Big tech firms have been in European regulators’ sights even before data privacy rights were boosted when the General Data Protection Regulation (GDPR) came into force nearly two years ago.

Though the GDPR has not changed the law around data protection too much, lawyers suggest its introduction—alongside much stiffer penalties and an improved appetite to monitor suspected abuses—has shone a light once again on the practices that underpin the business models that enable such firms to operate.

Neil Hodge is a freelance business journalist and photographer based in Nottingham, United Kingdom. He writes on insurance and risk management, corporate governance, internal audit, compliance, and legal...