US Supreme Court ruling puts EU-US data transfers at risk

The US Supreme Court ruled on 29 June 2026 in Trump v. Slaughter that the President may remove Federal Trade Commission commissioners at will, ending the agency’s independence. Privacy organisation noyb says the ruling knocks out the foundation of the EU-US Data Privacy Framework and has formally asked the European Commission to withdraw the adequacy decision that lets personal data flow from the EU to certified US companies. For European multi-location brands, the question is suddenly practical: which tools in the marketing stack move personal data to the US, and on what legal basis.

What happened

The Supreme Court’s decision in Trump v. Slaughter declared the removal protections that made the FTC an independent agency unconstitutional. That matters in Brussels because the FTC is the primary enforcement authority behind the EU-US Data Privacy Framework, the 2023 arrangement that allows personal data to move from the EU to US companies certified under it. According to noyb, the European Commission’s adequacy decision relies on the FTC as an independent regulator 259 times.

noyb, the privacy group founded by Max Schrems, sent a formal letter asking the Commission to repeal the deal in an orderly manner and says it will file a lawsuit in the coming weeks aiming to have the Court of Justice of the EU annul it. noyb also argues the ruling reaches beyond the framework itself: standard contractual clauses and binding corporate rules depend on transfer impact assessments that reference formerly independent US bodies such as the PCLOB and the Data Protection Review Court.

The framework has not been struck down. No court has invalidated the adequacy decision, certified US companies can still lawfully receive EU personal data, and a European Commission spokesperson said the Commission continues to monitor whether a high level of data protection is ensured and remains in close contact with the US administration.

Why it matters

The Court of Justice of the EU has already invalidated two predecessor arrangements, Safe Harbor in 2015 and Privacy Shield in 2020, each time after a challenge built on US surveillance law and weak oversight. Both times, thousands of companies had to rebuild their transfer arrangements overnight. A third invalidation would hit a much larger stack: review platforms, analytics, CRM, advertising and listings tools all process personal data, and many of them do it on US infrastructure under the current framework.

“Given that there are no independent authorities in the US anymore, we call on the European Commission to orderly withdraw the adequacy decision on the US.”

Max Schrems, noyb

What this means for multi-location brands

A brand with hundreds of locations cannot untangle its data flows in a week, so the work starts before any court rules. Central marketing and digital teams should map which vendors in their location-marketing stack process EU personal data, where it is hosted, and which transfer mechanism each one relies on. Review management is a good place to start, since customer reviews and responses contain personal data at scale: a platform for managing reviews across every location should be able to answer the hosting question directly. The same applies to listings and location data management, where consent logs and user interactions sit alongside the business data.

Data residency is also becoming a procurement criterion rather than a legal footnote. European multi-location brands increasingly ask where a vendor’s customer data physically lives before signing, and this ruling will sharpen those questions. PinMeTo hosts all customer data in the EU, so a potential annulment of the adequacy decision would not change the legal basis for the data our platform holds.

The bottom line

The EU-US Data Privacy Framework is still standing, but the pillar the European Commission leaned on hardest just cracked, and noyb’s CJEU challenge is expected within weeks. Multi-location brands that know exactly where their marketing stack processes personal data will read the next ruling as news; everyone else will read it as a project plan.