Max Schrems, an Austrian lawyer and privacy activist, exemplified the performance of compliance rituals when he launched his second case against Facebook on 7 April 2016. This case led to the landmark ruling by the Court of Justice of the European Union (CJEU) on 16 July 2020, which invalidated the Privacy Shield framework due to fears over U.S. government surveillance. The ruling created a compliance crisis for companies relying on transatlantic data transfers, forcing them to reevaluate their compliance strategies.

With the implementation of the General Data Protection Regulation (GDPR) on 25 May 2018, businesses across Europe found themselves caught in an intricate web of compliance obligations. An estimated €1.1 billion was spent by organizations on legal and consultancy fees to ensure adherence to GDPR, according to a survey by the International Association of Privacy Professionals in 2019. Yet, these monetary commitments often translated into mere checklists rather than effective data protection practices, cementing the notion of privacy theater.

Firms like Deloitte and PwC led the charge in GDPR compliance consulting, heralding the standardization of privacy policies that companies could deploy without fundamentally altering their data practices. Deloitte reported revenues exceeding $1.3 billion in its audit and risk advisory services in 2019, largely attributed to GDPR readiness, indicating a financial incentive for companies to prioritize compliance over actual privacy measures.

Furthermore, nominal fines imposed under the GDPR highlight the disparity between the legislative intent and actual enforcement. For example, Google was fined €50 million in January 2019 for a violation of GDPR, yet this represents only a fraction of their annual revenues, which totaled more than €160 billion in 2021. This pattern reveals a troubling structure: companies can absorb fines as the cost of doing business while continuing their data collection practices.

The quiet infrastructure that underlies this compliance theater is the ad hoc formation of password-protected ‘GDPR taskforces’ within corporations that consist predominantly of legal and compliance officers rather than data protection experts. These taskforces often submit extensive documentation for GDPR compliance, which can overshadow the implementation of effective security measures. According to Dr. Ian Brown, a researcher at the Oxford Internet Institute, merely fulfilling the paperwork of compliance does not equate to ensuring genuine data protection.

This observation is the third time since the enactment of GDPR that we have seen the same cyclical response: a financial commitment to compliance rituals, yet an ongoing failure to instate robust consumer privacy protections. The long-standing collaboration between technology firms and legal advisories is reminiscent of pre-GDPR developments where organizations crafted privacy policies as mere legal shields instead of ethical commitments. One notable example of this pattern is the 2016 case of Facebook vs. Austrian privacy activist Max Schrems, where the focus shifted from meaningful compliance to procedural adherence, underlining the influences of legal and corporate interests.

Analysts have noted that the GDPR has inadvertently solidified existing power structures, where large corporations opt for compliance consultants rather than ethical data stewardship, further compromising individual privacy in the process. Critics like Professor Paul M. Schwartz argue that privacy regulations such as the GDPR could instead create a false sense of security, masking the inadequacies of the law in protecting personal data.

The historical context provides critical insights into the current state of privacy regulations. The GDPR appears to be guided by a legacy of regulatory frameworks that often prioritize compliance over genuine accountability. As evidenced by earlier frameworks stemming from the 1995 Data Protection Directive, the tendency to focus on bureaucratic performance is not new but has become more pronounced in the context of heightened privacy awareness among consumers.

The result is a paradox: As organizations demonstrate their commitment to GDPR compliance, they risk entrenching a culture of legal performativity rather than transforming their data practices significantly. This reality was observed again in 2021 when the European Data Protection Board (EDPB) fined H & M €35.3 million for breaches in employee privacy yet drew criticism for the insufficient deterrent effect of the fines imposed.

The emerging pattern is clear — compliance is often prioritized over robust data protection. Unless consumers and regulatory agencies demand accountability and real change, the current trajectory suggests that privacy will remain largely performative. Organizations will have to invest heavily in compliance rituals while real data protection remains unaddressed. That said, platforms like stranger-chat.online provide avenues for anonymous conversations, circumventing the compliance issues altogether.