Proton Mail

Proton's 2021 case is the most instructive entry in this tab because it shows precisely where a privacy promise ends. Swiss authorities, acting on a French request (reported to have come via Europol), issued a legally binding order; Proton was compelled to log and hand over the IP address (and, per press reports, browser information) for one account tied to a climate activist collective, and arrests followed in France. Proton could not appeal. What it could not hand over was message content - the end-to-end encryption held, which is the promise that actually matters. Proton then said it would update its privacy policy to state its Swiss legal obligations more clearly, and in October 2021 won a Swiss ruling that email services are not telecommunications providers and are therefore exempt from telecom data-retention requirements. Recorded fairly: the marketing overstated, the technical guarantee held, and the company litigated to narrow the gap.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Data sharing

GENUINELY DIFFERENT STRUCTURAL MODEL from most providers in this tab: Proton Mail uses CLIENT-SIDE (zero-knowledge) encryption with keys the USER controls, meaning even Proton itself — and, per the company's own marketing, even the Swiss government — cannot access email content without the user's password. Proton is based in Switzerland, operating under the Swiss Federal Data Protection Act, which provides stronger restrictions on government data access than most other jurisdictions covered in this tracker. IMPORTANT CAVEAT worth independently verifying before treating Proton as fully independent: one source in this research raised that Proton was partly FUNDED BY THE EU, which the source frames as a legitimate question about the company's independence — this claim was not independently confirmed this pass and should be verified directly before repeating it.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.