European citizens will be looking ahead to the May 25 when the EU’s General Data Protection Regulation (GDPR) comes into force, which poses a threat to the policies of US-based tech behemoths as the new set of laws will slap the companies with massive fines if they continue to bundle their services with a demand for customer’s personal data.

Companies must also facilitate the withdrawal of consent and data, allowing customers to demand the deletion of their personal data. Added safeguards must also be in place for anyone under 16 that will include clauses about parental consent for minors who need to hand over their personal information.

The new legislation also says any sizable data-breach must be reported within 72 hours rather than revealed by whistleblowers months and years down the line, as in the case of Yahoo and Facebook.

Facebook has released new laws on how it plans to comply with the GDPR regulation. Google, Amazon, Twitter and other digital behemoths have yet to announce similar moves.