France is poised to adopt legislation that could profoundly reshape the core principles of online security by obliging communication service providers to install backdoors in encrypted messengers and limiting access to internet resources via VPN. The proposal has sparked sharp criticism from Tuta (formerly Tutanota) and the VPN Trust Initiative (VTI).
The first contentious bill involves an amendment to France’s Narcotrafic law, requiring providers of encrypted communication services to furnish law enforcement with decrypted messages from suspects within 72 hours of a formal request. Failure to comply could lead to fines of up to €1.5 million for individuals and as much as 2% of a company’s annual global revenue. While the legislation has yet to be enacted, it has already passed the French Senate and is moving on to the National Assembly.
Tuta has urged legislators to reject the amendment, arguing that undermining encryption will create vulnerabilities not merely for criminals, but for ordinary users as well. The company stresses that even if a backdoor is instituted for law enforcement purposes, cybercriminals and state-sponsored hackers could exploit the same mechanism. Tuta further maintains that such initiatives run counter to EU data protection regulations (GDPR) and violate German cybersecurity standards.
At the same time, another proposal in France would compel VPN services to block access to pirate websites. Media conglomerate Canal+ and the French Football League (LFP) are driving this measure, demanding that internet service providers and VPN operators restrict access to specific online resources.
The VPN Trust Initiative (VTI)—encompassing AWS, Google, Cloudflare, Namecheap, OVH, IPVanish VPN, Ivacy VPN, NordVPN, PureVPN, and ExpressVPN—has condemned the move, insisting that combating piracy should not give rise to censorship or infringe upon user rights. In an open letter, the organization drew parallels between this proposal and internet restrictions in countries such as China, Myanmar, and Iran, underscoring how such measures could establish a precedent for widespread censorship.
France is not the only nation tightening its grip on digital information. In the United Kingdom, the government recently demanded that Apple grant access to encrypted iCloud backups, prompting the company to disable end-to-end encryption for British users. Meanwhile, Sweden is drafting a bill obliging services like Signal and WhatsApp to introduce technical backdoors that would grant authorities access to encrypted messages.
It has also emerged that Europol chief Catherine De Bolle plans to push major technology firms toward more extensive collaboration with law enforcement on encryption issues, asserting that refusing such cooperation could pose a threat to European democracy.
