Proton, the privacy-first email service based in Switzerland, has published a report on the overwhelming reliance of listed EU companies on US tech services, mainly email. Using DNS lookups, Proton analyzed mail exchange records of all publicly listed companies in the EU to identify their email service providers.

Shockingly, 74% of these companies depend on US giants like Google and Microsoft for their email infrastructure, raising questions about data sovereignty and digital independence. 

In this article, we’ll break down Proton’s findings country by country, highlighting the sectors most reliant on US tech, and why it matters for Europe’s future.

Country-by-Country Breakdown

France: 66% of French businesses rely on US providers, with every publicly listed company worth over €200 billion using a US tech stack.

Even more concerning, the report found that 70% of critical infrastructure providers – think natural gas, electricity, water treatment – depend on US email services. In the automotive sector, which is the country’s largest employer, that figure rises to a whopping 77%.

United Kingdom: The reliance climbs to 88%, with 95% dependence in banking and telecommunications. Even the UK’s $1.1 trillion tech sector has every publicly listed company worth more than €200 billion tethered to US tech.

Spain: 74% of Spanish businesses use US providers, with at least six economic sectors – energy, banks, and tech hardware among them – showing 100% reliance.

Portugal: Nine key sectors, including energy, banks, insurance, and real estate, rely entirely on US email services. Alarmingly, every publicly listed Portuguese software and IT company also depends on them.

Nordic countries: Interestingly, Iceland, Norway, Finland, and Sweden top the chart with over 90% of public companies using US email services.

Why is Over-Reliance On US Tech Companies Bad For Europe?

To understand why this is a critical issue for European companies, we’d need to look into the possible repercussions of outsourcing tech.

1. US Legal Overreach

Under the CLOUD Act (2018), US authorities can compel American service providers to hand over data under a warrant or subpoena, regardless of where the data is stored, even if it’s on EU servers. 

While such orders can be challenged if they conflict with local laws like the GDPR, doing so often involves lengthy legal battles, high costs, and potential sovereignty concerns.

In short, even if your company operates entirely within the EU, using a US-based email provider means your communications could still be accessed under US law, placing your data control in foreign hands. This not only raises security risks but also hands a potential competitive advantage to outsiders.

2. AI Training Risks

There’s also the risk of your company’s data being used, directly or indirectly, for training AI models in the US.

While Microsoft and Google have both denied using customer data (beyond publicly available information) for AI training, they could alter their policies at any time. Precedents already exist:

• Zoom updated its policy in 2023 to allow customer data for AI training, only to roll it back after public backlash.
• Meta planned in 2024 to use public content from Facebook and Instagram users in the EU for AI training, but paused after Ireland’s DPC raised legal concerns.

Big tech companies have shown repeated intent to exploit legislative loopholes to feed their AI models, whether successfully or not. And as the Scarlett Johansson-ChatGPT voice incident proved, user consent is not always a hard stop when commercial incentives are strong.

Why Do EU Companies Rely So Heavily on US Tech?

The obvious question is: why? Why do so many EU companies depend on US-based email services?

The short answer: a lack of competitive alternatives. And that stems from the EU’s relatively slow pace of innovation.

Fragmented Regulations

The EU is made up of 27 countries, each with its own laws and regulations. For a startup trying to scale, this means navigating a complex web of compliance requirements, slowing growth, and limiting the region’s potential for global dominance. In fact, around 30% of EU unicorns eventually relocate outside Europe.

While some might argue that the US also has 50 states with different regulations, they all operate under one national framework. So, regulatory variations are far less in the US, making it easier for companies to scale.

Regulation Over Innovation

The EU has taken a customer-first approach with strict rules like GDPR and the AI Act to protect user data. 

While essential for sustainable development, these regulations can admittedly discourage entrepreneurs from experimenting or innovating, especially in fast-moving sectors like tech.

Weak Investment Environment

The funding gap is stark, too. According to the European Investment Bank (EIB):

• European scale-ups (companies in the expansion phase) raise 50% less capital than San Francisco peers by the time they’re 10 years old.
• Over 80% of scale-up deals in Europe involve a foreign investor, compared to just 14% in San Francisco.
• The US attracts 52% of global venture capital, while the EU manages only 5%.

This combination of underfunding and overregulation makes it harder for EU companies to compete, pushing them toward US providers that offer reliable, scalable solutions already backed by deep pockets.

The Way Ahead

It’s unrealistic to think EU companies will suddenly wake up one day, driven by patriotism, and stop using US tech entirely. These services have become foundational pillars of European business, and you can’t replace the foundation overnight.

What’s needed is a carefully planned, well-articulated vision to gradually reduce US dependency. For starters, companies could adopt EU-based alternatives such as Proton Mail (Switzerland), StartMail (Netherlands), and Tuta (Germany) for email. For cloud storage, options include Tresorit (Switzerland) and Cryptee (Estonia).

France offers a model worth studying. The government has developed La Suite numérique, an open-source collaboration platform with tools similar to Microsoft 365, complete with Visio for unlimited video conferencing, Tchap for secure group messaging, Drive for cloud storage, a native webmail service, and a secure file transfer solution. All data is stored exclusively on SecNumCloud-certified infrastructure in France, safeguarding digital sovereignty.

Ultimately, the EU must foster sustainable homegrown businesses through capital injection and smarter regulation, removing growth barriers while incentivizing innovation. 

Like France, governments should back initiatives that keep data and digital control within Europe. Protecting data privacy is important, but protecting data independence is equally critical if the EU wants to build something truly European without leaning on US tech.