Data-protection and consumer-authority complaint machinery

File formal administrative complaints with data-protection authorities (DPAs) under GDPR / Convention 108 / national data-protection statutes, and with consumer-protection authorities under national consumer-law and cross-border cooperation mechanisms, against specific AI products and deployments. The complaint is not litigation — it activates an existing regulator's statutory investigatory and enforcement machinery, forcing the authority to open a file, request the target's technical and commercial documentation, and either issue a decision, negotiate a settlement, or explain in writing why the complaint fails. GDPR's one-stop-shop and cross-DPA cooperation mechanism turn a well-drafted complaint into a multi-jurisdictional regulatory event when the target is a large cross-border AI vendor.

An actor chooses this strategy because it is far cheaper than litigation and much harder for the target to defeat by legal-fees attrition — the regulator, not the complainant, does the investigative work. The complaint also produces a written regulator finding that becomes the evidentiary substrate for the next campaign: a class action, a coalition letter, a parliamentary hearing, a follow-on complaint in a different jurisdiction. Regulators additionally have enforcement instruments a court does not — administrative fines calibrated to global turnover, orders to cease processing, orders to delete unlawfully-trained models — that impose direct commercial cost the litigation route cannot deliver on the same timeline. Where the DPA is under-resourced or captured, the complaint's public filing creates political pressure for the authority to act, and cross-border cooperation lets a well-organised complainant coalition venue-shop toward the DPA most likely to move.

It trades investigative speed and public visibility for administrative depth: the complaint pipeline is slow (multi-year), the regulator's decision is often narrower than the complaint asked for, and the DPA's own risk appetite bounds what the strategy can extract. The strategy is also brittle to regulatory capture — an AI industry with legislative access at the DPA's oversight level can shape both the authority's budget and the interpretive guidance the complaint runs against. A complaint's public political weight is highest at filing and again at decision; the years-long silence in between rewards actors with an institutional memory and a coalition that can carry the demand across staff turnover at both the complainant and the regulator.

The strategy pairs directly with empirical audit and expose (audits produce the specific processing-purpose or data-source claims a complaint reasons from), with strategic litigation (a DPA finding often becomes plaintiff evidence in the follow-on suit), and with coalition lobbying (regulatory decisions become the case citations the legislative-reform coalition uses to argue the existing regime is insufficient). It sits upstream of humanitarian-disarmament-treaty work on state-harm AI: the treaty coalition needs the "current law is insufficient" evidence base, and a run of DPA decisions defining the failure edge of the existing statute is that evidence base.