More Than Half of Europe's Privacy Regulators Use US Infrastructure

A November 10, 2026 snapshot examined the DNS, email routing, and website delivery systems of 27 EU national data-protection authorities, plus the European Data Protection Board and European Data Protection Supervisor. Fifteen of the national authorities relied on at least one US-headquartered provider for DNS, email, or web delivery; considering only email and website delivery, the figure was 11. Seven authorities routed email through US providers, including Microsoft, Cisco, Fortinet, and Proofpoint, while six used US-controlled website delivery networks, mainly Cloudflare. Nine had a US-controlled nameserver for at least one public domain. Counting public IP networks as well raises the national total to 18.

The findings show a practical dependence on US-controlled infrastructure among institutions responsible for enforcing European privacy rules, including Ireland’s regulator and the EU’s data-protection supervisor. They do not establish unlawful transfers or reveal where data is stored: provider control differs from data location, and the review did not inspect contracts or traffic. DNS indicates control over domain resolution, not access to site or email content; mail records show routing, not mailbox storage, and IP attribution does not prove where a site is hosted. The measurements are a single-day snapshot, with some web checks unsuccessful. The central point is that infrastructure sovereignty remains an unresolved issue even for regulators themselves, creating a potential market for European alternatives without proving misconduct by the organizations observed.