Geoffrey Richard

VPNs in Europe have been hit from every side: court and regulator orders to block sites, a Danish draft that would have outlawed some VPN uses, a French minister calling them "the next topic on my list", and talks on making them keep logs. Why that matters for privacy 🧵

The common thread: VPNs framed as a loophole. An EU Parliament research note in January headed a section "A loophole that needs closing". The privacy tool becomes the problem to solve.

What a VPN protects is metadata: it hides the sites you visit from your ISP or the café Wi-Fi, and your IP address from those sites. The EU's top court said in 2014 that such data "may allow very precise conclusions to be drawn concerning the private lives" of people.

A 2013 study found that four time-and-place points were enough to single out 95% of 1.5 million phone users.

nature.com/articles/srep01376

On anonymity, the UN's free-expression rapporteur wrote in 2015 that tools like Tor, proxies and VPNs "may be the only mechanisms" for some people to express themselves securely, so access "should be protected and promoted".

He also urged states not to make identifying users a condition of access. Age-gating VPNs comes close: prove your age, often with ID, to use a privacy tool.

The enforcement is where privacy breaks. India tried in 2022 (names, emails, IPs, five years): ExpressVPN, NordVPN, Surfshark and Proton pulled their servers, some keeping "virtual" Indian locations hosted abroad.

To be fair, a VPN isn't anonymity: it moves your trust from the ISP to the provider. Some broke it: IPVanish handed a user's IP and connection times to US investigators in 2016 despite a no-log claim. A 2016 study of 283 Android VPN apps found 18% didn't encrypt traffic and 38% triggered at least one antivirus detection. Squeezing reputable providers pushes people toward those.

EU law already knows what VPNs are: the Cyber Resilience Act lists them as "important" security products, and in July the EU's top court called them "lawful technical tools which users may legitimately use". Treating them as a loophole every few months gets it backwards. I'd rather see enforcement aimed at pirate sites and platforms, not at a privacy layer millions of people rely on.

France's National Assembly voted a tax of €0.055 per gigabyte delivered to French internet subscribers, paid by whoever sends the data. It's a Socialist amendment to the 2027 budget, adopted 11 votes to 10, with a hoped-for yield of ~€10bn a year. Short thread on why I think it's a bad idea🧵
---

It taxes bytes, not value. A gigabyte of a Linux ISO costs the same as a gigabyte of Netflix. The sender pays for traffic the subscriber asked for and already pays their ISP to carry. To bill it, ISPs must attribute flows to an "emitting company", even behind a CDN; how is left to a decree.

And it isn't even "fair share": the money goes to the state budget, not to networks. OVHcloud estimates a bill of up to €70M a year, and puts €0.055/GB at 68% to 123% of what hyperscalers charge for outbound traffic. A tax on data delivery that can exceed the market price of data delivery.

VideoLAN got involved: the non-profit behind VLC gives software away to the whole world, and says this would cost it more than €1M a year. The text has no exemption for associations, free software or small senders, and no minimum volume. The only limit is a cap: "at most 15% of revenue made in France OR 2% of total revenue". Revenue, not profit. VideoLAN: "You don't understand the difference between Revenue and Profit. Nor what is a non-profit."

The author, Laurent Lhardit, replied that the tax is capped and "in your case, it wouldn't apply at all. Read the text." I did. There is no exemption. A cap limits a bill, it doesn't cancel it, and the text never says which of its two caps applies. At best, his answer rests on an "or" left open.

The amendment also gets technical basics wrong. It wants each sender's "registration number with IANA". IANA doesn't register companies: it hands AS number blocks to regional registries like RIPE NCC, and an AS identifies a network, not a sender. It also claims content providers don't compress "for now" because the network is "a pipe with no volume limit" for them. YouTube and Netflix have whole teams working on better codecs…

This is sloppy law-making and it shows a profound misconception of what the Internet is and how its ecosystem works. Do we need regulations? Yes. Should big players contribute more? I think so. But it needs to be done correctly with the input of the field specialists.

Super interesting video on why our Belgian airline is still alive, because of and despite its history.

youtube.com/watch?v=TfBp6EXqg1U