Compliance 2026: Data Centers fighting against Windmills

This year, the location of data centers will revolutionize geopolitics and regulatory compliance. The choice of site will catalyze various legal forces driven by the consumption of artificial intelligence. When data centers promise to be powered by renewable energy, the legal framework will become even more complex and open to debate.

Multiple national interests are involved in the construction of a data center and are negotiated simultaneously across a range of legal disciplines such as real estate, energy, environmental, corporate, privacy and data security law, among others, whose comparative flexibility competes between countries and regions.

To secure massive foreign investment, to manage tax breaks and subsidies for technology transfers and sophisticated equipment, and to propose corporate and contractual engineering, we must study:

● How to strategically buy or lease land,

● The authorizations and licenses available to channel a huge consumption of energy;

● How to contractually secure the global connectivity of submarine fiber optic networks to ensure efficient data transmission.

● The level of regulatory requirements for ecological sustainability.

● A legal comparison of visible concessions to foreign investment.

● National privacy and digital security rules,

● The new international trade rules for the import of, for example, graphics processing units for data replication.

Four precedents from 2025 highlight the sensitivity of the global installation and management processes for data centers. This sensitivity is heightened from a legal standpoint when the specific requirements of the fragile promise that they will consume renewable energy are added.

1. The separation of responsibilities between corporate control and data storage.

In January 2025, the U.S. Supreme Court ordered ByteDance, TikTok's owner, to sell its app or face a ban on operating for violating national security. The execution of the ruling was negotiated with the understanding that Oracle would take over operations.

ByteDance regularly uses data center services in Oregon, Northern Virginia, and Hillsboro, provided jointly by Oracle and Equinix. This storage relationship allowed them to extend negotiations until the 22nd of this month and finalize the acquisition of TikTok USA from the North American consortium formed by Oracle, Silver Lake, and MGX, with a 45% stake. ByteDance will retain 19.9%, and the remaining percentage will be held by other current ByteDance investors.

The North American consortium led by Oracle, while not a controlling shareholder, will act as a trusted security partner responsible for ensuring the security of user data stored in Oracle's data centers. Oracle will also assume responsibility for managing the algorithm, content moderation, and platform integrity with TikTok's software. This transaction may be the first to balance Chinese and American interests in the sector. It will be finalized 120 days after President Trump authorizes it through his executive order.

2. Renewable energy does not resolve conflicts of data governance and privacy.

Regulations proliferated to impose a corporate culture of data protection, modeled by a kind of globalized ESG in business groups like Facebook, or imposed ministerially in China, as in the case of TikTok.

In 2023, large companies began structuring executive data management boards. This expansion reached Brazil, where TikTok invited members of civil society to join a national committee to decide on issues of integrity, quality, and consistency of the citizens' database consolidated by the federal government. The committee only fulfilled a formal function, because in October 2024, the National Data Protection Agency investigated access to...

TikTok was banned for users under 13, and parents were required to obtain parental consent for users between the ages of 13 and 18, under penalty of withholding 2% of the company's revenue. TikTok Brazil removed access for 7.5 million of the 24 million users under 13. The agency imposed restrictions on unregistered access, similar to those in the US and the EU. In March 2025, TikTok suspended unregistered access, requiring user identification, and submitted a compliance plan mirroring measures implemented in other countries that mandate user age verification.

Simultaneously with its compliance plan, TikTok embarked on negotiations to build a massive wind-powered data center in Fortaleza, consuming between 300 and 900 megawatts (an initial average of 210 megawatts, equivalent to the energy needs of a city of 2.2 million people). This is similar to the data centers it has been building since October in Shanghai and Lingang, but with significantly higher energy consumption (each data center in China consumes 24 megawatts). Fortaleza is a global hub for submarine cables in northeastern Brazil, equidistant from Europe, Africa, South America, Central America, and the United States, and boasts one of the world's largest renewable energy capacities, both solar and wind. The project represents an enormous energy challenge.

The Redata tax incentive program for data centers was used to subsidize TikTok in Ceará, contradicting a December 17th expert report from the Public Prosecutor's Office. The report questions the environmental permit granted for the construction because the data center's energy consumption will exceed that of 99% of Brazilian cities, citing a lack of verification of water availability, improper fragmentation of the environmental permitting process, and the omission of a structural impact assessment.

3. Legal engineering begins in a strategically deregulated territory.

One of the most stressful concerns is defining the location and securing funding for the facility. Venues compete on deregulation and promotions.

In early December, Australia's Foreign Investment Review Board suspended a ByteDance data center project in New South Wales or Victoria, which had already been delayed due to the company's lack of regulatory compliance following its failure to secure public funding from private investors and its lack of financial support from the Australian national treasury.

Without much discussion, in February TikTok initiated the construction of its northeastern data center in Brazil, powered by wind energy and with full Brazilian financial support. At the beginning of 2025, two Brazilian companies, Casa dos Ventos and Patria Investimentos, with European and Saudi capital, began work on the wind-powered data center in Ceará, investing €30 billion. In December, Patria Investimentos acquired all

The Casa dos Ventos operation after a fleeting approval from the National Competition Council (CADE) on the 17th.

4. Can the use of renewable energy represent an enabling ESG principle for data centers?

In Europe, complaints are proliferating about European data centers draining ports like Marseille, polluting urban life with constant noise and heat waves. Regulations are strict, but in practice, controls are relaxed in the face of the scale of the investments. To some extent, the promise of wind power contributes to this process.

Since 2023, Google and Microsoft have purchased large tracts of land in northern Finland to build data centers and offset the resulting heat. New submarine cables have been laid to Germany, and the development of cold-weather wind power generation has increased. For years, Finland has offered very low prices with substantial energy consumption incentives, as well as competitive labor costs compared to Sweden or Ireland.

In Germany, the company Windcore powers data centers with wind turbines in Paderborn, claiming they are carbon neutral (10 grams per kWh compared to the average of 430 grams). However, companies that store data have been very cautious about contracting these data centers due to the impossibility of guaranteeing a constant energy supply.

They're windmills, Don Quixote. The data storage giants are either following social pressure or responding to regulations and processes. Some countries, like Singapore, have relaxed their regulations for data center construction through a moratorium, prioritizing and authorizing projects that guarantee environmental sustainability. In October 2024, Singapore proposed an ESG Green Data Center Roadmap, consolidated in 2025 with industry input, to optimize the environmental efficiency of data center technology, as well as water consumption.

Wind energy isn't suitable for all data centers and depends on their location in wind farms. Only large operators have invested in building wind-powered renewable energy data centers because they can consolidate and position their corporate ESG strategy, justifying investments in these projects. While it's unlikely that this energy will play a fundamental role due to the maintenance costs of these investments, some national regulators use these projects as a pretext to attract massive foreign investments, such as TikTok's in Brazil.

They advocate a carbon-neutral strategy. This creates regulatory uncertainty that could lead to a lack of oversight of shared projects and mask genuine mismanagement of data, thanks to more flexible legislation or weaker enforcement mechanisms for privacy, integrity, and security in data centers.

This year, the two pillars of legal engineering for data centers—environmental and data protection—will clash like quixotic windmills. Will these foreign investments solidify a trend toward installing renewable energy data centers, or will they merely moderate compliance with content integrity, security, and data protection regulations in the companies that operate them?