Next upHack for Humanity: San Francisco (powered by Google Gemini)
News

Supreme Court FTC independence ruling threatens EU-US data transfers for cloud and AI

The US Supreme Court ruled 6-3 on June 29, 2026 that the FTC's removal protections are unconstitutional, undercutting the enforcement basis of the EU-US Data Privacy Framework.

Dmytro Spodarets
Jun 30, 2026 · 2 min read

The US Supreme Court ruled 6-3 on June 29, 2026 that the Federal Trade Commission’s for-cause removal protections are unconstitutional. The decision threatens the legal foundation of transatlantic data transfers for cloud and artificial-intelligence providers. The opinion in Trump v. Slaughter effectively overturns Humphrey’s Executor, the 1935 precedent that shielded independent-agency commissioners from presidential firing for 90 years.

The stakes for AI and cloud companies run through enforcement. The EU-US Data Privacy Framework, adopted in July 2023, names the FTC as its primary enforcement body and rests on that agency’s independence from the White House. Google, Microsoft and Amazon have all relied on the framework to lawfully move European user data and AI training data into US-based systems. Strip the FTC of independence, and the legal premise the European Commission accepted in its adequacy decision starts to wobble.

Chief Justice John Roberts, writing for the majority, held that the FTC’s structure violates the separation of powers under the unitary-executive theory; Justices Sonia Sotomayor, Elena Kagan and Ketanji Brown Jackson dissented. The ruling also expands presidential authority over other nominally independent agencies.

The Austrian privacy group noyb, founded by Max Schrems, called on the European Commission to “orderly withdraw the adequacy decision on the US” and said it plans to file a challenge at the Court of Justice of the European Union. noyb said the Commission cited FTC “independence” 259 times in its adequacy decision. That framing is advocacy, not a neutral reading, and the group’s count has not been independently verified.

Nothing changes overnight. The Data Privacy Framework remains legally in force unless and until the EU court invalidates it, and a noyb lawsuit typically takes two to three years to resolve. Companies leaning on Standard Contractual Clauses face the same exposure, because those instruments reference assessments of US oversight bodies that the ruling has reshaped.


Dmytro Spodarets
Dmytro Spodarets
Founder & Editor-in-Chief

Founder and Chief Editor of Data Phoenix — a San Francisco Bay Area media and education platform focused on AI and Data.

More news