talus, Chair of the European Data Protection Board. It is addressed to Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, at the Commission's Brussels address.

Its request is narrow, and that narrowness is the point. The EDPB does not ask for the framework to be suspended. It does not declare the adequacy decision invalid. It asks the Commission to look, and to report back.

What the EDPB actually asked for

According to the letter, the Board opens by thanking McGrath for engaging with EDPB members during the June plenary meeting, then states that judicial developments in the United States have occurred since that discussion which the Board considers important.

The operative paragraph is the last substantive one. According to the letter, "Given the potential consequences that the US Supreme Court's judgment may have in the EEA and its considerable significance for the EDPB, the EDPB asks the European Commission to closely assess whether this development affects the functioning of Commission Implementing Decision EU 2023/1795 and would welcome relevant actions, including the continued sharing of information with the EDPB in a timely manner."

Commission Implementing Decision (EU) 2023/1795 is the adequacy decision adopted on 10 July 2023. It is the instrument that permits an EEA-based advertiser, publisher or agency to send personal data to a self-certified US recipient without standard contractual clauses, binding corporate rules or a transfer impact assessment.

Caitlin Fennessy, Vice President and Chief Knowledge Officer at the International Association of Privacy Professionals, published the letter in a LinkedIn post and characterised it in measured terms. According to her post, "The letter is factual and not alarmist, but by citing these facts, the EDPB not only calls on the European Commission to take action, but adds their voice to the atmospherics that will inform the current Latombe case challenging the DPF on appeal before the Court of Justice of the EU." Her post also states that the letter follows a discussion across all data protection authorities at the most recent EDPB plenary meeting.

The judgment that prompted it

On 29 June 2026, the US Supreme Court delivered its judgment in Trump v. Slaughter, docketed as No. 25-332. According to the EDPB letter, that ruling overruled Humphrey's Executor v. United States, 295 U.S. 602 (1935).

The 1935 precedent had held that statutory protections enacted by the US Congress for Commissioners of the Federal Trade Commission did not violate the separation of powers under the US Constitution. Those protections limited presidential removal of FTC Commissioners to specified for-cause grounds, described in the letter as inefficiency, neglect of duty, or malfeasance in office.

The letter quotes the Court's reasoning at pages 2 and 27 of the judgment. According to the EDPB, the Supreme Court held that "the FTC has accumulated vast rulemaking, enforcement and adjudicatory powers" and that it "unquestionably exercises executive power, and must therefore be controlled by the Chief Executive, in whom such power is vested". The consequence, as the letter summarises it, is that executive officers are subject to the President's superintendence, including the power to remove them.

That is a domestic American constitutional holding about the structure of a domestic American agency. Its reach into European advertising law comes from a chain of legal citation rather than from anything the Court said about data.

Why FTC independence sits inside a European transfer rule

The chain begins with Article 45(2)(b) of Regulation (EU) 2016/679, the GDPR provision governing how the Commission decides whether a third country offers an adequate level of protection.

According to the letter, the EDPB "wishes to highlight that the existence and effective functioning of one or more independent supervisory authorities in the third country, with responsibility for ensuring and enforcing compliance with the data protection rules, is one of the key elements to be taken into account when assessing the adequacy of the level of protection in a third country". The Board adds that the same element is considered one of the keys to guaranteeing data subjects in the EEA an essentially equivalent level of protection in practice, and to securing cooperation with member state supervisory authorities.

The second link is the adequacy decision itself. According to the letter, the Commission, in the decision underpinning the framework, explicitly refers to the independence of the US authorities including the FTC, and to the fact that its five Commissioners may only be removed by the President for inefficiency, neglect of duty, or malfeasance in office. The EDPB cites paragraphs 58 to 60 of Implementing Decision (EU) 2023/1795 for that proposition.

The removal standard recited in a European adequacy decision as evidence of American oversight independence is, word for word, the standard the Supreme Court has now set aside.

Talus has been Chair of the EDPB since May 2023 and Finnish Information Commissioner since autumn 2020, according to her official biography published by the Board. Before those roles she was Deputy Information Commissioner, and prior to joining the Finnish data protection authority she spent more than ten years as Senior Adviser at the Ministry of Justice, where she led the national implementation of the GDPR in Finland and represented the Finnish government in the GDPR negotiations in Brussels. Her biography records a period at the European Commission's International Data Flows and Protection Unit within DG Justice and Consumers as a Seconded National Expert, and specialisation in cross-border data processing.

A second European voice on the same ruling

The EDPB is not the first European body to connect the June judgment to the framework. Austrian privacy group noyb had already written to the Commission on 30 June 2026 calling for an orderly withdrawal from the adequacy decision, arguing that the decision cites FTC independence more than 250 times, as PPC Land reported on 12 July. noyb stated it would file its own annulment action within weeks if Brussels did not act.

The difference between the two interventions is institutional rather than analytical. noyb is a litigant. The EDPB is the body that represents every data protection authority in the European Economic Area, and its letter carries the weight of a discussion held among all of them.

There was warning of the underlying constitutional question well before June. A Fifth Circuit concurrence in March 2026, in an unrelated enforcement matter concerning Intuit's TurboTax advertising, had flagged that the Supreme Court was weighing whether FTC commissioners could be shielded from removal. That same ruling vacated the FTC's in-house cease-and-desist order against Intuit on separate separation-of-powers grounds. Doubts about the framework's American oversight architecture stretch back further still, to January 2025 reporting on resignations at the Privacy and Civil Liberties Oversight Board.

The litigation running alongside

The framework has already survived one court challenge. On 3 September 2025 the General Court dismissed French politician Philippe Latombe's action for annulment in Case T-553/23, upholding the adequacy decision. That judgment partly rested on assumptions about the continued independence of US oversight bodies.

According to Fennessy's post, that case is now on appeal before the Court of Justice of the European Union. An appeal at that level is confined to points of law, which is precisely the register in which a change to the constitutional status of an oversight authority cited in the contested decision would be argued.

A separate reference, Case C-804/25, sits before the same court on whether the adequacy decision can cover FATCA-style tax data transfers, after the Brussels Court of Appeal referred thirteen questions in November 2025.

What happens procedurally is slower than it looks

The adequacy decision remains in force. It stays in force until the Commission repeals, amends or suspends it, or until the Court of Justice annuls it. Nothing in the EDPB letter changes the legal position of a transfer executed this week.

The mechanics of a Commission reassessment were addressed in the comment thread beneath Fennessy's post. According to Dr. Axel Spies, a German attorney and partner at Potomac Law who commented on the post, "It would not be an easy process. The commission would have to collect formal evidence and ask the US government for a statement."

Other practitioners read the direction of travel more sharply. According to Dominik Rapacki, chief executive of meetergo and CrabClear, who also commented on the post, "Schrems III is coming faster than we thought!"

Why the marketing industry is exposed here

Self-certification under the framework is not a legal curiosity for the advertising supply chain. It is load-bearing infrastructure.

Google began relying on the framework for certain EU-to-US transfers in its advertising services on 1 September 2023, and extended the same approach to Swiss and UK data flows in September 2024. A Dutch enforcement decision against Takeaway.com later limited its findings on Google Analytics transfers to the period before that date, treating 1 September 2023 as the point at which a valid adequacy decision resumed. Demand-side platforms have followed the same path: StackAdapt certified under the framework in February 2026, citing the removal of any need for standard contractual clauses.

If the adequacy decision were suspended or annulled, those transfers would not become unlawful automatically, but each would require a fallback mechanism assessed case by case. Standard contractual clauses under Article 46 remain available, as do certification schemes: the EDPB approved the Europrivacy transfer extension as a European Data Protection Seal on 15 April 2026, creating a certification-based route for transfers to non-EEA importers. Each of those routes carries a transfer impact assessment obligation that adequacy removes.

The commercial response to transfer uncertainty was already visible before this letter. AWS brought its European Sovereign Cloud to general availability in Brandenburg in January 2026, a project explicitly framed around European data control, following testimony in which Microsoft executives told the French Senate they could not guarantee protection of French data from US government access. On 7 July 2026, ten European media, telecom and ad tech companies launched the European Media Marketplace with data sovereignty as an explicit selling point.

The letter also lands in a period of unusually dense EDPB output affecting programmatic and AI-driven marketing. The Board adopted web scraping guidelines for generative AI on 7 July 2026, and on 17 July it asked the Commission for a legal basis allowing regulators to exchange confidential information across sectors, citing strain from AI-driven complaint volumes.

The open question

The Commission has not published a response. Under the terms of the 2023 decision it is obliged to monitor US legal developments on a continuing basis and may open a procedure to suspend, amend or repeal the finding if it concludes adequacy is no longer justified.

Whether the Trump v. Slaughter judgment crosses that threshold in the Commission's own assessment is now the question two European institutions, one Austrian litigant and one pending appeal are all pressing from different directions. The EDPB has framed it as a request for information. The framing does not narrow what the answer will have to address.

Timeline

Summary

Who: The European Data Protection Board, chaired by Anu Talus, wrote to Michael McGrath, the European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection. The subject is the US Federal Trade Commission and the European Commission's own adequacy decision.

What: A two-page letter asking the Commission to closely assess whether the US Supreme Court judgment in Trump v. Slaughter affects the functioning of Commission Implementing Decision (EU) 2023/1795, the EU-US Data Privacy Framework, and to keep sharing information with the Board.

When: The letter is dated 31 July 2026 and registered as Ares(2026)7540711. It responds to a Supreme Court judgment issued on 29 June 2026 and follows a discussion at the Board's June plenary meeting.

Where: Brussels, addressed to the European Commission, concerning data transfers from the thirty countries of the European Economic Area to the United States.

Why: Article 45(2)(b) GDPR treats the existence and effective functioning of independent supervisory authorities in a third country as a key element of any adequacy assessment. Paragraphs 58 to 60 of the 2023 decision rely on the FTC's five Commissioners being removable only for inefficiency, neglect of duty, or malfeasance in office. The Supreme Court has now held that FTC Commissioners are subject to presidential removal, removing the protection the European decision cited as evidence.