Keep Factually independent
Whether you agree or disagree with our analysis, these conversations matter for democracy. We don't take money from political groups - even a $5 donation helps us keep it that way.
Proton VPN eu governement wanting data for criminnals
Executive summary
Proton VPN, operated by Swiss-based Proton AG, repeatedly states it keeps no connection logs and therefore cannot hand over user IPs or browsing histories even when governments ask for them [1] [2]. Swiss law requires Proton to comply with Swiss court orders, and if a Swiss court approves a request Proton must provide whatever data it actually holds — but the company says it generally has “very little information to share” because of its no‑logs design [3] [4].
1. What Proton publicly says about government data requests — and why that matters
Proton’s transparency report and privacy materials emphasize a strict no‑logs policy: they do not record VPN session data or customer IPs and therefore “cannot comply with requests for user connection logs” because those logs don’t exist [1] [2]. The company also publishes transparency reports and a warrant canary to show the number of legal requests it receives and to alert users to secret orders when possible [1] [2].
2. The legal limit: Swiss jurisdiction and court orders
Proton is incorporated in Switzerland and repeatedly notes that it is “illegal for us to comply with any request for data unless it is supported by a Swiss court order,” meaning foreign agencies must go through Swiss authorities to compel Proton [3]. When Swiss authorities approve a request, Proton says it must share whatever data it actually has — but their public stance is that, for VPN sessions, that data is minimal or non‑existent [4] [3].
3. Where the tension with EU governments arises
European governments have been pushing various surveillance and retention measures that could affect VPN providers; reporting and analysis cite proposed or debated laws (including EU “chat control” and national retention measures) that could force providers to handle more user data or implement collection mechanisms [5]. Proton and industry commentators warn that such laws could force providers to build capabilities they currently avoid, and Proton’s CEO has publicly said the company might leave Switzerland if certain surveillance expansions passed [6] [5].
4. Practical limits: “We can’t hand over what we don’t have”
Independent audits, multiple Proton statements, and product explanations all underline a practical point: even if an authority demands logs tied to a server IP and timestamp, Proton says it “could not provide the requested information and this was explained to the requesting party” because they do not retain that metadata [1]. Analysts also note that while Switzerland cooperates in criminal investigations, Proton’s technical setup and stated policies limit what it can produce [5].
5. Exceptions, edge cases and past examples
Proton’s public communications acknowledge exceptions and difficult cases. For example, Proton Mail and VPN are treated differently under Swiss law; Proton Mail’s end‑to‑end encryption and “zero‑access” design constrain what Proton can hand over, while Proton concedes that in at least some Swiss orders it had to comply and that there are channels “reserved for serious crimes” where orders may be executed [7] [4]. Wikipedia notes controversy over proposed legal amendments in Switzerland that could require VPNs and apps to collect more data, and quotes Proton’s CEO saying the company would consider leaving Switzerland if such laws passed [6].
6. Competing perspectives and business incentives
Proton frames its policy as both a technical privacy design and a commercial differentiator: being based in Switzerland and not logging is presented as a core selling point that aligns with GDPR and privacy advocacy [8] [9]. Critics or skeptics (summarized in third‑party reviews) point out that no‑logs claims require independent verification; Proton’s no‑logs status has been independently audited in the past and the company highlights those audits and transparency reporting [10] [1].
7. What this means if you’re an EU user worried about criminal data requests
If an EU government demands data about someone who used Proton VPN, the request will generally need to be processed through Swiss legal channels for Proton to be compelled; Proton’s declared practice is to provide only what it actually holds, which for VPN session logs they assert is nothing identifiable [3] [1]. However, available sources note that Switzerland does cooperate in criminal investigations and that certain legal changes under discussion could alter provider obligations — reporting does not claim these changes are passed into law universally yet [5] [6].
8. Bottom line and open questions
Proton’s public materials and transparency reports consistently state: they do not keep connection logs, they are bound by Swiss court orders, and they will comply with Swiss legal requirements but can’t hand over data they don’t have [1] [3] [4]. Available sources do not mention a definitive instance where Proton VPN handed over identifiable VPN connection logs to an EU government because they lacked such logs, though they do record occasions where requests were made and explained to authorities that the data did not exist [1] [7]. The key open questions are how proposed Swiss or EU legal changes would alter obligations and whether future technical or legal pressures could force Proton to change its architecture — reporting shows Proton and other providers are actively resisting such changes [5] [6].