For space ambitions, the sky is not the limit but for regulation, it is. EU Space Act, GDPR and the structural limits of regulatory extraterritoriality.

On 25 June 2025, the European Commission proposed the EU Space Act, the first supranational regulatory framework for space activities within the Union. This article examines the extent to which the Space Act follows the European digital regulatory model – built upon the GDPR, NIS2, the DSA, and the AI Act – and identifies its structural limits when applied to the space domain. The Space Act faithfully reproduces the formal methodology of European digital law: recourse to regulation, extraterritorial jurisdiction based on the marketplace principle, and lex specialis cybersecurity requirements inspired by DORA and NIS2. However, it reveals fundamental substantive gaps, most notably the total absence of provisions on privacy and personal data protection in the context of Earth observation, and the lack of any governance framework for autonomous systems and artificial intelligence in space operations. The article argues that these omissions are not mere drafting oversights but reflect a sovereignty paradox: the European Union can regulate what is sold on its market, yet cannot control what is collected above its territory. The paradigmatic case of Starlink illustrates both the strategic dependency of European actors on extra-European space infrastructure and the limited enforceability of European rules against non-compliant operators. The multiplication of satellite constellations and the temporal exemption of pre-2030 satellites further dilute regulatory effectiveness. The article concludes by identifying three non-exclusive paths: improving the existing legal framework, developing autonomous European space capabilities, and pursuing multilateral space diplomacy – while acknowledging the severe geopolitical constraints on each.