How Proton Handles Law Enforcement Data Requests

Summary

Mark, a lawyer at Proton, explains how foreign law-enforcement requests for Proton user data are handled. His central point is that foreign authorities cannot request data from Proton directly. Because Proton is based in Switzerland, requests must go through Swiss authorities and comply with Swiss law. He contrasts this with companies based in countries such as the United States, which may be required to respond directly to domestic authorities.

Mark also emphasizes that even when a request is legally approved, Proton cannot provide information it does not collect or cannot decrypt. According to the video, the contents of Proton emails and files are encrypted so that Proton itself cannot read them, and Proton VPN does not store user-activity logs.

How a Foreign Request Is Reviewed

The process described in the video has two main stages.

1. Review by Swiss Authorities

1. The conduct must also be a crime in Switzerland. If it is not, Swiss authorities will not cooperate. Mark gives personal downloading of protected music as an example of conduct that would not meet this test.
2. Swiss authorities investigate the request and assess whether it violates human rights or fundamental rights.
3. They check for political motivation. Requests targeting dissidents or peaceful activists may be rejected.
4. If the request passes those checks, it is sent to the relevant federal or cantonal authority for execution. Mark says the responsible body may be police or a prosecutor, depending on the stage of the case.
5. A legally binding Swiss order may then be issued, allowing authorities to request data from Proton.

2. Proton’s Independent Review

Before responding, Proton says it conducts its own checks:

• Validate the documentation: Improperly formatted or invalid requests are rejected.
• Require a targeted, specific request: Broad demands, such as requests covering 100 accounts, or attempts to search indiscriminately, are rejected.
• Assess whether the alleged conduct is a crime under Swiss law: Proton says it does not simply accept the authorities’ assessment.
• Limit requests to existing data: Proton cannot provide information it does not collect. For example, the video says Proton VPN does not log user activity.
• Assess political-persecution and human-rights risks: Proton says it may reject a request involving, for example, the prosecution of someone for organizing a peaceful demonstration.

If any of these conditions is not met, Proton says it will object. If all are met and a valid order is issued, the video says Proton is legally required to comply. Refusing may bring criminal sanctions, fines, or enforcement measures.

What Information May Be Available

• Encrypted content: Proton says it cannot access the contents of users’ emails or files and therefore cannot hand them over in readable form.
• Basic account information: This may include a username, recovery details voluntarily added by the user (such as another email address or phone number), device-related push tokens, and account dates such as creation or last activity.
• Metadata: The video says obtaining metadata requires a special court order. For Proton Mail, this may include sender and recipient addresses, message subject, and timestamp. Mark describes this information as more protected and less frequently requested.
• Payment information: For card payments, Proton may have limited details, such as the last four digits. The video also mentions Bitcoin and cash as payment options that may be less traceable than credit cards.

Key Takeaway

The video presents privacy as protection within the law, rather than a way to avoid it. It describes multiple Swiss legal reviews and a separate Proton review before data can be disclosed, while noting that encryption and limited data collection restrict what Proton can provide. Mark says the video was filmed in June 2026 and that Proton would communicate changes to its data policy.

Speakers and Sources Featured

• Mark: The video’s sole speaking source. He identifies himself as a lawyer and explains Proton’s process.
• Sources and organizations referenced: Google’s transparency reports; Proton’s services and data practices; Swiss authorities, including federal and cantonal bodies; and the FBI and the UK’s NCA as examples of foreign law-enforcement agencies.