i18n-Internet-freedom-2026

Internet Freedom 2026: What's Left of the Open Web

The open web is becoming a regulated space — and a flood of AI slop, rage bait and data trading helps decide what stays visible in it. A look at the state of things, from the workshop log, October 2026.

Ingmar Konnow

• 11 Min. Lesezeit
Teilen
Internet Freedom 2026: What's Left of the Open Web

The internet was supposed to be the place where information flows freely and nobody at the door decides who gets in. Twenty years on, there are bouncers at the door — they're just called age verification, platform duties and ranking algorithms now. And the actual party? It's thrown by mega-corporations: entry is free, paid for in data and attention — and once you're in, you're never supposed to leave. That would be a fun side story if the web were only the entertainment district — but by now it also carries work, commerce, education and half of public administration. In this log I'm laying out what actually happened in 2026: where regulation bites, where it fails — and why the biggest threat to information freedom might not be censorship at all. Not distant tech politics, either: my whole profession is built on this open web, so let's go.

The regulation wave — what actually happened

This is no longer future talk. Four construction sites show how real it has become:

The UK switched the Online Safety Act to enforcement mode: age verification for age-restricted content has been mandatory since July 2025 — roughly 5 million additional checks per day at launch, and over 69 million verified age checks in the first six months alone. Side effects: a massive VPN boom and a government announcement that social media restrictions for under-16s are next.

Australia enforced the world's first under-16 social media ban in December 2025. Platforms removed 4.7 million accounts — a strong result on paper. Six months later, reality looks different: an estimated 70% of affected teens still have access, and the regulator has measured no discernible drop in reported online harm so far. A grand experiment with an open outcome — and precisely because of that, so instructive.

The EU is showing teeth through the DSA: a €120 million fine for X in December 2025 (partly for the deceptive "verified" checkmark and missing researcher data access), ongoing proceedings against TikTok over insufficiently protected minors' accounts, preliminary findings against Meta — 17 open investigations in total. Meanwhile the permanent "chat control" regulation is stuck in trilogue: the interim rule for voluntary scanning of unencrypted messages expired in April 2026 and was reactivated in July (until April 2028, end-to-end encryption excluded) — while the permanent regulation failed its sixth trilogue in late September on the same question as ever: scan everyone, or only suspects on a judge's order? Parliament wants the latter, the Council would rather make voluntary scanning permanent — and a newly floated "detection plan" is something even the negotiators cannot quite define. On 20 October the Council discusses a "detection package"; a blocking minority against mandatory scanning is two percentage points short — Germany, Belgium or Portugal could each close it on their own.

The US plays a double role here: inward, its states drive the strictest age-verification rules — the Supreme Court upheld Texas's ID requirement for porn sites in June 2025, and since summer 2026 Texas's app-store law is enforceable, requiring age verification and parental consent for minors' downloads; the Supreme Court let it stand against the tech lobby in July 2026, with Utah and Louisiana following. There is also regulation by settlement: Meta had to commit across 47 states to overnight curfews, restricted notifications during school hours and daily time caps for teens. Outward, Washington fights the same kind of regulation as censorship: US diplomats were ordered to mobilize against the DSA, and in December 2025 the State Department imposed visa bans on former commissioner Breton — the DSA's "mastermind" — and four disinformation researchers. No federal act, but a patchwork of state laws — pointing the same direction: verification as the ticket in.

The pattern underneath: the state no longer builds walls around its part of the net — it plays code enforcement and hands the club owners the conditions. The bouncers are paid by the promoter, but the house rules increasingly come from the authorities. Regulation is becoming a product requirement.

Europe regulates — but the club belongs to others

The point is: the club all of this happens in belongs to US companies — the infrastructure the web runs on sits with them. And the CLOUD Act of 2018 gives US authorities the right to demand data from those providers — no matter which continent the server sits on. Extraterritorial reach goes in both directions, just not symmetrically. The EU court's September 2025 confirmation of the EU-US data transfer framework changes little about that: anyone in Europe building on US clouds and US platforms effectively operates in a foreign jurisdiction.

How seriously Washington takes its own question shows in the TikTok deal: in January 2026 the US operation was effectively force-sold — a joint venture with Oracle, Silver Lake and MGX (ByteDance still holding just under 20%) now keeps US user data onshore, while the algorithm remains licensed Chinese property and will only be trained on US data going forward. "Sovereignty tax" is what one analysis called it — and the label sticks: data and algorithms are no longer neutral trade goods but contested state assets.

And China? Their counter-model is long finished — and being exported: firewall, real-name registration, data localization, as a blueprint for dozens of states. When DeepSeek showed in early 2025 that the AI stack can come from China too, the West reacted promptly — with bans on government devices. As of 2026, the free web sits between three blocs: the EU regulates, the US enforces through platform control and legal reach, China supplies the control model.

Slop - washed out, regurgitated, boring

While outside they argue about the door, the real business runs inside — and it's bigger than any door check. According to a Pew analysis from August 2026, about 10% of all webpages show significant signs of AI authorship — among pages published since ChatGPT's release, roughly a third. DoubleVerify counted over 500 million impressions of low-quality AI content ("AI slop") in the first half of 2026 alone, monetized through advertising. Not an accidental byproduct but a business model: content doesn't have to be good, just cheap and plentiful.

Slop has a property you notice the moment you read it: it's statistical — washed out, regurgitated, interchangeable. The average of everything that was already there, warmed up once more. And that's precisely the underestimated danger: information freedom isn't only about what may be published — it's about whether anything verifiable can still be found in the mush. A web where every third new text might be machine-produced doesn't need censorship to devalue information; the blur does it on its own. Sourcing and editorial accountability thereby become infrastructure questions, not culture-page topics.

While the web's average gets watered down, those who figured it out go the other direction: extreme. "Rage bait" — Oxford's word of the year for 2025 — is content engineered to provoke anger, because anger is what the ranking algorithm pays out in reach; usage of the term tripled within twelve months. The result of this economics is absurd and logical at once: the average waters down, the reach goes to those who escalate loudest. Almost everyone knows it firsthand: a quick look at the feed, still scrolling two hours later. In a recent US survey, 88% of 13-to-24-year-olds reported doomscrolling — half of them lose more than an hour of sleep on those nights. Nobody needs to ban anything for that — it's enough that outrage reliably pays better returns than facts. The freedom question thereby becomes an attention question as well: who holds the focus — and what a feed can bait its audience into.

And behind it sits the same business from the other side: if you don't pay to get in, you're not the guest in this club — you're the goods. "Who cares, I have nothing to hide" — that sentence sits in every second conversation, and data brokers are thriving on it. The US trade authority FTC aptly called the business "commercial surveillance" in its big platform report: profiles, movements and interests of millions of people get marketed, combined and resold — with or without the knowledge of those concerned. The new age checks feed the same logic from the other side: anyone showing ID at every door creates data silos that didn't exist yesterday. In the end, freedom on the web presumes an audience that still values its data — and its attention.

The door moves into the model

Content is only one half — the other is access. Cloudflare reported in June 2026 that on its network — behind which roughly a fifth of the web runs — machine traffic exceeded human traffic for the first time: about 57% bots versus some 42% humans. The lion's share is training crawlers collecting content without ever sending a reader back: OpenAI refers one visitor per roughly 1,000 crawled pages; Anthropic's ratio sits around 38,000 to one.

Sticker on a wall

And the door itself moves up a level: AI answers replace the link. The first randomized study on this (July 2026) puts the effect of Google's AI Overviews at nearly 40% fewer clicks to sources — a third more searches end without any click at all. Anyone looking for answers no longer leaves the answer machine — and anyone publishing on the web becomes a raw-material supplier for a layer nobody gets a say in.

The control point has moved house once again: from network operator to platform, from platform to model. Those who used to do SEO now implicitly negotiate with a handful of model operators. The pushback is already running — Cloudflare has blocked AI crawlers by default since July 2025, licensing deals between publishers and model companies are forming, antitrust cases are pending. The information-freedom question of 2026 is therefore less "who may publish?" and more: who controls the door to the answer?

The decentralized alternative — counted honestly

The alternative to the club with bouncers exists — it's just smaller than its reputation. Bluesky has roughly 46 million registered accounts but lost more than half of its monthly active users since its late-2024 peak; the latest count sits around 10.7 million. The Fediverse reaches about 1.2 million monthly actives. Solid niches — not a large-scale counter-public.

The most telling detail hides in the fine print: even Bluesky now runs age checks for UK users. Decentralized protocols don't change the fact that the service at the end of the line falls under national law — the club may be decentralized, the house rules stay national. For more on that gap between promise and platform reality: I wrote it down in my log on Web3 and what remained after the hype — same lesson, different chapter.

The honest middle

Two truths that rarely appear side by side in this debate:

First, the problem is real. Child sexual abuse material, grooming and organized disinformation are not invented justifications — and a web with no enforcement capability at all wouldn't be a freer one, just a more defenseless one.

Second, the price is real. Blanket chat scanning, ID requirements for anonymous participation, and a regulator that acts as investigator and judge in one shift power — and power without counterweight has never been used exclusively for good purposes.

So the actual question of 2026 isn't "free or regulated?" but: where do the bouncers sit — and who writes their rules? An age check via the EU Digital Identity Wallet is a different thing than an ID upload at every single platform. A judicially ordered scan is a different thing than a permanent scanner inside every chat app. These are design questions — and they're being decided right now, mostly without much of an audience.

What this means for digital projects

From my work with products, platforms and my own infrastructure — four points any project should have on its radar today:

  1. Compliance is a product feature. Age verification, moderation duties and transparency reporting are no longer a legal afterthought but architecture decisions — with data flows, UX trade-offs and operating costs. Addressing them only at launch review means building twice.
  2. Jurisdiction is an architecture decision. CLOUD Act and GDPR both claim reach beyond their own borders — the choice of cloud region, provider and data residency determines whose legal space a project actually lives in. "EU cloud" is no longer a marketing label but risk management. The same calculation, by the way, runs in my own infrastructure — self-hosted open-source services are less a statement than an operating decision.
  3. Platform dependence is regulatory risk — and more. A channel whose reach or business model hangs on a supervisory decision is not a strategy. The same applies one level up to the answer layer: those who are only found via models are at their discretion. Owned domains, owned distribution — newsletter, RSS, direct customer relationships — are the risk buffer that counts again in 2026. This log, too, runs under its own domain — for exactly that reason.
  4. Trust becomes a differentiator. In a web full of generated content, offerings with verifiable provenance win: clear sources, traceable authorship, documented decisions. What used to be hygiene is now a competitive edge.

Use the web — don't get used

First: the web isn't only an entertainment district. There are the quieter houses with a cover charge — major magazines and newspapers like ZEIT, whose paywalls exist because serious journalism costs money. And that's exactly the counter-model to free entry: whoever pays for content is a customer instead of goods, and the product has to hold up with the reader rather than the advertiser. A deliberately chosen subscription is the most direct answer to the slop business.

Second: sovereignty starts at your own domain and, in the end, on your own server. Own website, own newsletter, RSS — channels no algorithm can throttle and no authority can suspend. Anyone going a step further runs parts of their digital infrastructure themselves: I self-host a good share of my services on my own hardware with open source — from photo backup to identity management. What that buys is concrete: I know where my data lives, whose legal space it sits in, and what happens when a provider turns the pricing dial or changes the rules. The price is real learning and maintenance work — not everyone has to run a server. But whoever does understands afterwards what dependence costs — and what independence pays.

Third — the smallest dial with the fastest effect: take the feed into your own hands. Chronological feeds, RSS readers, deliberate source choices over the algorithm buffet — once you treat your attention as a resource, you quickly notice the club visit is voluntary. The bouncers can't be switched off — but where you go out is still your call.

Conclusion

Less of the open web utopia remains than assumed — but differently than the gloomy forecasts claimed. The web of 2026 isn't censored in the classic sense; it's more measured, more obligated, and increasingly machine-filled. The bouncers are real — they're called compliance departments and age-assurance providers. The biggest venues' promoters are too — they're called Meta, Google and ByteDance. But they're not the whole web — and the honest debate no longer revolves around whether, but where and how.

What remains is a piece of design leeway: anyone responsible for digital products helps decide where the bouncers stand — and whether "free" stays an architecture feature or degrades into a marketing word. And that leeway is closer than it seems — on my own desk, too.

As of: October 2026. Even the sixth trilogue ended without agreement — I suspect I'll be re-reading this paragraph in a year. Hopefully with better news.

Sources

Making a digital project more sovereign — infrastructure, platform risk or product strategy? Worth a conversation → ingmar@konnow.de · LinkedIn

0%
11 Min. Lesezeit