The EDPB: the board that keeps 30 regulators singing one song

The EDPB (Art. 68) seats every EU/EEA data protection authority plus the EDPS. Three jobs: (1) Guidelines — the interpretive canon this pillar cites constantly: video devices, consent, dark patterns, access rights, AI models. Not formally binding on courts, but DPAs enforce by them, which makes them binding in every way that costs money. (2) Consistency refereeing — in cross-border cases under the one-stop-shop, concerned DPAs can object to a lead authority’s draft; deadlock triggers an Art. 65 binding decision. This is not decorative: EDPB interventions forced the Irish DPC to raise Meta fines by hundreds of millions and to expand findings it had declined to make. (3) Opinions on the hot stoves — consent-or-pay (Opinion 08/2024), AI training (Opinion 28/2024), each redrawing industry plans within weeks. Why it matters to you: forum-shopping resistance. Big tech clustering in one country picks its lead regulator; the EDPB is the mechanism keeping that from deciding outcomes — imperfect, slow, but with a visible record of ratcheting enforcement up rather than down. Citing it: in any dispute, an on-point EDPB guideline paragraph does more work than three adjectives. Companies’ lawyers know the canon; quoting it signals you do too.