The European Union could soon adopt a law that would strengthen online privacy protections for consumers, but it would come at a cost to free expression and leave a redacted history for Internet users.

Last week, European Union leaders agreed on the final text of a privacy bill that the European Parliament will vote on next month. The law, which would go into effect in 2018, would require that companies explicitly obtain permission from people before using their data.

Consumers would also have the right to examine and correct the information or transfer it to other companies. This would, for example, prevent an email provider from making it so hard to move old emails to a new provider that consumers are essentially held hostage.

Under the bill, regulators would have the authority to penalize companies that violate the rules with fines of up to 4 percent of their global revenue. Businesses would have to notify regulators within 72 hours if personal data was stolen.