Attention Governance Law in Europe

1. Meaning and Scope

Attention Governance Law refers to the body of European legal rules governing how public authorities, digital platforms, advertisers, media organizations, employers, educators, and technology providers capture, direct, manipulate, measure, distribute, or restrict human attention.

It is not a single codified European cause of action. Rather, it is an emerging interdisciplinary field formed from:

data-protection law;

consumer-protection law;

digital-platform regulation;

freedom of expression;

privacy and personality rights;

competition law;

advertising law;

equality and non-discrimination law;

employment law;

child protection;

AI governance;

administrative law and fundamental rights.

The central legal question is increasingly:

When does the design or governance of an attention-capturing system become legally problematic because it interferes with autonomy, privacy, equality, informed choice, or fundamental rights?

Examples include:

infinite scrolling;

autoplay;

recommendation algorithms;

personalized advertising;

behavioral profiling;

notifications and engagement optimization;

dark patterns;

algorithmic ranking;

political microtargeting;

attention-based advertising;

addictive or compulsive interface design;

AI-generated personalized content;

manipulation of children;

workplace attention monitoring;

algorithmic amplification of harmful content.

There is no general European statutory right simply called a “right to attention.” Instead, legal protection is constructed through existing rights and regulatory obligations.

2. European Legal Framework

A. GDPR

The GDPR is central because attention-management systems normally depend upon personal data.

Important provisions include:

Article 5 – lawfulness, fairness, transparency, purpose limitation, data minimisation;

Article 6 – lawful bases for processing;

Article 12–15 – transparency and access;

Article 21 – right to object;

Article 22 – automated decision-making;

Article 25 – data protection by design and by default;

Article 35 – data-protection impact assessments;

Article 82 – compensation.

An engagement-optimization system can therefore raise questions about whether users genuinely understand how their data is being used to influence what they see.

B. Digital Services Act

The Digital Services Act is particularly important for platform-based attention governance.

Relevant areas include:

transparency of recommender systems;

explanations concerning the main parameters used by recommender systems;

restrictions on certain forms of targeted advertising;

protection of minors;

systemic-risk assessment for very large online platforms;

mitigation of systemic risks;

transparency concerning advertising;

restrictions concerning dark patterns.

Thus, attention governance increasingly moves beyond the traditional question of “was the individual informed?” toward “was the digital environment itself designed and governed in a lawful manner?”

C. EU Consumer Law

Attention manipulation can also constitute a consumer-law problem.

Relevant concepts include:

misleading commercial practices;

aggressive commercial practices;

material distortion of economic behaviour;

hidden advertising;

manipulative interface design;

dark patterns;

unfair contractual practices.

The Unfair Commercial Practices Directive is particularly relevant where interface architecture materially influences consumer decisions.

D. EU AI Act

AI systems can affect attention through:

recommender systems;

personalized advertising;

emotion recognition;

profiling;

conversational systems;

content generation;

behavioral prediction.

The AI Act adds requirements depending on the risk category and use of the system.

Particularly important concepts include:

transparency;

human oversight;

risk management;

data governance;

accuracy;

robustness;

cybersecurity;

protection of fundamental rights.

E. EU Charter of Fundamental Rights

Attention governance can engage:

Article 7 – respect for private and family life;

Article 8 – protection of personal data;

Article 11 – freedom of expression and information;

Article 20 – equality before the law;

Article 21 – non-discrimination;

Article 38 – consumer protection;

Article 47 – effective judicial protection.

F. European Convention on Human Rights

The ECHR can become relevant through:

Article 8 – private life and autonomy;

Article 10 – freedom of expression and information;

Article 14 – non-discrimination;

Article 13 – effective remedy.

Attention governance therefore creates a potential tension between platform freedom to organize information and individual freedom to receive information without unlawful manipulation or excessive surveillance.

3. Core Legal Issues in Attention Governance

3.1 Attention Capture

A platform may design its service to maximize:

time spent;

clicks;

scrolling;

advertisements viewed;

notifications opened;

return visits.

The legal issue is not simply whether the system is engaging.

The question is whether engagement optimization becomes:

deceptive;

coercive;

unfair;

discriminatory;

privacy-invasive;

harmful to minors;

inconsistent with informed consent;

incompatible with fundamental rights.

4. Major European Case Laws

Case 1: Meta Platforms Ireland Ltd v Bundeskartellamt

CJEU, Case C-252/21, 2023

Facts

The German competition authority examined Facebook's collection and combination of personal data from different sources, including Facebook and external websites.

The issue involved the relationship between:

data collection;

personalization;

platform power;

GDPR requirements;

competition law.

Decision

The CJEU recognized that competition authorities may consider GDPR-related issues when assessing the exercise of market power, while maintaining the respective competencies of data-protection authorities and competition authorities.

Principle

Large platforms cannot treat personal-data exploitation as legally isolated from their broader digital business model.

Relevance to Attention Governance

Attention-optimization commonly depends on:

data collection → profiling → personalization → prediction → content ranking → user engagement → advertising.

Therefore, the legality of the attention economy can depend on whether the underlying data architecture is lawful.

5. SCHUFA Holding AG v Verbraucherzentrale Bundesverband

CJEU, Case C-634/21, 2023

Facts

SCHUFA generated credit scores that were used by businesses when making decisions concerning individuals.

Although SCHUFA described the score as information supplied to decision-makers, the score could have a decisive practical influence on the ultimate decision.

Decision

The CJEU held that automated scoring can fall within the GDPR's rules concerning automated decision-making when it effectively determines the decision made about the individual.

Principle

A formal human decision-maker does not necessarily eliminate the legal significance of algorithmic influence.

Relevance

The same logic can apply to attention governance.

For example, a platform may technically say:

“The user chooses what to watch.”

But if an algorithm determines which content is overwhelmingly presented, promoted, recommended, or hidden, the legal question may concern the actual influence of the algorithm, not merely the formal existence of user choice.

6. Dun & Bradstreet Austria GmbH

CJEU, Case C-203/22, 2025

Facts

The case concerned automated decision-making and the information that must be supplied concerning the logic involved.

Decision

The Court emphasized the importance of providing meaningful information concerning the functioning of automated decision-making so that individuals can understand and exercise their rights.

Trade-secret considerations do not automatically eliminate transparency obligations.

Principle

Algorithmic secrecy is not an absolute answer to accountability.

Attention-Governance Relevance

A user challenging an attention-ranking or profiling system may need meaningful information about:

what categories of data are used;

what factors influence recommendations;

how personalization operates;

how content is ranked;

whether behavioral characteristics are being inferred;

how advertising profiles affect the information presented.

The law does not necessarily require disclosure of source code.

The important issue is meaningful legal transparency.

7. Österreichische Post AG v Österreichische Datenschutzbehörde

CJEU, Case C-300/21, 2023

Facts

Österreichische Post processed personal data to predict political affinities of individuals.

The claimant sought compensation for resulting non-material harm.

Decision

The CJEU distinguished:

infringement of GDPR;

damage;

causal connection between infringement and damage.

It also rejected the idea that compensation for non-material damage could automatically be subjected to an additional seriousness threshold imposed by national law.

Principle

A data-protection infringement, damage, and causation are legally distinct questions.

Attention-Governance Relevance

Suppose a platform creates a behavioral profile to predict:

political interests;

emotional states;

purchasing preferences;

vulnerabilities;

ideological interests.

That profile may influence the user's attention environment.

A claimant must still establish the relevant legal infringement and, for compensation, the necessary damage and causal relationship.

8. Wirtschaftsakademie Schleswig-Holstein

CJEU, Case C-210/16, 2018

Facts

A company operated a Facebook fan page using Facebook's analytical tools.

The CJEU examined responsibility for processing personal data occurring through the Facebook environment.

Decision

The Court accepted that responsibility can be shared where an entity participates in determining purposes or means of processing.

Principle

Using a third-party technological platform does not automatically eliminate legal responsibility.

Relevance

Attention governance frequently involves multiple actors:

platform;

advertiser;

analytics provider;

AI provider;

data broker;

content creator;

recommendation provider.

An organization cannot necessarily avoid responsibility merely by saying:

“The algorithm belongs to another company.”

9. Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW

CJEU, Case C-40/17, 2019

Facts

A website incorporated Facebook's “Like” functionality, which transmitted personal data to Facebook.

Decision

The CJEU recognized circumstances in which a website operator could be a controller jointly with another entity for particular processing operations.

Principle

Embedding third-party technology can create legal responsibility for resulting data processing.

Attention-Governance Relevance

Modern attention systems are frequently assembled from:

tracking pixels;

advertising SDKs;

analytics tools;

recommendation engines;

social plugins;

AI personalization services.

The organization deploying the technology cannot automatically escape responsibility by outsourcing the technical component.

10. Google Spain SL v AEPD and Mario Costeja González

CJEU, Case C-131/12, 2014

Facts

Search-engine indexing made information about an individual easily accessible in response to searches of his name.

Decision

The CJEU recognized that search-engine processing could have significant effects on individuals and established the European framework for delisting in appropriate circumstances.

Principle

Technological organization and amplification of information can itself create legally significant consequences.

Relevance to Attention Governance

Attention governance is partly about amplification.

A piece of information may already exist online, but an algorithm can determine:

whether it appears;

how prominently it appears;

to whom it appears;

how frequently it appears;

what other information accompanies it.

Thus, ranking and amplification can have legal significance independently of the original publication.

11. Delfi AS v Estonia

ECtHR Grand Chamber, 2015

Facts

An online news portal was held liable under domestic law for seriously harmful comments posted by users.

Decision

The ECtHR examined the balance between:

freedom of expression;

protection of individuals;

intermediary responsibility.

The Court accepted that liability could, in the circumstances of the case, be compatible with Article 10.

Principle

Internet intermediaries may have legal responsibilities concerning harmful online content, although those responsibilities must remain compatible with freedom of expression.

Attention-Governance Relevance

Attention systems do not merely host information.

They can:

recommend;

rank;

amplify;

repeat;

personalize.

Consequently, the legal analysis of platform responsibility may increasingly consider not simply hosting, but also algorithmic amplification.

12. MTE and Index.hu v Hungary

ECtHR, 2016

Facts

Online organizations faced liability concerning user-generated comments.

Decision

The Court emphasized the importance of context when assessing restrictions on online expression.

Principle

Liability for online speech must be assessed with careful regard to Article 10 and the particular characteristics of internet communication.

Attention-Governance Relevance

An attention-governance system may distinguish between:

ordinary criticism;

satire;

political expression;

misinformation;

unlawful threats;

defamatory statements.

Automated moderation and ranking therefore require context-sensitive governance.

13. Bărbulescu v Romania

ECtHR Grand Chamber, 2017

Facts

An employer monitored an employee's workplace communications and relied on the monitoring in disciplinary proceedings.

Decision

The ECtHR held that workplace communications can fall within Article 8 and established safeguards for assessing employee monitoring.

Principle

Workplace monitoring must be justified and proportionate, with consideration of:

prior notification;

legitimate reasons;

extent of monitoring;

consequences for the employee;

less intrusive alternatives;

safeguards.

Attention-Governance Relevance

Modern employers may monitor:

screen activity;

keystrokes;

application use;

response times;

attention patterns;

productivity;

meeting participation.

AI-based “attention scoring” therefore raises privacy and proportionality concerns analogous to workplace monitoring.

14. López Ribalda and Others v Spain

ECtHR Grand Chamber, 2019

Facts

Employees were subjected to covert video surveillance following suspected workplace theft.

Decision

The Court assessed whether covert monitoring was proportionate to the employer's legitimate interests.

Principle

Workplace surveillance requires a careful proportionality assessment.

Attention-Governance Relevance

Continuous AI monitoring of employee attention may be more intrusive than traditional surveillance because it can operate:

continuously;

invisibly;

at scale;

through behavioral inference.

Therefore, attention analytics can create substantial Article 8 issues.

15. CHEZ Razpredelenie Bulgaria

CJEU, Case C-83/14, 2015

Facts

Electricity meters were placed at unusually high locations in a predominantly Roma neighbourhood because of concerns about electricity theft.

Decision

The CJEU recognized that a facially neutral practice could amount to indirect discrimination depending on its effects.

Principle

Discrimination can arise from apparently neutral systems where they disproportionately disadvantage a protected group.

Attention-Governance Relevance

Attention algorithms can create similar problems through proxies.

A platform may not explicitly use:

race, religion, disability or gender,

yet may use variables strongly correlated with them.

Consequently, an apparently neutral engagement algorithm can potentially generate discriminatory outcomes.

16. Feryn

CJEU, Case C-54/07, 2008

Facts

A company made public statements indicating that it did not want to employ certain ethnic groups.

Decision

The Court recognized that discriminatory recruitment statements can fall within EU equality law even without an identified individual applicant proving that they personally applied and were rejected.

Principle

Structural discriminatory practices can have legal significance beyond an individualized transaction.

Attention-Governance Relevance

This is relevant to algorithmic attention systems where discriminatory targeting or exclusion operates structurally.

For example, an advertising system could systematically:

show employment advertisements differently to demographic groups;

exclude particular populations;

allocate opportunities according to discriminatory proxies.

17. Big Brother Watch and Others v United Kingdom

ECtHR Grand Chamber, 2021

Facts

The cases concerned large-scale electronic surveillance and interception of communications.

Decision

The Court accepted that States may have intelligence capabilities but required a sufficiently precise legal framework and safeguards governing:

authorization;

selection;

retention;

examination;

use;

oversight.

Principle

Powerful technological surveillance requires strong legal safeguards.

Attention-Governance Relevance

Attention systems also depend upon large-scale behavioral observation.

A government or public authority using AI to analyze:

online behavior;

browsing patterns;

communications;

political interests;

behavioral tendencies

may therefore encounter Article 8 and other fundamental-rights constraints.

18. Important Legal Doctrines Emerging from These Cases

A. Autonomy

Attention governance can interfere with autonomous decision-making where users are systematically manipulated rather than merely persuaded.

The legal distinction is between:

ordinary persuasion

and

deceptive or coercive manipulation.

B. Transparency

Transparency requires users to understand relevant aspects of:

data collection;

profiling;

personalization;

recommendation;

advertising;

automated decision-making.

Dun & Bradstreet and SCHUFA are particularly important here.

C. Proportionality

A legitimate objective does not automatically justify every attention-management technique.

Courts can consider:

legitimate objective;

suitability;

necessity;

less intrusive alternatives;

balancing of competing rights.

This is particularly important for workplace and government surveillance.

D. Data Minimisation

A platform should not necessarily collect every possible behavioral signal merely because those signals could improve engagement prediction.

The GDPR's data-minimisation principle can become highly relevant.

E. Human Agency

Attention governance increasingly raises the question whether a person genuinely controls a decision.

An interface may technically offer a choice while its architecture strongly channels the user toward one outcome.

This makes substantive autonomy more important than formal choice.

19. Dark Patterns and Attention Governance

Dark patterns are interface designs that manipulate users into choices they might not otherwise make.

Examples include:

hidden cancellation;

misleading buttons;

repeated prompts;

default consent;

confusing privacy settings;

countdown pressure;

forced continuity;

disguised advertising;

difficult refusal mechanisms.

They can implicate:

GDPR;

consumer law;

DSA;

contract law;

unfair commercial-practice rules.

The legal question is often:

Was the user's apparent consent or commercial choice genuinely informed and freely exercised?

20. Algorithmic Recommendation Systems

Recommendation systems are central to attention governance.

A simplified model is:

User data → profiling → prediction → ranking → recommendation → user exposure → engagement → new data → revised prediction

This creates a feedback loop.

The legal risks include:

Privacy

Behavioral profiling may involve extensive personal-data processing.

Manipulation

The system may exploit inferred vulnerabilities.

Discrimination

Certain groups may receive systematically different content.

Freedom of expression

Ranking can influence what information users encounter.

Consumer protection

Commercial recommendations may not be sufficiently transparent.

Child protection

Children may be particularly vulnerable to engagement-maximizing systems.

21. Attention Governance and Children

Children require particularly careful treatment.

Potential risks include:

compulsive engagement;

targeted advertising;

profiling;

emotional manipulation;

inappropriate recommendations;

excessive notifications;

behavioral prediction;

exposure to harmful content.

The legal analysis may involve:

GDPR;

DSA;

EU consumer law;

EU Charter;

ECHR;

national child-protection law.

The central principle is that children cannot necessarily be treated as ordinary adult users for attention-design purposes.

22. Political Attention Governance

Political information creates an especially difficult legal balance.

Algorithmic systems can determine:

which political messages users see;

how often they see them;

which groups receive particular advertisements;

how political content is ranked;

whether controversial content is amplified or suppressed.

This engages:

freedom of expression;

freedom to receive information;

privacy;

political advertising rules;

equality;

democratic participation.

The law must therefore balance platform governance with pluralistic information access.

23. Competition Law Dimension

Attention is also an economic resource.

Large platforms can compete for:

user time;

advertising attention;

engagement;

data;

behavioural information.

Competition-law issues may arise where a dominant platform:

self-preferences its own recommendation services;

excludes competing attention intermediaries;

combines data in ways unavailable to rivals;

restricts interoperability;

imposes unfair access conditions.

The Meta Platforms litigation demonstrates how data practices and market power can intersect.

24. Causation in Attention-Governance Claims

A claimant generally needs to distinguish between:

Stage 1 — System design

Example:

platform intentionally optimizes notifications for engagement.

Stage 2 — Individual exposure

claimant repeatedly receives targeted notifications.

Stage 3 — Behavioral effect

claimant changes conduct because of the system.

Stage 4 — Legal harm

privacy, financial, reputational, employment, equality, or other legally recognized harm occurs.

Stage 5 — Causation

the unlawful feature materially contributed to the harm.

This is particularly important in damages claims.

25. Evidence

Important evidence can include:

algorithmic documentation;

recommender-system parameters;

model cards;

technical documentation;

A/B testing records;

engagement metrics;

user-interface versions;

notification logs;

advertising records;

profiling records;

DPIAs;

data-processing records;

internal risk assessments;

complaints;

moderation records;

audit reports;

source-code extracts where lawfully obtainable;

expert statistical evidence;

discrimination statistics;

communications between platform engineers and management.

A major litigation problem is information asymmetry because the platform usually possesses the technical evidence.

26. Defenses

Organizations may argue:

1. User autonomy

The user voluntarily chose to interact with the platform.

2. Legitimate interest

Personalization or recommendation serves a legitimate commercial or social purpose.

3. No legally significant decision

The algorithm merely recommends content and does not formally decide anything.

4. Human control

A human remains responsible for the ultimate decision.

5. Freedom of expression

Ranking or moderation decisions are part of editorial or platform freedom.

6. No discrimination

Different outcomes result from legitimate behavioral differences rather than protected characteristics.

7. No damage

A technical infringement does not necessarily establish compensable loss without the required causal damage.

8. Proportionality

The system pursues a legitimate objective through proportionate means.

27. Remedies

Depending on the legal basis, remedies can include:

cessation of unlawful processing;

correction of personal data;

deletion;

restriction of processing;

objection to processing;

human review;

recommender-system changes;

removal of unlawful targeting;

correction of discriminatory practices;

injunctions;

administrative penalties;

compensation;

restoration of access;

contractual remedies;

regulatory enforcement;

systemic compliance measures.

For GDPR claims, Article 82 can provide compensation where the statutory requirements are satisfied.

28. Comparative Case Table

29. Practical Legal Test for Attention-Governance Claims

A European court or regulator could effectively ask:

Step 1 — What is the technology?

Is it:

recommendation;

advertising;

profiling;

AI;

monitoring;

ranking;

personalization?

Step 2 — What data does it use?

identity data;

browsing history;

location;

communications;

inferred interests;

sensitive data;

behavioral patterns.

Step 3 — What does it attempt to influence?

purchasing;

political opinions;

employment;

information exposure;

health decisions;

workplace behavior;

educational activity.

Step 4 — Is the influence transparent?

Can the person understand the significant factors involved?

Step 5 — Is there meaningful choice?

Can the individual realistically:

refuse;

opt out;

change settings;

challenge the result;

obtain human review?

Step 6 — Is the system discriminatory?

Does it produce disproportionate effects on protected groups?

Step 7 — Is surveillance proportionate?

Could the same objective be achieved through less intrusive means?

Step 8 — Who is responsible?

Potentially:

platform;

advertiser;

employer;

AI developer;

data broker;

controller;

processor;

public authority.

Step 9 — Was there legally recognized harm?

Examples:

financial loss;

privacy interference;

discrimination;

reputational harm;

unlawful processing;

employment disadvantage.

Step 10 — What remedy is appropriate?

Potential remedies include:

deletion;

correction;

cessation;

human review;

algorithmic modification;

compensation;

regulatory sanctions;

judicial injunction.

30. Overall Legal Position

Attention Governance Law is an emerging field rather than a single European legal doctrine. Its importance comes from the fact that modern digital systems increasingly compete not merely for information or transactions but for human attention itself.

The strongest European legal principles currently come from the intersection of:

GDPR — controlling profiling and personal-data exploitation;

DSA — governing platforms, recommender systems, advertising and systemic risks;

consumer law — controlling manipulation and unfair commercial practices;

AI regulation — governing algorithmic systems according to risk;

equality law — controlling discriminatory targeting and outcomes;

Article 8 ECHR — protecting privacy and aspects of personal autonomy;

Article 10 ECHR — protecting freedom of expression and information;

EU Charter rights — protecting privacy, data, equality, expression and effective remedies;

competition law — addressing the economic power created by control over users' attention and data.

The most important jurisprudential development is the movement from a formal choice model—“the user clicked”—toward a more substantive inquiry into how technological architecture, profiling, algorithmic ranking and surveillance actually influence human choices.

The cases of SCHUFA, Dun & Bradstreet, Meta Platforms, Österreichische Post, Wirtschaftsakademie, Fashion ID, Google Spain, Bărbulescu, López Ribalda, CHEZ, and Big Brother Watch together provide a strong European foundation for analyzing modern attention-governance disputes, even though most of them are not cases specifically labelled “attention governance.”