A Fresh Look at The World Map of Encryption Laws and Policies

By Ellie McDonald

Lately, every month seems to bring a new headline about a government coming for encryption: from the ongoing fight between the UK Home Office and Apple over backdoor access to end-to-end encrypted iCloud backups, to Canada’s C-22 Bill, and recent proposals in Ireland and Sweden. It can feel bleak.

But that’s not the whole story. Most web traffic is now encrypted, more people are moving to Signal and other applications like it, and governments and security agencies including the United States Cybersecurity and Infrastructure Security Agency and the Swedish Armed Forces have formally advocated for the use of encrypted messaging apps.

On one hand, we’re seeing ever greater adoption of encryption, and on the other, muscular attempts to undermine it, making it hard to tell the speculative from the certain. Comparative analysis across countries can show us which laws are being copied from elsewhere, where advocates should spend scarce resources, and where we’re winning.

That’s why we at Global Partners Digital have relaunched our World Map of Encryption Laws and Policies. With an updated methodology, it assesses laws, policies and practices on encryption across countries so civil society can compare and spot trends. By design, it only covers the legislative environment, and so it does not capture trends in commercial products, such as the integration of AI assistants into encrypted messaging, which raises its own questions about what content leaves the device. It’s not the full picture but a useful reflection of the state of play.

A revised methodology, a new look and updated country research

The map covers 100 countries: 40 are assessed under our updated assessment framework (over 30 are live now, with up to 40 to be added in the coming weeks) and the other 60 continue to reflect the earlier one. Each country is labelled with the assessment framework applied and date of the update.

We adapted the updated framework in several ways. First, we updated the research questions to account for some of the more recent attempts or proposals to break or bypass encryption, such as client side scanning or VPN restrictions.

Second, under the new framework, each country receives two ratings: restrictions show how far its laws and policies interfere with strong encryption, safeguards show how well people are protected against abuse of those powers, with analysis of indicators such as the presence of independent oversight, effective appeal routes, and how often and how intensively powers are used. Under the original framework, only Restrictions were assessed. 

Third, we introduced a more rigorous approach to scoring. Each country reviewed under the updated framework is assessed against 10 indicators measuring the intensity of restrictions (rated minimal, moderate or severe), and 5 indicators assessing the adequacy of safeguards (rated weak, moderate or strong). Under restrictions, one indicator captures and measures the severity of any proposals for reform.

Together, the two layers of assessment aim to provide a holistic picture of the legal framework in a given country as it impacts the use of encryption. The full indicators and research questions are public for researchers to scrutinise, use and adapt. 

While partial, the updated research already shows some trends.

Findings and throughlines

No blanket bans and backdoors*

Amongst the updated countries, none has banned encryption outright. *The asterisk: some laws give a legal basis for a backdoor (such as the UK’s and Australia’s technical notice regimes, discussed below), and some mass surveillance powers get there indirectly, but to our knowledge, no backdoor giving indiscriminate access has been built. That’s a sign advocacy has worked.

VPNs have fared worse. China allows only authorised VPNs, which tend to serve state surveillance, and China and Myanmar block VPN traffic with deep packet inspection. Russia requires VPN providers to connect to its state blocklist system, and block sites on it, turning it into an enforcement mechanism, and Venezuela’s state ISP blocks them. Indonesia prohibits systems like VPNs that facilitate access to prohibited content. The UK recently went the other way: confirming it will not restrict VPNs following concerted opposition by VPN providers and digital rights groups.

Democracies are driving the new proposals

Six countries are rated severe under proposals for legal reform, four of them are established democracies: the UK, Sweden, Ireland and Canada, plus Russia and Myanmar.

Lawful access by design

More laws and proposals are trying to bypass traditional lawful access routes, in which police must get a warrant for data a provider holds, by compelling providers to build an encryption backdoor, which undermine end-to-end encryption (E2EE) and treat everyone’s communications as suspect. 

The UK and Australia already run technical notice regimes that can force providers to build access capabilities, and the UK Home Office is strongly believed to have served Apple with two successive notices demanding access to encrypted iCloud data. Apple is challenging the latest notice at the Investigatory Powers Tribunal, and Liberty and Privacy International are challenging the wider regime.

Others are following. Canada’s C-22 Bill (Lawful Access Bill) would make designated providers build lawful access capabilities and retain metadata indiscriminately, and Ireland and Sweden have floated similar measures. 

Online safety laws at a tipping point

Online safety regulation is a big current amongst surveyed countries: measures range from duty-of-care obligations, detection duties and age assurance. In its earlier forms, the EU’s child sexual abuse regulation (EU CSAM, known colloquially as Chat Control) was the most direct threat, allowing national authorities to issue detection orders compelling providers to scan encrypted channels. 

The UK’s and Australia’s Online Safety Acts both include proactive detection powers, with limits. On an end-to-end encrypted service, complying with such a power would in practice mean client-side scanning: checking content on the user's device before it is encrypted. Australia’s Unlawful Material Standards states that providers aren’t required to introduce a systemic weakness or vulnerability to an encrypted service; in the UK, the powers sit with the regulator, Ofcom, which hasn’t yet activated them. In June 2026, Keir Starmer’s government announced plans to force nudity scanning on the devices of users not verified as over 18. Because the scanning switches off only once a user proves they are an adult, this in practice means age assurance for every device user. Andy Burnham, who became Prime Minister in July, confirmed his government will follow suit.

Age-based social media access and features bans are spreading, with a law in Australia and proposals in countries including Canada, Greece, Indonesia, Thailand, the UK and some US states. Most proposals in the countries we surveyed explicitly exempt encrypted messaging from the scope of bans, however proposals from Indonesia and Thailand have not stated this. There was also an effective challenge in France, where a law banning certain social media platforms for under-15s was struck down by the Constitutional Court in August 2026. 

With the rise of prohibitionist approaches, there is a risk that privacy measures like encryption and tools like VPNs will fall under greater fire. Blunt responses risk cutting young people off from precisely the tools that can help to protect them from data harms.

Privacy erosion by other means

Even where countries don’t restrict encryption outright, indiscriminate surveillance laws and targeted surveillance practices erode privacy. Across the countries surveyed, there were reported cases of hacking, spyware and other device surveillance tools which sidestep encryption, allowing messages to be read before they are encrypted or after they are decrypted. 

Lengthy data retention mandates interlock with broad interception regimes and rules tying SIMs and devices to a verified identity to make surveillance more intrusive. End-to-end encryption protects what people say, but not who they talk to or their location. Retained metadata tied to a verified identity can reveal a great deal about someone without touching their message content. Mexico now ties phone lines to the national ID. Indonesia requires biometric SIM registration. In Vietnam, identity verification, 24-month retention and data localisation provide authorities with the ability to link every account to a verified individual. The effect on encryption is indirect, but material.

Digital authoritarianism

Encryption interference is only one indicator of digital authoritarianism. For instance, Russia’s System of Operative Investigative Activities (SORM) gives real-time, warrantless access to data. Venezuela’s state ISP carries out government-ordered blocks of Signal and Tor. Pakistan has deployed a Lawful Intercept Management System (LIMS) that allows authority to see website content if it’s accessed over HTTP by any Pakistani resident (only metadata if accessed over HTTPS) and its Web Monitoring System (WMS 2.0) allows for the blocking of VPNs or any website containing content deemed “unlawful” by the authorities. China, Kazakhstan and Myanmar use controls to surveil and censor the population. Viewing any of these features solely through an encryption lens would be reductive.

A right to use encryption

The research also brings into focus counter-trends. More laws and policies are protecting encryption. Most significantly, Chile’s Framework Law on Cybersecurity states that everyone has the right to adopt technical security measures such as encryption, the only instrument we found that expressly protects its use. Brazil’s ECA Digital requires privacy by default and strong security for children’s data. Elsewhere, there is increased indirect protection through constitutional guarantees of privacy, data protection or freedom of expression. When Germany said it would vote against EU Chat Control, Justice Minister Stefanie Hubig framed the objection in constitutional terms, arguing that indiscriminate monitoring of private chats has no place in a state governed by law. With the Netherlands, Poland, Austria and others, that was enough to pull the vote, and the Council later adopted a position that dropped mandatory scanning.

The role of civil society in stopping harmful laws

Civil society has played a key role where harmful proposals have been stalled or averted. In Sweden, civil society, technologists and unexpected allies pushed back on the Data storage and Access bill, with the Swedish Armed Forces intervening to warn that its requirement to store and give law enforcement access to encrypted communications “cannot be fulfilled without introducing vulnerabilities and backdoors that third parties can exploit.”

In Nigeria, after concerted civil society engagement, the government’s white paper on its online harms bill recommended excluding encrypted private messaging from scope. In the Republic of Korea, the government scrapped a 2020 draft law that would have punished people for refusing to unlock devices, after experts argued it violated the right against self-incrimination. In the UK, campaigner pressure has helped push Ofcom to use its proactive detection powers cautiously.

Green shoots

Together, these trends and examples point to a way forward: broaden the tent, work across the aisle with feminist and children’s rights groups, build networks, back the field with up-to-date analysis, and get more muscular where needed to effectively protect and promote encryption.

Part of our success has been in better articulating what encryption does for us. It shields our data and communications from corporate or government intrusion. In turn, it enables journalists to do critical investigative work, shields activists and dissidents from government spying, and helps maintain the confidentiality of essential services. It protects our banking details and health records, and gives us more control over how our personal data is collected, used and shared. Encryption is an enabler of our rights and freedoms, which is why we strive to protect it.

Ellie McDonald is a Policy and Advocacy Lead at Global Partners Digital (GPD) where she works to shape human rights-respecting tech policy and governance. She has a particular focus on cybersecurity, encryption and emerging tech. She's previously worked on freedom of expression and equalities issues in advocacy and policy roles at the Equal Rights Trust and ARTICLE 19. She has also run campaigns on children’s social care and global education policy. 

Celebrate, Promote and Defend Encryption Today

Today is Global Encryption Day, the annual day of action when advocates, champions and everyday people come together to celebrate, promote and defend encryption. Now in its sixth year, it includes events from Mumbai to Kakuma Refugee Camp in Kenya, Port Harcourt in Nigeria and Oshawa in Canada, with more running through the end of the month.

The center piece is the Global Encryption Day Summit, Imagine a World Without Encryption: Defending the Foundation of Digital Trust. Ellie McDonald, whose feature on GPD’s relaunched World Map of Encryption Laws and Policies appears above, will present Bans and Scans: Insights from GPD’s World Map of Encryption as part of the event.

Want to appear here? Sponsor a newsletter.

This Week's Links

Link of the Week

• More Perfect Union and the AI Now Institute hosted the People’s AI Assembly, a livestream where organizers, writers and policymakers, including Lina Khan, Naomi Klein, Karen Hao and Arundhati Roy, discussed building a worker-centered response to the AI industry. Watch the recording. https://www.youtube.com/live/JZ7DnHoPLLQ