A New EU Project Wants Privacy Defenses to Follow People Across Devices

A person can reject a cookie prompt on a laptop, limit app tracking on a phone and still have little visibility into how an account, device identifier or connected television links activity across services. Privacy settings often sit in separate places because the systems collecting data do too. A European research project called REAL-PETS is organized around that mismatch.

The European Commission’s CORDIS record lists REAL-PETS as a Horizon Europe project with a start date of October 1, 2026, an end date of September 30, 2029 and an EU contribution of about €3.85 million. Its stated objective is to develop cross-platform privacy-enhancing technologies, combining detection, regulatory compliance and human-centered design. ^[1]

IMDEA Networks describes planned approaches including adaptive “smart-noise” defenses, privacy-preserving analytics, anonymous credentials and post-quantum-ready encryption. It says pilots with privacy technology providers will be used to validate the work. These are project objectives, not features already shipped to browsers or phones. ^[2]

Why a single privacy switch often falls short

Tracking is not one mechanism. A website may use cookies or storage; an app may have access to device-level identifiers or embedded software libraries; a connected device may send telemetry through a vendor account. A person may see one control at a time, while the underlying data relationships cross companies, devices and jurisdictions.

That creates three linked problems. First, detection: a user or regulator needs evidence about what is happening, not just a policy statement. Second, mitigation: a defense must reduce collection without breaking ordinary functions or creating new ways to identify someone. Third, usability: people need to understand what a setting does and how to make a meaningful choice without becoming full-time privacy engineers.

REAL-PETS explicitly combines these concerns rather than treating privacy as a legal question alone or as a browser plug-in problem alone. Its consortium includes academic groups focused on privacy, law and usability, alongside small and medium-sized technology partners. That mix could help the project test whether a technical defense works in real contexts and whether people can use it. ^{[1] [2]}

What the proposed tools mean—and what remains unknown

“Privacy-enhancing technology” covers a broad family of methods. Privacy-preserving analytics can aim to produce useful aggregate insights while limiting exposure of individual records. Anonymous credentials can prove an eligibility fact without revealing a full identity. Adaptive defenses may alter signals to make tracking less reliable. Post-quantum-ready encryption refers to cryptographic approaches designed to remain secure against future quantum computers that could break some widely used public-key systems.

Those labels are not guarantees. Adding noise may protect people while reducing the accuracy of a service. An anonymous credential can still be linked if a system collects other identifying details. A cryptographic protocol can be sound while its implementation, key management or user interface fails. The project’s value will depend on how it measures these tradeoffs and tests them across different platforms.

The Commission record and project page are useful evidence about scope, schedule and funding. They do not yet provide independent outcomes, technical specifications for a deployable product, or results from the promised pilots. The consortium’s launch communication describes the project’s ambitions, not completed protections. ^{[1] [3]}

What would make the project useful to people

The work will matter if it answers practical questions. Can a person discover which apps or devices share a tracking identifier? Can they revoke a permission without losing access to an unrelated service? Does a defense reduce cross-context linking under realistic conditions? Can a regulator or researcher verify the claim without receiving sensitive user data? Do people understand what the setting changes?

Useful evaluation should test several platforms at once and include failure cases: shared devices, account sign-ins, device resets, app updates and services that stop working when a signal is blocked. It should also explain who operates each protection and what data remains visible to the service provider. Without those details, “cross-platform” risks being a slogan for a collection of isolated controls.

For readers, there is no new REAL-PETS tool to install today. Existing privacy settings and reputable tracker controls remain the practical options while the research proceeds. For developers, the project is a reminder to make data flows and permissions understandable across the full device ecosystem. For policymakers, it may produce evidence about where current rules and technical controls meet—and where gaps remain.

Three years is a long time in software, but it is a reasonable horizon for research that needs to connect measurement, cryptography, compliance and human use. The important milestone will not be the project’s launch. It will be whether its pilots show a protection that works across real services and remains usable without asking people to trade away basic functionality.

Related reading

• How personal AI systems should expose and control stored context
• Post-quantum security: planning the transition beyond compliance evidence