You use NordVPN, ExpressVPN, or Proton VPN with European servers. You tell yourself: "my data is out of reach of the United States." That's false. Here's why.
What is the CLOUD Act?
The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) was signed into US law on March 23, 2018. In short: US courts can compel any American company to provide data stored on its servers, regardless of which country those servers are in.
The exact text
« A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States. »
NordVPN is registered in Panama but operates under US law for certain services. ExpressVPN has been owned since 2021 by Kape Technologies, listed on the LSE but with close ties to the USA. Proton AG is Swiss — one of the rare VPNs genuinely beyond direct CLOUD Act reach, but watch out for third-party dependencies in their infrastructure.
Three documented real cases
IPVanish — 2016
The "no-log" VPN that handed logs to the FBI
IPVanish displayed a "zero log" policy on its website. In 2016, the company provided user identification information to Homeland Security Investigations. The revelation came from a public court proceeding in 2018. The no-log policy was marketing — not a technical guarantee.
PureVPN — 2017
Assisting identification of a cyberstalker
PureVPN helped the FBI identify a cyberstalker by providing connection logs — despite a clearly displayed "no-log" policy. The company was registered in Hong Kong, but its servers and American clientele placed it in FBI jurisdiction. The "unlogged" data existed after all.
Lavabit — 2013
Shutdown rather than compromise
Lavabit was the encrypted email service used by Edward Snowden. In 2013, the FBI demanded the SSL keys for the entire server — potentially compromising all users. Founder Ladar Levison chose to shut down his service rather than comply. This case illustrates that even a resistant company can be forced or shut down.
CLOUD Act vs GDPR: who wins?
The legitimate question is: "doesn't GDPR protect European data?" In theory, yes. In practice, it's more complex.
| Criterion | GDPR (EU) | CLOUD Act (USA) |
|---|---|---|
| Scope | Companies processing European data | US companies, anywhere in the world |
| Mechanism | Civil law — complaints, fines | Criminal law — binding court order |
| In case of conflict | US company must notify foreign government | Can ask US judge to quash if manifest conflict |
| Practical result | US company generally hands over data | Immediately applicable under contempt of court |
In practice, in the vast majority of documented cases, American companies have chosen to comply with the CLOUD Act rather than risk contempt of court — even when it violated GDPR.
What this means for you practically
- The geographic location of servers doesn't protect you if the company managing them is American or depends on a US entity
- "No-log" policies are not technical guarantees — they can be marketing or simply inaccurate
- The only real protection is to control your own infrastructure, in a jurisdiction not subject to the CLOUD Act
- Protective hosting providers: Infomaniak (Switzerland, strict data protection), 1984 Hosting (Iceland), UpCloud (Finland, sovereign GDPR)
The solution: self-host out of reach
The CLOUD Act targets American companies, not individuals who host their own infrastructure. A European individual or SME managing their own VPS at an Icelandic hosting provider is not subject to the CLOUD Act.
That's exactly what the Sovereign VPN with Headscale tutorial enables: deploying your own WireGuard server at a hosting provider beyond any US influence, in under 2h30.
Important nuance
A sovereign VPN protects you from mass collection and passive surveillance. Against a targeted judicial investigation with international cooperation, the level of protection also depends on the laws of the country where you are physically located. That analysis is beyond the scope of this article.