Data Protection Authorities (DPAs) play a critical role in shaping and applying the regulation applicable to online media expression within the European Economic Area. Drawing on seven ubiquitous types of online new media actors, a comprehensive survey of these authorities was undertaken. It found that European DPAs generally adopt an expansive interpretation of data protection and a constrained understanding of freedom of expression in this space. In contrast, data protection enforcement is weak and lacking in harmonization. Except for street mapping services, each type of online media actor had only faced relevant enforcement action from a minority of these agencies. DPA financial resourcing is very limited. Notwithstanding the development of DPA ‘network governance’, only DPAs with a particularly extensive interpretative stance proved likely to have engaged in extensive enforcement activity. It remains unclear what difference the General Data Protection Regulation will make to resolving this enforcement gap and its related problems.