More Than Half of Europe's Privacy Regulators Use US Infrastructure

In May 2023 the Irish Data Protection Commission fined Meta €1.2 billion for transferring European users' data to the United States in breach of Article 46(1) GDPR. The commission's own domain, dataprotection.ie, is delegated to AWS Route 53.

The two facts are not the same kind of thing. The fine concerned Meta's transfers, not the commission's DNS provider. But they sit next to each other, and the question this article asks is how far the dependency runs across the bodies that enforce the GDPR.

We checked the 27 national data protection authorities of the EU member states, plus the European Data Protection Board and the European Data Protection Supervisor, on 10 November 2026. For each we read the authoritative nameservers, the mail exchangers, the final HTTP host after redirects, the delivery headers and the IP network of that host. We counted a provider as US-controlled if the company is headquartered in the United States: Cloudflare, Amazon, Microsoft, Akamai, Proofpoint, Cisco and Fortinet all qualify. We did not try to establish where data is stored, and we did not inspect contracts or traffic.

That distinction matters. A US provider can process data in the EU under an Article 28 data processing agreement and, where personal data is transferred outside the EEA, a Chapter V mechanism such as the standard contractual clauses or an adequacy decision, including the EU-US Data Privacy Framework adopted in July 2023. Cloudflare, AWS and Microsoft offer EU data-localisation options that limit where certain data is handled; those options do not change the provider's corporate control. What this measures is supplier control, not where the bytes sit.

Eleven of 27 for email or web delivery

Seven authorities route their email through a US provider, and six serve their website through a US-controlled delivery network: five on Cloudflare and one on Akamai. Lithuania and Malta appear in both groups, so the union is 11 of the 27, not 13.

The email group is Belgium (Fortinet FortiMail Cloud), Bulgaria (Cisco Secure Email Cloud), Croatia (Microsoft 365), Czechia (Microsoft 365), Greece (Proofpoint), Lithuania (Microsoft 365) and Malta (Microsoft 365). The delivery group is Estonia, Finland, France, Lithuania and Malta on Cloudflare, and Spain on Akamai.

Email is the heavier dependency. A message to a data protection authority can contain a complaint, a data subject request, a medical record attached to a breach notification or a whistleblower's identity. MX records show where mail is routed for filtering. They do not establish the contractual relationship or where mailboxes are stored: the provider may be a processor, a sub-processor, or only a relay. For the authorities that publish a DPA, the provider is named there; we did not inspect those contracts. Delivery is lighter in principle, but a site proxied through a CDN has its TLS terminated and its requests seen at the edge. The edge can be in Europe; the provider is still US-controlled.

Fifteen of 27 once DNS is included

Nine authorities have a US-controlled nameserver on at least one of their public domains: Belgium, Finland, France, Hungary, Ireland, Latvia, Lithuania, Malta and the Netherlands. The providers are Cloudflare, AWS Route 53, Azure DNS and Akamai. Adding the four authorities that only appear at this layer (Hungary, Ireland, Latvia and the Netherlands) brings the total to 15 of 27. Finland is the case where the website and email domains diverge: tietosuoja.fi is on AWS Route 53, but the published email om.fi is on Elisa and valtori.fi. Finland counts for DNS on the website and for delivery, not for email.

DNS is a control dependency, not a data transfer. An authoritative nameserver answers queries about the domain; it does not see the content of the website or the mail. We report it separately for that reason, and the headline number includes it because control of a domain's resolution is still control of a piece of public infrastructure. A reader who wants the narrower number should use 11 of 27. With the EDPB and EDPS, the 29-body total is 17.

The 12 outside the headline count

Eleven authorities have no US-controlled provider at DNS or email on 10 November 2026: Cyprus, Denmark, Germany, Italy, Luxembourg, Poland, Portugal, Romania, Slovakia, Slovenia and Sweden. Their delivery edge is domestic where the HTTP measurement succeeded. Cyprus, Portugal and Slovenia returned no usable page; Austria, the twelfth case, also failed. A failed or blocked HTTP measurement is not evidence of a domestic provider, and the CSV marks each failed or blocked row.

That list is not a clean European-cloud story: Cyprus uses CloudNS, a Bulgarian provider; Luxembourg uses Wedos, a Czech provider; Sweden uses Zetup and Nordlo, both Swedish; Italy uses Fastweb.

Cyprus and Slovenia nonetheless have public IPs on Microsoft and IBM networks. Italy's public IP is Amazon, but the Garante declares Polo Strategico Nazionale, an Italian IaaS provider, for its sites. The address is an IP/ASN attribution, not proof of origin hosting, and the architecture behind it is not established here. If US-controlled public IP networks are counted, the national total is 18 of 27.

At EU level, the EDPB also counts. Its DNS and mail run on Vodafone (AS1273, United Kingdom) and European Parliament infrastructure, but its public host CNAMEs into an AWS application load balancer and resolves to Amazon addresses, so it counts as a delivery dependency.

The pattern

On this evidence, the split does not map neatly onto the policy debate. Germany is on bund.de. Ireland, which handled the largest transfer fine in GDPR history, is on AWS. The European Data Protection Supervisor, the body that supervises the EU institutions' own data processing under Regulation (EU) 2018/1725, answers with an AWS load balancer header on its public site. The regulators still depend on the same providers.

None of this shows wrongdoing. US-controlled infrastructure remains in use at the institutions that write and enforce the rules. A single snapshot cannot establish whether replacement projects occurred, stalled or simply did not reach these layers. For European vendors selling sovereign alternatives, that gap is the market. The buyers are not only companies under NIS2 or DORA. They include the regulators themselves.