Few services stand for secure, encrypted email like ProtonMail. Which made a 2021 case all the more striking: the provider logged a user's IP address and passed it to the authorities — leading to an arrest. What had happened, and what does it teach us?
What happened in 2021
French investigators wanted to uncover the identity behind a ProtonMail account that a climate activist group ("Youth for Climate") used to communicate. The request went through Europol to the Swiss authorities. They issued a legally binding order forcing ProtonMail to log and hand over the IP address and information about the device used for this one account. This led to the activist being identified. Proton had no way to challenge the order — under Swiss law it was valid.
What Proton did not do
Important for context: ProtonMail could not read the content of the emails — it is end-to-end encrypted. What was handed over was metadata (IP address, device type) for a specifically named account. There was no backdoor and no voluntary cooperation: according to Proton's CEO, nothing ran directly with the French police or Europol — the order was issued by the Swiss authorities.
The real lesson
End-to-end encryption protects the content of your messages — not the metadata. Your IP address reveals where and when you connect from; that can be enough to identify you. And: no provider stands above the law of its own country. The marketing ("we don't store IP logs") described normal operation — not what is possible for a single account under a valid court order. Proton has since clarified this wording and explicitly recommends Tor for IP protection.
Being fair
Proton acted lawfully, could not read any content — and in 2021 even won a case before a Swiss court establishing that email services do not have to carry out data retention. The point is not "Proton is bad," but rather: trust the architecture, not the promises. What never accrues technically in the first place cannot be handed over either.
What this means for you
- Hide your IP? Use Tor — then the service never sees your real IP in the first place. Our Whonix guide shows how to set up Tor cleanly.
- Minimize metadata: services without a phone number and without logs, ideally on their own no-logging server — that is exactly what VOID is. More on this in Metadata: What Your Messenger Reveals.
- Harden your device: a degoogled, up-to-date system as the foundation — the SaferPhone models with GrapheneOS.
Conclusion
The ProtonMail case is no reason to demonize Proton — but an important reminder: encryption is necessary, but not sufficient. Anyone who needs anonymity must also protect their metadata (Tor, no identity anchor, a minimal data trail). Rely on what technically never accrues.