Proton, Signal, DuckDuckGo, and Brave are being adopted across Europe as a jurisdictional escape from American surveillance law. Their transparency reports, court records, and the last eighteen months of European legislation tell a more precise and useful story about what a switch protects and what it leaves entirely exposed. European tech alternatives have moved from enthusiast forums into government procurement policy in under two years. The people adopting them — swapping Gmail for Proton Mail, Google Search for DuckDuckGo, Chrome for Brave or Firefox, WhatsApp for Signal — believe European tech alternatives place their data under law they can actually influence. It is worth asking, carefully and without cheerleading, whether that belief holds up under scrutiny.
The inbox that went dark
In February 2025, a United States executive order named Karim Khan, the British chief prosecutor of the International Criminal Court, among those sanctioned over the court’s arrest warrants for Israeli Prime Minister Benjamin Netanyahu and his former defense minister. Within weeks, Khan had lost access to his Microsoft email. He moved to Proton Mail.
Who pulled the switch is still contested. The Associated Press reported that Microsoft blocked the account. Microsoft denied cutting off the ICC and said the court itself made the decision. Dutch reporting indicated Microsoft had told the ICC that the sanctions required Khan’s disconnection, or services to the whole organization would end. In February 2026, Microsoft asked a UK parliamentary committee to correct testimony one of its executives had given on the episode.
The dispute over agency does not change the shape of the event. A prosecutor at a court in The Hague lost his working inbox because of a decision taken in Washington. A Finnish MEP later put the general anxiety into a single line at a policy summit: the EU runs on Microsoft, and the United States could turn it off inside an hour. That image did more for European digital sovereignty than a decade of privacy advocacy. Within a year, France’s interministerial digital directorate ordered ministries to submit plans to eliminate extra-European dependencies, and the consumer switching list hardened into five standard recommendations.
What people are actually running from
The case against the incumbents has three parts, and all three are substantially correct.
The first is the business model. Google’s and Meta’s revenue depends on constructing behavioral profiles precise enough to auction. The products, the free tier, the defaults are all downstream of that. No amount of regulation changes an architecture built to know you.
The second is law. Section 702 of the U.S. Foreign Intelligence Surveillance Act permits large-scale collection of foreign communications without individual warrants, and non-Americans have historically had almost no standing to contest it. Section 2713 of the 2018 CLOUD Act reaches data in a U.S. company’s possession, custody, or control regardless of which country the server sits in. A data center in Frankfurt operated by an American company is not, legally speaking, a German data center.
The third is leverage — the Khan problem. Not surveillance but dependency: the capacity of a foreign political decision to remove a service an institution has built itself around.
A fourth, quieter concern is that the legal bridge keeps collapsing. The Court of Justice struck down Safe Harbor in 2015 and Privacy Shield in 2020. The replacement, the EU-U.S. Data Privacy Framework, survived its first challenge on September 3, 2025, when the General Court dismissed Philippe Latombe’s annulment action and found the U.S. Data Protection Review Court sufficiently independent — while expressly confining itself to the facts as they stood in 2023 and declining to consider anything afterward. Latombe appealed on October 31, 2025. Three frameworks in a decade, the third under appeal, is a reasonable thing to want out of.
What European tech alternatives actually change
Take the five swaps one at a time, because they are not equivalent.
- Proton Mail for Gmail: Proton stores your mailbox with zero-access encryption: the server holds ciphertext it has no key for and cannot produce message bodies under any circumstances. That is a genuine architectural difference from Gmail, not a policy promise. It does not cover the envelope. Proton’s own support documentation states that subject lines and sender and recipient addresses are encrypted but not end-to-end encrypted, which means a Swiss court order can reach them. Mail exchanged with non-Proton addresses is protected by TLS in transit and zero-access encryption at rest, but is not end-to-end encrypted unless both parties use PGP.
- DuckDuckGo for Google Search: DuckDuckGo does not build a search profile tied to you, which is the point. Its results have long been syndicated in part from Microsoft’s Bing, and in 2022 researcher Zach Edwards found that the DuckDuckGo mobile browser permitted Microsoft-owned tracking scripts on third-party sites while blocking everyone else’s. Founder Gabriel Weinberg confirmed that the syndication agreement prevented the company from going further. DuckDuckGo renegotiated the terms and removed the carve-out in August.
- Proton Drive for Google Drive: The cleanest swap on the list. End-to-end encrypted file storage set against a service whose commercial logic is to index what you put in it.
- Brave or Firefox for Chrome: Both block considerably more than Chrome does by default. Brave runs on Chromium, Google’s engine, so moving to it diversifies the vendor but not the rendering engine; Firefox’s Gecko is the last significant independent engine in consumer browsing. Both have had their moments. In June 2020, Brave was found to be auto-completing typed cryptocurrency exchange addresses into its own affiliate links; Brendan Eich called it a serious error of judgment and reverted it. Mozilla derives more than ninety percent of its revenue from search partnerships, principally with Google — the main alternative to Chrome is funded by Chrome’s maker.
- Signal for WhatsApp or iMessage: The strongest item by a distance, and the easiest to verify, because Signal publishes the subpoenas. When grand juries in Virginia, California, and the District of Columbia demanded names, addresses, correspondence, and contact lists, Signal produced two Unix timestamps per account: when it was created, and when it last connected. That is not a policy. It is an architecture that never held the rest.
Four of the five carry American passports
Here is the part the switching guides tend not to lead with. DuckDuckGo, Inc. is headquartered in Paoli, Pennsylvania. Brave Software, Inc. is in San Francisco. Mozilla is a U.S. corporation and foundation based in Mountain View, California. The Signal Foundation is a U.S. 501(c)(3), also in Mountain View. Proton AG is in Plan-les-Ouates, Geneva — and Switzerland is not a member of the European Union.
The canonical list of European alternatives consists of four American organizations and one Swiss one. What separates them from Google is not where they are incorporated. It is what they are built to hold. That doesn’t make the swaps pointless. Signal is plausibly the most privacy-preserving consumer messenger in existence, and it is American. But it does dissolve the jurisdictional story most switchers believe they are buying.
Switzerland is a jurisdiction, not a shield
Proton publishes its numbers, which is more than most companies do, and they’re instructive. Between 2017 and 2025, Proton Mail received 45,667 legally binding orders from Swiss authorities and complied with 40,389 of them. In 2025 alone, it received 9,301, contested 988, and complied with 8,313. In 2024, the figures were 11,023 received and 10,368 complied with — with a compliance rate above ninety-four percent. Three cases show what compliance actually yields.
In 2021, French police investigating a Paris gentrification protest routed a request through Europol to Swiss authorities, who issued a binding order requiring Proton to begin logging the IP address of one named account. Proton complied, and authorities identified the activist. The company’s marketing had said it kept no IP logs by default; the word “default” carried more weight than most readers assumed, and the copy was revised afterward.
In 2024, in a Spanish terrorism investigation into the Catalan Democratic Tsunami movement, Proton provided the recovery email address attached to an account. It was an iCloud address. Apple supplied the rest — full name, two home addresses, a linked Gmail account.
In March 2026, court records reviewed by 404 Media showed that a January 2024 Mutual Legal Assistance Treaty request from the FBI had produced, through Swiss authorities, the payment card identifier attached to an account associated with Atlanta’s Stop Cop City movement. Proton’s position — technically accurate — was that it provided nothing to the FBI. It provided it to the Swiss justice department, which provided it to the FBI.
Article 271 of the Swiss Criminal Code does genuinely prohibit Proton from handing data directly to foreign authorities. Requests must pass through Swiss legal review, and that review is real friction. In all three cases, it was also the route the foreign authority successfully took. Now the control experiment. Proton VPN — same company, same country, same lawyers — has received 458 legally binding Swiss orders since 2017 and denied all 458; every one of them an attempt to link a server IP address and a timestamp to a person. Not because Switzerland protects VPNs more than it protects email. Because Swiss law does not currently require connection logs, Proton VPN does not keep them, so there is nothing to hand over. The difference between 40,389 orders complied with and 458 refused is not jurisdiction. It is whether the data was ever created in the first place.
Europe wants the keys too
The assumption underneath the migration is that European authorities are less interested in your communications than American ones. The last eighteen months do not support it.
Switzerland proposed a revision to its surveillance ordinance, the VÜPF, extending obligations to any service with 5,000 users or more: identity verification, six months of IP retention, and under the draft Article 50a, an obligation to remove encryption the provider itself had applied. Proton called it stricter than anything in the United States or the EU and threatened to leave the country; Threema said it was prepared to launch a popular initiative. Because the change was drafted as an ordinance rather than a law, a referendum was not available. In February 2026, after cross-party opposition and parliamentary motions demanding a fundamental rewrite, the Federal Department of Justice and Police ordered an external regulatory impact assessment and prepared a second consultation. The proposal is not dead. It is not passed either.
Sweden’s data retention bill was targeted to take effect on March 1, 2026 and would require messaging providers to store communications and give police retrospective access. Signal’s president said the company would exit Sweden rather than comply. More than two hundred organizations and experts urged rejection. So did the Swedish Armed Forces, which had adopted Signal for non-classified communications only weeks earlier, and warned the requirement could not be met without introducing vulnerabilities that third parties could exploit.
France went furthest and then reversed. Article 8 ter of the narcotics bill would have obliged platforms to deliver decrypted messages within seventy-two hours. The Senate passed it; the National Assembly struck it down in March 2025, with votes from across the chamber.
And the United Kingdom — not in the EU, but unambiguously European — produced the clearest case in the period of a government removing encryption from its own residents. In January 2025, the Home Office served Apple a secret Technical Capability Notice under the Investigatory Powers Act, demanding access to iCloud data protected by Advanced Data Protection. Apple withdrew the feature for UK users in February 2025 rather than build the capability. The original notice sought worldwide reach; after months of talks, the U.S. Director of National Intelligence confirmed the UK had withdrawn it and issued a replacement targeting only British residents. Apple filed a fresh complaint at the Investigatory Powers Tribunal on August 4, 2026. Eighteen months on, UK users still cannot turn the feature back on.
Read that sequence again. A European government stripped an encryption feature from its own citizens, and American pressure was what narrowed the order. At the EU level, the chat-scanning file has been running for four years. Regulation 2021/1232, the voluntary scanning derogation known as Chat Control 1.0, expired on April 4, 2026, after Parliament voted against extending it. It returned on July 9, 2026, when Parliament failed to reach the 361 votes needed to reject a fast-tracked Council text; suspicionless scanning is now permitted until 2028. The permanent regulation, the CSAR, remains in trilogue after the supposedly final round collapsed on 29 June 2026 over precisely that question.
Backdoor is the wrong word for the right worry
The intuition that every system has a way in is sound. The word usually attached to it is not. A backdoor is a deliberate weakness placed in the cryptography or the client. No public evidence suggests one exists in Proton, Signal, Brave, or Firefox. All four publish source code; Signal and Proton commission external audits. Assuming a hidden master key is, in fact, the least useful way to be suspicious of these products, because three other doors are standing open and are far better documented.
The first is metadata. Routing information cannot be encrypted end-to-end, because something has to read it to route it. Every person named in the cases above was identified through metadata: an IP address, a recovery email, a payment card. Not one of those cases involved broken encryption.
The second is compelled prospective logging. The 2021 Proton order did not decrypt anything. It required the company to begin generating data it had not previously kept, on one named account, going forward. That is not a backdoor. It is a legal instrument that reaches the same destination more slowly. Article 50a of the VÜPF draft would have converted the case-by-case version into standing policy.
The third is the endpoint. Client-side scanning, the architecture at the center of the CSAR fight, does not break encryption. It inspects content on the device, before encryption or after decryption. The ciphertext remains mathematically intact, and the confidentiality is gone regardless. What the Global Encryption Coalition and the Swedish Armed Forces both objected to was engineering, not politics: a deliberately introduced weakness cannot be restricted to its intended user.
Encryption is a mathematical guarantee about content. In every unmasking in these cases, investigators found a fact about the account.
So does the flag matter?
The honest answer is yes, but not in the way it is being sold, and not as much as the marketing implies. What jurisdiction genuinely buys is remedy. Data governed by law you participate in is data whose custody you can litigate, legislate, and vote about. Latombe’s appeal exists. Apple’s tribunal case is being argued partly in open court. The French Assembly killed Article 8 ter. Cross-party pressure forced the Swiss Federal Council into a second consultation. None of those levers is available to a European against Section 702. That asymmetry is the strongest part of the sovereignty argument, and it survives everything above.
Three things, however, do not follow. It does not follow that European law is more protective in outcome: the VÜPF as drafted would have imposed retention obligations Proton itself called stricter than U.S. practice, and retention of that kind is outright illegal for German email providers. Switching does not mean your legal exposure disappears, because four of the five products are American. And a European provider won’t refuse when asked.
So what does switching actually buy? Three things, in descending order of reliability. First and largest: a business model that does not require knowing you. Nobody in this set profits from a behavioral profile, and that win is permanent and independent of any legislature. Second: architecture — Signal’s two timestamps, Proton Drive’s zero-access storage, Proton VPN’s 458 refusals — which reduces what any order can extract. Third and smallest: jurisdiction, which mostly changes who you can complain to. That ordering is precisely the reverse of how the movement advertises itself.
What this means in practice
Decide who you are actually protecting yourself against. Against advertising technology, data brokers, and casual commercial profiling, these swaps work close to completely. Against a lawful order from your own government, they help at the margins. Against a determined state that already has your name, they help very little on their own. Metadata discipline outranks brand loyalty. The payment method, recovery address, and phone number identified real people in every case described here. An account paid for anonymously and recovered to nothing is a different object from the same service paid for with a credit card.
Read the transparency report, not the homepage. Proton publishes figures that undercut its own marketing; Signal publishes the subpoenas it fought. Companies willing to do that are being more useful to you than companies that promise more. And watch legislation rather than logos. The second VÜPF consultation, the CSAR trilogue, the Riksdag’s vote and the tribunal sitting in London will shape your privacy over the next two years far more than any switch you make this weekend.
Karim Khan’s problem was never that Microsoft could read his email. It was that Microsoft could switch it off. A Swiss provider fixed that — immediately, completely, permanently. It fixed nothing else. Most of the people who have followed him across are solving a different problem than the one they believe they have, using tools that are genuinely better than the ones they left, for reasons that have almost nothing to do with the map.
Sources: Proton AG transparency report (updated January 6, 2026) and Proton VPN transparency report (updated July 14, 2026); Proton support documentation on message encryption; Signal’s published government-request records; the General Court judgment in Case T-553/23, Latombe vs. Commission, and the pending appeal C-703/25 P; Swiss Federal Department of Justice and Police announcements on the VÜPF revision; reporting by the Associated Press, TechCrunch, 404 Media, Heise, The Register and Computer Weekly.
Follow us on X, Facebook, or Pinterest
