Is Proton leaving Switzerland? What we know in 2026
Proton has not said it is leaving Switzerland as a company. In July 2025, Proton said it was "moving most of its physical infrastructure out of Switzerland" because of a proposed Swiss surveillance rule, starting with its AI assistant, Lumo. As of October 31, 2026, that rule is not in force: Swiss officials plan a second public consultation, currently foreseen for late 2027.
Below is what the Swiss proposal says, what Proton has said and done, and what it means for an account today. Everything is taken from Proton's own pages and from official Swiss government publications, with dates.
What is the Swiss proposal?
The proposal is a partial revision of two ordinances under the Swiss law on the surveillance of post and telecommunications (BÜPF). The ordinances are known by their German abbreviations, VÜPF and VD-ÜPF, and in English as the OSCPT. The explanatory report from the Federal Department of Justice and Police (FDJP) is dated January 8, 2025, and the public consultation ran from January 29 to May 6, 2025.
In plain terms, the draft sorts providers of "derived communication services" (a Swiss legal category that, according to the explanatory report, includes email services, webmail and email apps among them, and messaging apps) into three tiers based on size:
- Minimal duties: fewer than 5,000 users and under 100 million Swiss francs in annual revenue. These providers must tolerate surveillance and hand over data they already have, but have no identification duties.
- Reduced duties: 5,000 to just under 1 million users. These providers take on basic information and user identification duties, including keeping subscriber data.
- Full duties: at least 1 million users, or annual revenue of 100 million francs or more in each of the last two business years. These providers take on all information and identification duties, must keep metadata (records of who communicated with whom and when, not the content) for six months, and must be on call.
The draft also includes an article on removing encryption that a provider has itself applied. The FDJP's results report notes that respondents asked for end-to-end encryption to stay explicitly outside its scope.
What Proton has said and done
Proton's clearest statement is in its Lumo launch post, published July 23, 2025. Proton cited "legal uncertainty around Swiss government proposals to introduce mass surveillance," which it described as proposals "that have been outlawed in the EU." It then said: "Proton is moving most of its physical infrastructure out of Switzerland. Lumo will be the first product to move."
In the same post Proton said: "This shift represents an investment of over €100 million into the EU proper." It added that it would keep opposing the proposals in Switzerland: "we do not give up the fight for privacy in Switzerland".
On August 19, 2025, in a post offering discounts to Swiss businesses, Proton named the revision directly: "it's also important to avoid regulations that would undermine individual privacy and force tech companies to potentially leave Switzerland, such as the harshly criticized OSCPT revision."
Proton also took part in the official consultation. The FDJP's results report lists Proton among the respondents that expressly rejected the draft. In its summary of the economic objections, the report says (our translation from German) that companies including Proton "see their existence threatened and are considering leaving Switzerland as a location."
I could not find a later Proton post saying the infrastructure move is finished, paused or reversed. Proton's blog, news page and press page did not have one as of October 31, 2026.
What has happened since
Three things are on the record.
- The consultation results are out. The FDJP published its results report dated February 11, 2026. It counts 194 responses, 58 of which expressly declined to comment on the substance. According to the report, the cantons broadly welcomed the draft, while providers and private individuals were mostly critical. Two parties in parliament, the FDP and the Greens, and the business groups economiesuisse and SGV firmly rejected it.
- A second consultation is planned. The Swiss federal publication platform, Fedlex, lists a new procedure for the same two ordinances, titled in German as a "second consultation procedure" (zweites Vernehmlassungsverfahren). Its record was created on December 11, 2025, and its foreseen dates are November 1, 2027 to February 1, 2028. It appears under planned consultations.
- The 2025 draft is not in force. The legal basis page of the Post and Telecommunications Surveillance Service (PTSS), published August 5, 2026, lists the most recent ordinance changes as those adopted on November 15, 2023, in force since January 1, 2024.
So the honest status is: the proposal was consulted on, drew heavy criticism, and is going back out for a second round. What the next draft will contain has not been published. Fedlex dates for planned consultations are forecasts and can move.
What it means for your account today
Nothing in the official record changes how a Proton account works today, because the revision has not been adopted. Here is what Proton's own pages say right now:
- Who runs the service. Proton's privacy policy, last modified May 12, 2026, says the services are operated by Proton AG in Geneva and are "governed by the laws and regulations of Switzerland."
- Where mail servers are. Proton's Mail security page says: "We have invested heavily in owning and controlling our own server hardware at several locations within Switzerland".
- Current legal position. Proton's Switzerland page says that in October 2021 the Swiss Federal Administrative Court "ruled that email companies cannot be considered telecommunication providers," and that, as a result, Proton is not required to follow the surveillance law's mandatory data retention rules.
- Encryption. On the same page, Proton says that "even if Proton were forced to turn over all our computer systems, your email contents, items in cloud storage, calendar events, and other data would continue to be encrypted." That is Proton's description of its own design.
If Proton moves infrastructure for Mail, Drive or VPN, its own security and legal pages are the ones to check.
FAQ
Is Proton Mail leaving Switzerland?
Proton has not said Proton Mail is leaving. Its July 2025 statement was about moving "most of its physical infrastructure", with Lumo first. As of October 31, 2026, Proton's Mail security page still describes servers at several locations in Switzerland.
Is Proton VPN leaving Switzerland?
I found no Proton statement specific to Proton VPN. The July 2025 statement covers Proton's physical infrastructure in general and names only Lumo.
Has the Swiss surveillance law passed?
No. The 2025 draft revision of the VÜPF and VD-ÜPF is not in force. Fedlex lists a second consultation, currently foreseen for November 2027 to February 2028.
Does this change my encryption?
Not today. The draft has not been adopted, and Proton says its data would "continue to be encrypted" even if it had to hand over its systems. Consultation respondents asked for end-to-end encryption to stay outside the draft's encryption article; the next draft has not been published.
Where can I follow updates?
Proton posts company news on its blog. The official Swiss record is on Fedlex under planned and ongoing consultations, and the PTSS legal basis page lists what is in force.
If you want a second inbox
You don't need to do anything because of this story, but some people like to keep a second account. Secria Mail has a guided "Import from Proton": save your mail as EML files with Proton's free Mail Export Tool, then open Settings > Import & export > Bring mail in. Mail is encrypted in your browser before upload, original dates are kept, and import works on every plan, the free one included. Post-quantum encryption (ML-KEM-1024 with X25519) is on by default on every plan, and signing up needs no phone number and no card.
Our step-by-step guide on how to export Proton Mail emails covers the export, and the Proton Mail comparison page covers how the two services differ.
Secria fact-checks every post against primary sources. Spotted something wrong or out of date? Email hq@secria.me and we will correct it.