On November 11, Lina Attalah, founder and editor-in-chief of the independent Egyptian news outlet Mada Masr, will face trial for the second time in just two weeks. This time, she faces charges of spreading false news, an accusation that has become one of the Egyptian government's most frequently used tools for prosecuting journalists. 

The trial follows a conviction on October 27, when Attalah was found guilty of managing an unlicensed news website. The Mada Masr team had repeatedly applied for a license, but their attempts went unacknowledged. The proceedings took place in a single hearing, which Mada Masr states included serious violations of her right to a fair trial. She was sentenced to the maximum fine of 3 million Egyptian pounds (approximately 55,000 USD), forcibly removed from the courtroom, and held for seven hours until the fine was paid. The court also ordered Mada Masr's closure and the confiscation of all equipment belonging to the organization. 

The current wave of repression has also targeted Matsada2sh, a fact-checking and open-source intelligence initiative. Its entire six-person newsroom was violently arrested, illegally detained, and interrogated under torture before being charged with terrorism-related offenses and spreading false news. The team remains in pretrial detention. 

According to CPJ, at least 25 other journalists are currently incarcerated in Egypt. 

Governments seeking to control the flow of information increasingly rely on a combination of legal harassment, financial pressure, criminal prosecution, and restrictions on the infrastructure that makes independent publishing possible. Egypt's media licensing regime is a particularly troubling example. Requiring news organizations to obtain government authorization to operate creates an obvious mechanism for restricting who gets to publish and whose voices are allowed to reach the public.  

The charge of spreading false news is similarly dangerous. Governments around the world have increasingly invoked the language of misinformation to justify restrictions on speech, often without meaningful safeguards against political abuse, as we laid out in our recent submission to the United Nations Office of the High Commissioner for Human Rights. Governments should never be the arbiters of which reporting is permissible, particularly when that reporting concerns their own conduct. 

Why Mada Masr matters 

Founded in 2013, Mada Masr has spent more than a decade doing the kind of journalism that authoritarian governments find most threatening: documenting abuses, amplifying marginalized voices, and reporting on issues that powerful institutions would prefer remain hidden. 

Its reporting has given torture survivors and the families of political prisoners a platform. It has opened space for debate about reproductive rights. It has brought frontline reporting from Sudan and Gaza, and stood alongside refugees facing xenophobic attacks and security crackdowns. 

Emerging as a digital-first publication, in a media environment where traditional outlets were increasingly constrained, being purely digital allowed Mada Masr’s founders to build an independent publication outside the structures of legacy media.  

At a time when only 43% of Egyptians had access to the internet, going fully digital meant taking a big risk, but it was one that has been rewarding: Despite being blocked by the Egyptian government since 2017, Mada Masr has continued to reach Egyptian and global audiences, and Attalah has received numerous accolades, including the Knight International Journalism Award, the Ordre des Arts et des Lettres, and a spot in TIME Magazine’s 100 most influential people (2020). 

Mada Masr has also consistently engaged with technology and advocated for a free and independent internet for the global majority. It has covered dozens of hot-button tech stories in recent years, from Egypt’s Cybercrime Bill and Israel’s use of AI weaponry in Gaza, to stories about the “privacy chaos” caused by biometrics to more personal essays about the importance of the internet and tech. In August, they launched an open call for proposals on original critical reporting on artificial intelligence. 

Mada Masr may be thoroughly Egyptian, but it doesn’t belong just to Egypt. Its team has made into a publication that represents the kind of independent, local, grounded journalism that international audiences need, particularly at a time when international reporting on state repression is lacking. They built on-the-ground networks to center local voices in Sudan (publishing in both English and Arabic on the conflict) and Gaza out of a sense of cross-border responsibility and solidarity. 

This is precisely why its potential closure should concern everyone who cares about a free press. The ability to publish independently, investigate powerful institutions, and to share information without government interference is fundamental to the exercise of free expression.  

From solidarity to action 

The international community has repeatedly expressed concern about restrictions on press and internet freedom in Egypt. More than 100 organizations have now joined statements of solidarity with Mada Masr, and with Matsada2sh.  

These expressions of support matter, particularly when journalists are increasingly isolated and under threat—but solidarity must also translate into sustained political and institutional pressure. 

The international governments and institutions that maintain relationships with Egypt—including those in the European Union, the United Kingdom, and the United States—should make clear that the prosecution of journalists and the forced closure of independent media outlets are unacceptable.  

The cases against Lina Attalah, Mada Masr, and Matsada2sh must be dropped. The journalists who remain in detention must be released. And Egypt's licensing regime, with its profound chilling effects on access to information and independent knowledge production, must be brought to an end. 

There is a particular urgency to defending independent media at a moment when governments are finding ever more ways to restrict the circulation of information. Whether through internet shutdowns, platform restrictions, surveillance, or the criminalization of reporting, the result is often the same: fewer opportunities for people to understand what is happening around them, to challenge official narratives, and to hold power accountable. 

We cannot allow the closure of one of Egypt's most important independent newsrooms and the prosecution of its editor-in-chief to become another routine episode in the global erosion of press freedom. Nor should we wait until the last independent journalists have been silenced before recognizing what has been lost. 

To learn more about Lina Attalah in her own reads, you can read our Speaking Freely interview from January 2026. 

  

The Brazilian National Data Protection Agency (ANPD) plays a pivotal role in the regulation of digital platforms according to new legislation approved in Brazil. Throughout this year, EFF has presented comments, filed submissions, and met with the agency to emphasize crucial guardrails that the enforcement of new regulations should ensure. 

ANPD is responsible for detailing and applying obligations set in Law n. 15.211/2025, which established rules for the protection of children and adolescents in the digital space. While some provisions establish important privacy safeguards, like prohibiting advertising based on profiling of underage users, the law created mandatory age assurance mechanisms for accessing digital products and services. 

We have raised alarms on the privacy and free expression issues around age-gating the internet. Age verification technology is often inaccurate and privacy-invasive. Examples also show how it’s prone to enforcement overreach, resulting in sites blocked beyond legal requirements. In the UK, providers disproportionately restricted several counseling, support and mental health sites under the Online Safety Act. Current age assurance methods risk wrongly walling off adults with no valid IDs, facial differences, physical disabilities, among others. 

We highlighted these concerns in our comments and submissions underscoring that ANPD should avoid a blanket approach to age assurance obligations. Following the legislation, restrictions should apply only to products and services that are inadequate or prohibited to children and adolescents according to categories already set in regulation, with robust protections against subjective and overbroad interpretations. Guarantees such as access to information, freedom to participate in society and meaningful access to technologies also compound what constitutes the best interests of the child.  

Moreover, we stressed that zero knowledge proofs alone fail to ensure strong user privacy, including safeguards that the law itself sought to secure. Our submission explains why other requirements, such as unlinkability, selective disclosure, batch issuance and processing on device, are crucial for achieving greater levels of protection and mitigating privacy harms. Minimum information being shared to the verifier and no “phoning home” to the issuer of a user’s accepted credentials are conditions that prevent actions like collusion and data sharing about the user. 

We also shared inputs about the scope of the law, asking more clarity on which providers are covered by its obligations and the importance of treating differently non-dominant players like federated networks and free software applications. Without that clarity, this could negatively impact beyond gaming and major platforms that are the main target of these regulations. We elaborated on the agency’s regulation of prevention duties, the relevance of modulating them according to the type and structure of providers, and alerted them that their interpretation should not result in general monitoring obligations. 

On another but related front, we sent comments regarding Brazil’s new internet intermediary rules. Here too, ANPD has a critical regulatory role after a Supreme Court’s decision and presidential decrees changed the liability regime initially set in the law known as “Marco Civil.”  

With the turn to notice and takedown mechanisms and duty of care obligations, we emphasized measures to prevent censorship of protected content. These involve ensuring solid means for appeals of restricted posts, avoiding overreliance on AI-based content moderation, strictly tailoring the application of concepts like duty of care and systemic failure, and not normalizing the blocking of platforms and websites.  

We raised concerns about a trend reflected in the new regulation requiring platforms to proactively report user to authorities with unclear guarantees. Finally, we urged the agency to advance essential transparency and accountability measures for enabling greater public oversight over the application of the new regime. 

As we said before, platform accountability under the new rules ultimately hinges on how accountable its enforcement will be by platforms and state institutions. Rigorous commitment to fundamental rights, including freedom of expression, privacy and data protection, is required so that intended protections don’t instead lead to harms. ANPD must uphold this commitment and make sure that new regulations don’t backfire. 

EFF strongly condemns Turkey’s state-led discriminatory, oppressive attacks on feminist and LGBTQ+ organisations, media platforms, student groups, and rights defenders and activists within the country.

Since mid-September, access to the websites and social media accounts of a dozen organizations have been blocked by court order, while over 60 members and activists have been detained, their offices and homes raided, mobile phones, laptops and other digital devices seized, and judicial proceedings launched against them. 

These actions threaten the very existence of the LGBTQ+ organizations targeted, limiting their ability to carry out legitimate human rights work, deterring participation and support, and chilling the free speech rights of not just these groups, but any organization that even reports on LGBTQ+ oppression.

A little over a week ago, an Istanbul court shut down the website and social media accounts of T24, Turkey’s longest running independent digital news organization—which has covered government-backed campaigns against and earlier crackdowns on gay rights groups—alleging it had aired “LGBT propaganda” over the past year. 

It’s all part of Turkey’s efforts to portray LGBTQ+ groups and support networks for those living with HIV as criminal organizations that must be suppressed, purportedly to protect family values. Homosexuality is not illegal in Turkey (unlike Uganda, Nigeria, and Egypt, where it is criminalized), but LGBTQ+ organizations and activists have in recent years faced increased government oppression, including criminal proceedings on allegations related to obscenity and violations of Turkey’s Law on Associations, which regulates the activities of nonprofits.

In its new crackdown, the government is targeting LGBTQ+ groups’ websites and social media channels for alleged obscene posts accessible to children. Kaos GL, Turkey’s oldest gay rights organization, said investigations are being led by the Cyber Crimes Bureau of the Ankara Chief Public Prosecutor’s Office, which took members of its Board of Directors into custody, raided their homes, and searched the organization’s offices, where electronic devices were seized. 

According to Human Rights Watch, prosecutors in Istanbul said those targeted were suspected of “founding, leading, or being a member of a criminal organization,” as well as sex work and drug-related offenses. Publicly available law enforcement and judicial documents about the investigation reportedly don’t say which publications or posts are alleged to be obscene.

The prosecutor’s office launched an investigation of the organization and others under Article 226 of the Turkish Penal Code, which regulates the offense of “obscenity” (without clearly defining it), while the overall operation, dubbed “My Family is Safe” and launched as part of President Recep Tayyip Erdoğan’s “Decade of the Family” program, is being brought under Article 220 of the code. Justifying the crackdown by invoking family values and child safety suggests that the government is trying to enforce a moral code on society based on intolerance of and discrimination against LGBTQ+ people.

New Low for Turkey

Framing the activities of LGBTQ+ rights organizations as violations of organized crime provisions is a new low for Turkey, where free speech and press freedoms have long been under attack. The implication from these raids and investigations is that the organizations’ legitimate civil society work advocating for the rights of queer people—monitoring human rights violations, offering legal aid, running news portals, sponsoring cultural events such as symposiums and film screenings, publishing an online magazine and supporting LGBTQ+ refugees—is suspected of being criminal threatens the basic human rights of the LGBTQ+ community in Turkey.

These actions send a dangerous message to people and organizations exercising freedom of speech and association in support of queer people. Under the penal code, directing a criminal organization is punishable by five to ten years in prison, while merely being a member carries a sentence of two to five years. 

EFF joins hundreds of human, civil, LGBTQ+, and digital rights organizations around the world in calling for the immediate release of all those detained for exercising their rights to freedom of expression, association and legitimate human rights work, and the unblocking of all websites and social media accounts of affected organizations. 

For many LGBTQ+ individuals the world over, the internet can be a safer space for exploring identity, finding community, and seeking support. The anti-LGBTQ+ crackdown in Turkey is not happening in a vacuum—unfortunately we are seeing anti-LGBTQ+ bills restricting free expression and privacy, content moderation decisions that disproportionately impact LGBTQ+ users, and other forms of intolerance around the world. 

We urge international civil society and diplomatic partners to raise awareness of and to speak out against the crackdown, and to publicly show support for the legitimacy of Turkey’s LGBTQ+ organizations and the important work they do to ensure that queer people are safe and free.

This post was co-authored by Sheila B. Lalwani, a doctorate student and recent COMPASS Fellow hosted by EFF.

Age verification proposals are often presented as a simple tradeoff: sacrifice a little privacy to better safeguard children online. But that framing overlooks a more fundamental question. What happens to people who cannot verify their age at all? This is particularly a problem when users are required to prove their age with identity documents.

Age-related restrictions are developing quickly around the world. While they differ radically across jurisdictions, in the past year, we’ve witnessed a sharp uptick toward mandatory age assurance for social media access but also for other high-risk digital services.

For example:

• In late 2025, Australia became the first country to implement a minimum age requirement for prohibiting children under age 16 from creating or holding social media accounts. 
• India passed the Digital Personal Data Protection (DPDP) Act that includes mandatory verifiable parental consent and has undertaken ongoing discussions for social media restriction.
• The United Kingdom passed the Online Safety Act requiring age verification across a swath of services hosting content considered harmful to users under 18. More than half the states across the U.S. have enacted age verification laws. 
• An EU Commission’s expert report recommends a ban on social media access for users under 13. It also recommends mandatory age verification for platforms to ensure that users are ‘age appropriate.’ 

The Access Problem 

Age verification laws that are predicated on the necessity of users possessing a current passport, driver’s license, credit card, or similar documents proving their identity exclude critical sections of populations.  And this problem is global in nature: Millions of people lack government-issued identification or encounter regular challenges to obtaining or updating it. 

Roughly 15 million adult U.S. citizens lack a driver’s license, and a further 2.6 million lack any government photo ID; leaving large groups blocked from online content or services. The UK has a similar predicament: proof-of-age checks are often reliant on passports, driver’s licenses, or other recognized alternatives, which can pose unique challenges to people without these documents.

Much of the advocacy around age verification discusses the privacy harms of age verification. Yet these measures also threaten something more fundamental: equal access to information and the ability to exercise the right to freedom of expression. 

Unfortunately, age verification systems foster unequal access to information and provide an asymmetric solution to find essential information, build community, and weigh in on public discourse. As governments and companies increasingly require users to prove their age before accessing online services, these individuals risk being excluded from large parts of the internet altogether. 

Effects on Global Majority Countries 

Age verification laws reshape who can speak, who can access information, and who gets excluded from the digital public sphere. In other words, age verification is not a neutral safety measure: it presents a structural barrier to disproportionately exclude certain groups—particularly those in the global majority—and alters the architecture of global online expression. Some of these groups are already marginalized offline, and age verification extends that exclusion into digital spaces.

For instance, 850 million people globally do not have ID. Most of these individuals exist in primarily low and middle income countries in Sub-Saharan Africa and South Asia. The World Bank points out that many are members of marginalized groups and more than half of those lacking access to identity documentation also have children whose births have not been registered. Women are particularly vulnerable and are 8% less likely than men to have an ID. Other vulnerable groups, such as adults in low income countries, are less likely to have an ID when they fall below 25 years, as are those with a primary school education or less or those in rural areas. 

A policy paper from EDRi points out that age verification laws provide quick tech solutions but overlook longstanding structural challenges and undermine the universality of the internet. The analysis finds that age verification laws have serious human rights implications and ironically harm the very individuals they deem to protect. Moreover, these laws depend on the collection of harmful mass data that human rights organizations, including EFF, is fighting against—and has for decades. 

For example:

• In Morocco, a push to restrict children’s access would ban under-13s from creating accounts on gaming platforms. This could potentially create challenges for those with IDs that have incomplete information concerning the year of birth. In addition, this push would also impact those who attempt to leave Morocco.
• In Egypt, the lack of ID cards has created challenges for minority groups such as the Baha’i.
• Stateless individuals would also struggle under age verification laws. The Rohingya, the world’s largest population of stateless people, often lack IDs. 
• Kuwait’s Bidoon population also lacks proper identification materials. According to Amnesty International, this leads many to rely on standard civil identity cards, which can be restrictive.  
• Nigeria launched a national program to provide ID cards to its population in 2007. Since then, 64.4 million have registered, but that represents just over 30% of the national population.
• The Kafala system, a practice in several countries across the Middle East, also introduces challenges for age verification laws. Under this legal framework, migrant workers’ legal residency and employment status are bound to a specific employer. This potentially leaves stateless persons or migrant workers vulnerable to forced labor and restricted movements. 

No ID, No Access

Age verification laws are less about confirming the age of a user and more about creating barriers to online participation that many people cannot reliably scale. The net result is reduced access, more data collection, and an increased chance of unequal or mistaken exclusion from accessing information online. 

Nobody doubts the importance of protecting children online. While proponents assert that age verification laws protect minors from harmful material, online harassment, and digital addiction, these laws are not the solution. They subvert fundamental freedom of expression rights and pose significant privacy risks.  

EFF has long warned against age-gating the internet. Age verification technology itself is often inaccurate and privacy-invasive, and as more countries considering implementing ID-based checks, the risks move beyond censorship and surveillance toward excluding some people entirely. That’s why we’re working with groups in the U.S. and around the world to push back against these laws, and why we hope you join our effort.

For more information on how to fight back against dangerous age verification laws, visit our resource hub at eff.org/age

In a new blow to Ola Bini’s legal guarantees, Ecuadorean authorities retained the free software developer and security expert yesterday in Quito and ordered his immediate deportation from the country. He is barred from returning to Ecuador for 10 years. 

According to information released by his lawyer, Bini was intercepted by a car with four people who identified themselves as immigration agents. He was then taken to an immigration office without further information or a formal order from a competent authority. There, officials told Bini that his visa had been revoked but didn’t show any supporting document.  

Bini's defense filed a habeas corpus to safeguard his freedom and prevent his deportation. Yet, Ecuadorian authorities affirmed that the developer represents a threat or risk to public security and the state structure, and must leave the country. The ground for deportation is a secret report which allegedly asserts that Bini committed acts against the security of Ecuador. The defense could not access its contents.  

The deportation hearing started yesterday at 5pm Quito time. Human rights organizations tried to attend the hearing but were denied entry. The hearing was suspended but later reconvened establishing his immediate deportation. Ola Bini was relocated to Quito's airport and must stay there until he flies back to Sweden. 

The case that led to Bini's unfounded criminal conviction has expired (the statute of limitations ran out) and the court had already formally lifted all precautionary measures against him. Yesterday's events open a new chapter in the nefarious persecution of Ola Bini by Ecuadorean authorities.  

Since Bini’s arbitrary arrest in 2019, EFF has reported about his criminal prosecution fraught with misconceptions and rights violations. The script of what happened yesterday follows the same patterns we saw in the entire case, from its outset with unjustified allegations that Bini was a national security risk. The Observation Mission of Ola Bini’s case, joined by EFF and other digital and human rights organizations, has published reports and raised international awarenness about the perils of this case to the protection of rights online and the beneficial work of security experts.  

In a case surrounded by political interests, Ola Bini’s unanimous acquittal by the lower court in 2023 was overturned after the prosecution’s appeal. The majority of the appeals court convicted Bini for attempted unauthorized access of a telecommunications system without actual evidence to corroborate the accusation claims.  

Now, once again we must sound the alarm. Ecuadorean authorities must explain the accusations against the security expert. We will remain vigilant and ensure that at least this time his rights are respected.  

The EU Commission draft law to restrict young people’s access to the internet that it presented last week will come at a high cost: it will put online services behind age gates, expand the use of intrusive age verification, and undermine the privacy of all users. 

The EU Kids Act aims to protect children from risks associated with social media, video games, and AI systems by introducing age-based access rules, safety requirements, and stronger enforcement and oversight measures. It presents itself as building on the Digital Services Act (DSA) and puts into “hard law” some of the safety-by-design measures specified in the non-binding DSA guidelines on minors’ protection. 

The proposal is built around the following elements: social media age “delay”, safety by design, age assurance and parental responsibility, and strong enforcement. Each of these measures are concerning.  

Mandatory Age Gates for Social Media and Video-Sharing Platforms 

Following the advice of an expert panel, the proposal would create a phased access to social media and video-sharing platforms deemed risky—a threshold met simply by relying on personalized recommender systems or offering “uninterrupted content consumption”: no service accounts for children under 13; restricted accounts under tight parental supervision from 13 to 15; and autonomous accounts in a safe-by-design environment from 15 to 18. Full online access is therefore reserved for adults. 

However they’re designed, age gates undermine civil liberties, reduce safety, and create barriers to internet entry, often at the expense of marginalized groups.

If this sounds complex and like a compliance nightmare, that’s because it is. The access delay comes with privacy-intrusive age verification across the board, relying on the EU age verification scheme. For teenagers, this law means significant control in the hands of their parents, who must set up accounts and prove that they are, in fact, parents, adding yet another problematic layer of verification. 

In fairness, the Kids Act’s gradual approach at least appears to be designed with some proportionality considerations, rather than imposing a blanket social media ban. Just last month a French court declared such undifferentiated bans unconstitutional. The EU Kids Act distinguishes between age groups and certain services and follows a risk-based approach. This means, for example, that age verification is not required for existing accounts if the provider can tell with a “high degree of confidence” that the user is above the age threshold—a vaguely specified standard.  

Yet, the law still indiscriminately covers social media and video-sharing, with virtually all mainstream services being covered by the proposal. The broad scope also sits uneasy with the use of age thresholds, which remain a blunt proxy for maturity. What is more, by focusing heavily on safety and harms, the EU Kids Act pays little attention to the privacy and freedom of expression rights of users, as well as the right of children themselves to access information and to participate online. However they’re designed, age gates undermine civil liberties, reduce safety, and create barriers to internet entry, often at the expense of marginalized groups. They also create a powerful infrastructure for control and further entrench the power of big tech. 

The proposal exempts not-for-profit encyclopedias, scientific repositories and educational services, as well as open-source software-developing and-sharing platforms. However, no exceptions are foreseen for small and medium-sized enterprises, which will only foster the dominance of resource-laden tech companies that were already investing in similar measures. And we know that most companies are well-advised to play it safe and use privacy-unfriendly age checks across their platforms. 

Safety by Design Across Covered Services 

The proposal’s second pillar, “safety by design”, casts a wider net. It applies across social media, video-sharing, online games, AI companions, chatbots and even app stores—with varying requirements. Providers must generally make child-safe design the default and can relax from the requirements only if they use age assurance to establish that the user is an adult. 

For example, rules on addictive features such as infinite scrolling, safe account settings, and more choice over recommender systems are to provide a safe internet experience to young people. As regards AI companions and chatbots, the proposal requires companies to design their services to reduce minors’ exposure to emotional dependencies and harmful interactions. Online games are covered as well: they must come with contact protections. The law also makes app stores the gate keeper for age-appropriate access, based on an age-rating system. 

The devil of these measures lies in the details, but all of them raise fundamental rights concerns and some of them seem poorly suited, if at all, to the decentralized architecture of the Fediverse. The requirement for very large online platforms to set up compliance plans before rolling out new services raises additional questions about the risks of transplanting product-safety doctrines of conformity and risk control into speech regulation. Deciding what is “safe” can easily become a question of what content people can access or share.  

Next Steps  

By choosing to regulate all these aspects through the Kids Act, the Commission not only but creates a privacy minefield, it also intermingles the digital fairness agenda with the more fundamental-rights heavy questions of age assurance and access to information. An unfortunate policy choice that will politicize well-intentioned efforts to curb manipulative and addictive design practices (read our position on the DFA). 

It speaks volume that the Kids Act has not gone through a full impact assessment process, which would typically require a systemic check of alternative policy options and stakeholder consultations. Looking forward, we call on the EU lawmakers to pull the teeth of the most harmful suggestions and to make sure that the new measures don’t erode the fundamental rights of all users. 

EFF, Access Now, and Data Privacy Brasil are putting forward recommendations to strengthen robust privacy and data protection safeguards in the context of Brazil's elections. The recommendations stress the close relationship between violations of personal data protection and challenges to the integrity of electoral processes. They underscore how privacy and data protection guarantees are a crucial tool for curbing the targeted spread of false or manipulative content and other problematic strategies used by political actors that are amplified by digital technologies such as artificial intelligence systems. 

The recommendations are part of a broader regional initiative and build on the legal and institutional safeguards already in place in Brazil. They seek to promote greater coordination among oversight institutions, civil society, and digital platforms, and encourage the solid implementation of privacy and data protection guarantees as drivers of electoral integrity. Read the full document below. 

The Link Between the Integrity of the Electoral Process and Privacy 

Protecting the integrity of the electoral process in the face of internet and social media use is a challenge that many policymakers are addressing or are willing to address. Online, content that can affect the integrity of the electoral process is increasingly personalized. This phenomenon is so concerning that it has been identified as one of the main global short- and medium-term risks. 

In an era of generative AI, the economic cost and technical difficulty of producing and spreading false or synthetic content to deceive, manipulate, or simulate authenticity have been considerably reduced. That intensifies concern over the integrity of the electoral process. Meanwhile, online privacy and personal data protection remain unfinished business in Latin America. 

There is an intrinsic connection between the ability to collect and process large amounts of personal data and the way false or manipulative content is created and distributed—on social media and messaging apps in particular, and on the internet in general. For this reason, applying strict laws and policies on personal data protection and privacy makes it possible to reduce the impact of false or manipulative content. This is especially important in electoral contexts, where such content affects and impoverishes public debate, directly affecting political and electoral rights and the integrity of the electoral process. 

This phenomenon predates the emergence of the internet. However, the rise of new technologies accelerates the generation and spread of false and manipulative content. This is supported by the very economic model that sustains the platforms, amplifying its effectiveness and reach. On the one hand, social media platforms have content recommendation algorithms that use personal data to generate profiles to which they can then serve targeted advertising content, including explicitly political propaganda. This technique is known as "microtargeting." 

Political microtargeting seeks to have a direct or indirect impact on democracy. It is used to persuade voters, to encourage or discourage turnout at the polls, or to raise funds using information that is deliberately taken out of context, inaccurate, or erroneous. 

The control exercised by these companies raises serious concerns about people's rights. By having access to massive amounts of personal information, these companies have the ability to shape the content that users see and interact with. This happens through the construction of profiles that can reveal habits, social relationships, political preferences, and opinions, to mention a few examples. Personal data is the fuel that amplifies risks to the integrity of the electoral process. That’s true whether it’s provided by the users themselves or generated by the platforms from their interactions online. 

For disinformation actors, access to sophisticated tools—such as those used to create "deepfakes" through generative AI, or "bots" programmed to spread content and seek to manipulate public opinion—boosts the effectiveness of this microtargeting in terms of quality and scalability, making it harder to detect as false or manipulative content. AI-generated avatars and synthetic characters that simulate voters, influencers, hosts, commentators, or community leaders can produce footage that appears spontaneous, fabricate the voices of artificial political actors, and make it harder for users to identify if a given public statement was created or mediated by technology. 

In this context, paid promotion with nanotargeting seeks to reach increasingly specific profiles with customized content, and AI-based tools are used to assess and map its impact on social networks. Drawing on the personal data of groups of voters, profiles of "synthetic voters" are created to test messages or strategies in search of the most efficient way to influence real voters. 

This rapid expansion of AI systems and hyper-personalization with data can lead to a problem of "epistemic erosion" for democratic societies, as pointed out by the UN's Independent Scientific Panel on AI Governance in 2026. 

At Access Now, Data Privacy Brasil, and the Electronic Frontier Foundation, we point to the enforcement of personal data protection laws and public privacy policies as an efficient mechanism for improving the quality of our democracies and reducing the manipulation of public discourse in digital environments and its impact in electoral contexts. Measures to broaden access to information for electoral decision-making, and to ensure transparency about campaigns' and political parties' use of digital technologies built on the massive processing of personal data, also play a relevant role in guaranteeing the integrity of the electoral process. 

Recommendations for Safeguarding the Integrity of Electoral Processes in Brazil in the Face of New Technologies 

Concern about the effects of spreading false, manipulative, or deliberately decontextualized content is particularly heightened in electoral contexts. From Argentina to Mexico, many countries in Latin America, including Brazil, are holding or will hold significant electoral processes in the coming period. 

Providing the public with quality information from a range of sources is an essential element for the exercise of political rights. In order to safeguard the electoral process, these countries must enforce their privacy and personal data protection laws through their competent authorities, in coordination with their judiciaries and electoral courts. 

Access Now, Data Privacy Brasil, and the Electronic Frontier Foundation propose the following recommendations to protect the integrity of the electoral process by guaranteeing privacy and data protection during electoral contexts: 

1. Strengthen personal data protection guarantees and policies as a key element for the integrity of the electoral process, in particular the principles of necessity, purpose, and proportionality:

• Prohibit the processing of sensitive personal data (such as philosophical beliefs and the labeling of ideological leanings), including inferred data, that reveals or could reveal people's political preferences for the purpose of targeting political content. In electoral contexts, the processing of sensitive personal data is only legitimate when the person has given their consent in advance, explicitly, and with strictly limited and clearly disclosed purposes of use and transfer. 
• Processing must be carried out only on personal data that is strictly necessary for the purpose being pursued. 
• Prohibit adding users to instant messaging groups for political outreach purposes, except in exceptional cases involving lists of political party members or where prior and informed consent has been given by the data subject. 
• Free, specific, and informed consent means that the person is able to make a real choice, set apart from other choices, and does not run any risk of deception, intimidation, coercion, denial of access to products or services, or other significant negative consequences if they do not give their consent. 

2. Political parties, federations, and coalitions must improve the information made available to the general public about their personal data processing activities in electoral contexts, including: 

• The personal data processing policy adopted, in compliance with data protection legislation and electoral legislation, including the measures adopted to prevent breaches of the general protection principles, to record personal data processing operations, to obtain consent appropriately, and to ensure technical and administrative security in data processing; 
• Communication channels where the data subject can obtain information about the processing of their personal data, exercise the rights provided by law, and request to opt out of receiving electronic and instant messages. 
• Information about the profiling they carry out for electoral purposes and about the procurement and use of data-based digital technologies in this context, including for purposes of paid promotion, microtargeting, network analysis, and prediction of voters' reactions or behavior. 

3. Strengthen cooperation mechanisms between the National Data Protection Authority (ANPD) and the Superior Electoral Court in order to: 

• Improve communication channels and strengthen joint initiatives to oversee compliance with data protection guarantees in the electoral context, with the publication of periodic enforcement reports. 
• Identify and dismantle coordinated strategies that compromise the integrity of the electoral process and carry out online activities that pretend to be "organic" and citizen-based when they are in fact funded or coordinated by a party, government, or company, such as bot farms, fake personal accounts managed by a single entity, AI avatars and synthetic characters that simulate real voters in order to manipulate public opinion, among others. 
• Within the scope of their powers, require the preparation and publication of a data protection impact assessment in cases involving the use of sensitive personal data or emerging technologies for voter profiling. 

4. Authorities, political parties, communicators, and social media platforms must ensure, as far as possible, that the population has access to adequate and relevant information for electoral decision-making. 

• Political parties, electoral authorities, and data protection authorities must allocate a percentage of their communications budget to warning about the consequences of microtargeting in electoral contexts; and about the use of AI avatars or synthetic voters to simulate support, rejection, outrage, or spontaneous political mobilization. 
• Strengthen alliances with fact-checkers and other relevant communicators, such as civil society organizations, influencers, and others, to identify campaigns that compromise the integrity of the electoral process and to inform the public about such alliances through different channels, including official government channels.
• Systematize the electoral proposals developed by candidates and their electoral platforms according to thematic areas to facilitate comparison between political parties. 
• Agree on strategies between authorities and online platform companies, including social media platforms and chatbots, at the start of electoral periods, so that priority is given to content developed by electoral authorities. 
• Every body, protocol, or policy created that involves authorities or public entities must be communicated in accordance with proactive transparency standards. 

5. Platforms must disable microtargeting tools for political and electoral content during previously established periods. 

6. Authorities, technical actors, academics, civil society, and/or social media platforms must collaborate in creating an algorithmic impact analysis lab that makes it possible to oversee compliance with these recommendations. 

• Produce reports on the results achieved, in particular those that document the existence of microtargeting, the use of personal data for targeting, and exposure to varied content in electoral contexts. 
• Establish strict cybersecurity protocols so that the labs prevent access to real users' private information. 

7. The authorities responsible for overseeing personal data protection and electoral matters must have sufficient functional, economic, and technical autonomy and independence to guarantee the proper exercise of their powers. 

Brazil's new internet intermediary liability regime is underway. The implementation of changes established by the Supreme Court includes notice and takedown mechanisms and duty of care obligations. Caution is crucial as these measures can create problematic incentives for enforcement overreach and over censorship of protected speech.  

The court in June issued a new decision clarifying elements of its 2025 finding that the previous liability regime was partially unconstitutional. The government also published in late May two presidential decrees that detail how the new rules apply. 

Under the new regime, social media platforms and other internet applications that curate or interfere with posts can be held liable for third-party content if they don’t remove it after being notified by the user seeking take down unless there's a reasonable doubt that the content is unlawful. For certain specific cases, like crimes against honor (e.g. defamation), platform liability still depends on failing to comply with a judicial order.  

For some serious crimes, like human trafficking and crimes against women, applications have a duty of care to remove related content immediately and can be held liable when systemically failing to do so. The precise limits of what constitutes a systemic failure are still unclear. There are also stricter rules for paid ads, boosted content, and bots. 

The previous regime, set by Article 19 of the law known as the Brazilian Civil Rights Framework for the Internet (“Marco Civil da Internet” in Portuguese), sought to protect freedom of expression online by holding internet application providers liable for user content if they failed to comply with a judicial order to remove it. There were specific, limited exceptions to this rule, like the unauthorized disclosure of nude or private sexual images. This was meant to prevent providers from over-removal of user content to avoid legal action. Yet, the court found that this provision failed to sufficiently safeguard democracy and fundamental rights. 

We outlined the thorny context leading to this shift in Brazil’s intermediary liability rules, including Big Tech’s alignment with the far right and hurdles to approve platform regulation in Congress, through a proper legislative process. 

Brazil’s shift is part of broader discussions and changes in response to growing concerns over online harms and digital platforms’ abuses. However, responses focused on platforms’ liability of user-generated content carry important traps and risks—from entrenching dominant platforms’ power over the information flow to escalating arbitrary online surveillance and censorship. The path ahead must prevent this to the extent possible, and the new presidential decrees provide a mixed contribution towards this task. 

New Decrees: Strengths and Flaws  

The government published two decrees regulating the new regime set by the Supreme Court. One introduces changes to its previous regulation, the Decree 8.771/2016, detailing elements of the decision, including additional duties that the court only briefly addressed (Decree 12.975). The other regulates measures to tackle violence against women online (Decree 12.976). 

The Supreme Court's decision didn't establish guidelines to protect users' due process rights when facing content take down and removal demands. Instead, it relies on providers to self regulate, which could lead to over censorship.  

The decrees’ provisions on user notification systems are helpful in this sense. They stipulate that providers must inform users (both the notifier and the content author) about the decision to remove or keep the content up, why, and the means to appeal. The guidance makes explicit that a platform may reconsider and reinstate content after an appeal and must explain its reasons to the party requesting removal and content author. The decrees also address concerns with the weaponization of notification systems, establishing that internet applications must adopt measures to prevent abuses. 

Decree 12.795 reinforces that applications can keep content up after notification when there’s reasonable doubt that the post is unlawful, stating that the analysis should consider the context of the publications, freedom of religion and belief, and any informational, educational, or critical, satirical, or parodic purpose with the aim of ensuring freedom of expression. With these guidelines, it aims to mirror the Digital Services Act's "notice-and-action" approach. Moreover, for sexual related, intimate content, platforms will provide a specific and easily accessible notice channel where victims or their representatives can follow the case. 

One of the most concerning provisions requires applications to proactively report content related to criminal conduct on their platforms to government authorities. Applications must send the post along with information that can identify the user. The Ministry of Justice will regulate this provision, something the Supreme Court didn't touch on in its decision. While it seems to apply just to those providers already required to comply with new content-related obligations (exempting email and videoconference providers, for example), it takes a disastrous step beyond. It’s not only about preventing the spread of unlawful content online; it gets platforms to police and report users to authorities by handing identification information apparently without a court order. 

Decree 12.795 also details the definition of messaging applications that are exempt from notice and duty of care obligations. It excludes features for public dissemination of content and open groups so that the exemption doesn't apply. It's still unclear what exactly open groups mean. Especially regarding end-to-end encrypted applications, it's crucial that duties to monitor and take down don't affect conversations that are under this security architecture. Perhaps more troubling, the Supreme Court stated in its clarification ruling that a judicial order can determine email, voice and video conference, and messaging providers to take down content of private communications. Any measure must respect privacy and free expression safeguards and refrain from undermining end-to-end encryption. 

Furthermore, decree 12.976 importantly addresses the protection of women online, but it contains a broad definition of online violence against women that will guide how platforms handle takedown notices they receive. This definition involves "any act, conduct, or omission that causes (...) psychological, political, or economic suffering (…) in any aspect of their lives, committed, instigated, facilitated, or aggravated, in whole or in part, by the use of digital technologies." Its breadth could unfortunately result in censoring legitimate criticism and other protected speech, which platforms and authorities must avoid. 

The decrees also establish powers to the Brazilian Data Protection Agency (ANPD) to oversee and regulate the new regime. Among controversies, the decrees give ANPD the power to apply penalties for breaches of content-related obligations. These obligations go beyond agency competencies set in the Data Protection Law and the Law 15.211/2025, focused on the online protection of children and adolescents. They are also not clearly covered by Article 12 of Marco Civil as it stipulates administrative penalties for violations of its data privacy provisions.  

We appreciate that ANPD has been open to civil society's demands and concerns. While it’s crucial that the agency conducts its oversight role preserving a proportionality commitment and keeping solid participation channels, sanction powers must be prescribed by law. 

Alerts for the Path Ahead 

It’s true that there are critical platform accountability problems we must address, especially regarding the big players. And yes, platforms should align their policies and practices with human rights standards, including by dealing diligently with the dissemination of unlawful, toxic content. But accountability efforts should look at platforms’ systems and processes and promote measures to put checks on the power of tech giants, instead of having a prevalent focus on policing and reporting user behavior.  

Key digital competition measures to regulate gatekeeper platforms are under discussion in bill 4675/2025, but the proposal is pending in Congress with no clear timeline for approval.  

One important measure is to ensure accountability of take-down requests, including by the government. The Supreme Court’s decision stipulated that internet applications should publish transparency reports of the removal notices they receive. Government institutions should follow suit by periodically disclosing aggregate data of their own requests to online platforms, covering various types of user data and demands for content and account restrictions. Back in 2016, Marco Civil’s regulation decree established that all federal bodies must annually publish statistical reports on their requests of subscriber data to providers. To the best of our knowledge, federal bodies generally fail to meet this provision. ANPD can play a crucial role in stepping up transparency in the implementation of the new rules. 

Ultimately, platform accountability under the new liability regime hinges on how accountable its application will be by platforms and state institutions, and on the regime's commitment to protecting fundamental rights, including freedom of expression and privacy.  

  

 

EFF and ARTICLE 19 have submitted joint comments to the European Commission on draft guidelines for the Digital Services Act’s trusted flagger mechanism. Having long advocated for a DSA that protects freedom of expression while preserving intermediary liability protections and the prohibition on general monitoring, we welcome the Commission's effort to provide practical guidance on how the trusted flagger system should operate. 

The DSA’s trusted flagger system can help platforms identify illegal content more efficiently. But if implemented poorly, it could also encourage over-removal of lawful speech, weaken due process, and give government authorities disproportionate influence over online expression. 

We support the Commission's focus on good practices and illustrative examples, rather than legal interpretations that could inadvertently steer platforms toward particular enforcement outcomes—and argue that the guidelines should include stronger safeguards to protect freedom of expression, due process, and the impartiality of the trusted flagger system. 

We also support the Commission's clarification that the DSA itself does not define "illegal content"; that determination must come from applicable national or EU law. Trusted flaggers submit prioritized notice, but platforms remain responsible for determining whether content is actually illegal. Platforms must therefore conduct careful, informed assessments and should not assume that a trusted flagger notice necessarily warrants restricting content. 

Our submission highlights several areas where the guidelines could be strengthened: 

• Cross-border assessments require caution. Platforms should not rely on a trusted flagger notice to assess legality across Member States, where national legal frameworks may differ. 

• Systemic risks extend beyond content moderation. The DSA's systemic risk framework should not rely too heavily on individual moderation decisions, but should also consider broader platform design choices, including recommender systems. 

• Law enforcement authorities should generally not be granted trusted flagger status. They already have statutory powers under Article 9 of the DSA, and combining those powers with trusted flagger status creates a risk that platforms may treat trusted flagger notices as de facto removal orders, undermining due process and the rule of law. 

• Civil society organizations play an essential role. Civil society organizations help identify illegal content and report human rights abuses, but the guidelines should also recognize that these organizations may face retaliation for their work and should be protected from abusive campaigns that threaten their independence. 

• Trusted flaggers should complement—not replace—existing partnerships. The new mechanism should not sideline existing trusted partnership programs, including collaborations with civil society organizations that do not or cannot hold trusted flagger status, especially those outside of the EU with valuable regional expertise.  
  

Read the full submission here:

Users are always seeking more control over their social networking experience to make it better, whether to improve privacy or enhance flexibility. Interoperability between social networking platforms like Facebook and TikTok has so many benefits that solve those issues.  

Say you’re on multiple platforms because you have friends you follow on different networks, but you’ve decided to choose one platform with better privacy practices. With interoperability, you could switch and still interact with friends who remain on larger platforms. It could also enable independent apps with better privacy controls and more user choice. These are the untapped possibilities that could benefit users in the European Union under the 2022 Digital Markets Act (DMA).  

Yet, the European Commission, in its first review of the DMA, announced in April it had decided not to extend the DMA’s interoperability mandate to social networking and didn’t give a deadline or a timeline for enforcing that part of the Act. The Commission said “there is no clear demand” from users and businesses for social networking interoperability and, in any case, it’s too technically complex at the moment. Meanwhile, the Big Tech platforms that have been slow-walking interoperability over the last two years, erecting a myriad of hurdles for users seeking more freedom to choose other platforms, get a pass.

This is a huge disappointment and a missed opportunity by the Commission. Interoperability dismantles one of the biggest barriers faced by users who want to leave the tech giants’ platforms: the choice between changing to a platform you prefer or staying behind on a platform where all your friends, communities, and customers are.

The DMA, which went into force in 2024, aims to foster more choices for European Union users and encourage competition and innovation by forcing so-called gatekeeper platforms like Meta, Apple, and Google, to open their ecosystems to competitors. The regulation does a great deal to foster the integration of competing services and devices with the ecosystems of very large online platforms that act as gatekeepers. It even requires interoperability for messaging services, despite the significant technical and privacy challenges involved.

So, it’s odd that the Commission is using complexity as a shield against taking on social networking interoperability. The internet already runs on complex interoperable systems. Approaches like ActivityPub, the decentralized networking protocol behind the “Fediverse,” which gave rise to decentralized networks like Mastodon, already exist. The DMA shouldn’t mandate a specific protocol, but it can require meaningful interoperability outcomes.

The argument that there’s no real demand for social networking interoperability also falls flat. Users want the ability to move across platforms, choose the content they’d like to see from platforms, and not be tied down to a single platform. But there’s no way to get there—the platforms are doing little to open their social networking ecosystems. And now you have the DMA’s enforcer saying it’s not going to make them change. Demand for alternatives won’t materialize at scale until users see real progress towards interoperability, something the Commission has the power to do.

Having decided there’s little demand and too much complexity to proceed with mandating social networking interoperability, the Commission said it “will continue to monitor and assess how these services evolve.” This wait-and-see-posture only hurts users and strengthens and further entrenches Big Tech incumbents.

The DMA is supposed to center on the rights of technology users and be the pathway to an internet experience where you decide which software runs on your devices, where it’s easy to find the best products and services, and where you can leave a platform for a better one without forfeiting your social relationships.

Meanwhile, Big Tech is also resisting the DMA’s openness requirements. For example, Apple is supposed to be opening up iOS devices to rival app stores. Yet, the smartphone giant’s plan for opening its App Store levies junk fees and onerous conditions on app makers and is effectively impossible for any competitor to use.

It’s not just Apple pushing back against DMA enforcement. Meta's response is a “pay for privacy “system, in which users who do not consent to Meta’s surveillance will have to pay to use the service, or be blocked from it. Whether their plan complies with the DMA remains under review.

Nowhere in the DMA does it say social networking companies get to install a toll booth for users seeking to benefit from privacy rights the regulation grants them. The future EU Digital Fairness Act is another opportunity to protect users from such practices by declaring them unfair.

The Commission has responded to these developments with investigations, preliminary rulings, and fines. Meanwhile, users are missing out on greater choice and flexibility in how they communicate and connect online.  

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Seeking transparency and accountability in Paraguay’s use of facial recognition, EFF, the Association of Technology, Education, Development, Research, Communication (TEDIC), and the Centre for Justice and International Law (CEJIL) filed a complaint with the Inter-American Commission on Human Rights against the state for arbitrarily denying access to information about its implementation and use of the technology as a tool for mass surveillance that erodes people’s privacy rights. 

The case involves the Ministry of the Interior and National Police’s installation in 2019 of surveillance cameras with facial recognition technology in Asunción. Maricarmen Sequera, a lawyer and executive director of TEDIC, filed an information request with the ministry seeking details and protocols about the implementation and use of facial recognition systems and the personal data processing involved. 

The request sought information about, among other things, whether the state had conducted human rights or data protection impact assessments, as well as if it had developed measures and protocols for avoiding abuses, illicit uses of personal data, and other risks in the deployment of the facial recognition system.

The state denied most of the information requested, arguing that implementation details, protocols, and the processing of individuals' personal data were confidential security information. TEDIC contested the secrecy in courts, but the analyses lagged and ultimately sustained the denial of information. 

The petition filed last Friday (19) cites Inter-American standards upholding the public’s right to access information, particularly in relation to national security, that the Paraguayan authorities disregarded in denying TEDIC’s information request. The petition also argues that the refusal of information violated privacy and the right to informational self-determination.

The petition asks the Commission to recognize a violation of those rights and require the state to deliver the information requested. Further, the petition seeks an order compelling the state to adopt mandatory permanent mechanisms of active transparency regarding the acquisition, contracting, implementation, financing, functioning, and use of surveillance technologies by public bodies, especially those that incorporate processing of biometric data or artificial intelligence systems. 

It also asks the Commission to order the state to mandatory procedures for human rights impact assessments prior to acquiring and using surveillance technologies, particularly those that collect biometric data or use artificial intelligence.

The state’s lack of transparency in this case is not an isolated incident, both in Paraguay and in Latin America, where opacity in matters of security and surveillance is the unsettling rule. The situation gets worse with the increasing normalization of intrusive surveillance technologies by states in the region.

The Special Rapporteur for Freedom of Expression of the Inter-American Commission emphasized that states should disclose surveillance capabilities and contracts, and acknowledge state use of surveillance technologies at a meaningful level of detail, to facilitate essential public debate on the necessary limitations of surveillance in democratic societies and ensure compliance with international human rights law.

We hope that the Inter-American Commission upholds the robust safeguards in the Inter-American System and advances access to information and privacy rights in a case that can set a crucial precedent for the region.

The internet is an essential resource for young people and adults to access information, explore community, and find themselves—both inside countries and across continents. Yet governments around the world continue to introduce and implement legislation requiring all online users to verify their ages before accessing the digital space. In some cases, politicians are going further, putting forth proposals to ban social media for younger users.  

In late 2025, Australia’s government rolled out the first complete ban on users under 16 from having social media accounts. In this sweeping regime, platforms are required to introduce age assurance tools to block under-16s, demonstrate that they have taken “reasonable steps” to deactivate accounts used by under-16s, and prevent any new accounts being created, or face fines of up to 49.5 million Australian dollars ($32 million USD). The 10 banned platforms—Instagram, Facebook, Threads, Snapchat, YouTube, TikTok, Kick, Reddit, Twitch, and X—have each said they’ll comply with the legislation, which led to young people losing access to their accounts overnight. Reddit is currently challenging the law in Australian courts on constitutional grounds. Recent research notes how the ban is preventing teenagers from accessing news in the country. 

In the United Kingdom, rules took effect in mid-2025 under the Online Safety Act that require all online services available in the country to assess whether they host content considered harmful to children; if so, these services must introduce age checks to prevent children from accessing such content. Online services are also required to change their algorithms and moderation systems to ensure that content defined as harmful, like violent imagery, is not shown to young people. 

This approach is reckless, short-sighted, and we’ve already seen it introduce more harm to the young people that it is trying to protect. The UK’s scramble to find an effective age verification method shows us that there isn't one, and we’ve spent years urging UK politicians to abandon any measures that require platforms to collect data or remove privacy protections around users’ identities. 

Earlier this year, Indonesia’s Communications and Digital Affairs Minister, Meutya Hafid, announced that users under 16 would have their accounts on “high risk” platforms deactivated from 28 March. The platforms subject to this ban are YouTube, TikTok, Facebook, Instagram, Threads, X, Bigo Live, and Roblox; with Hafid noting how this policy would make Indonesia “the first non-Western country to delay children's access to digital spaces according to age.”

Similarly, the Malaysian government has recently pushed forward with plans to ban users under 16 from having accounts on social media platforms with at least 8 million users in Malaysia, including Facebook, Instagram, TikTok, and YouTube. Users under the age of 16 are being told to download or transfer their data from these platforms in one month before the restrictions are applied. Platforms failing to comply with the ban may face penalties of up to $2.5 million USD.

In Latin America, Brazil approved a new law in 2025 establishing that providers of information technology products and services directed to children and teenagers, or likely to be accessed by them, must conduct age checks when their products and services offer risks to underage users. Regulation requires age assurance for products and services that are not allowed for children and adolescents in accordance with Brazilian legislation. App stores and operating systems are required to provide age signals for other providers. 

While the law is already in force, full compliance with its obligations is expected for early 2027, after the approval of further regulations and a transition period, and the authority responsible for enforcing the law is the Brazilian National Data Protection Agency. The list of concerns regarding the implementation of the law include: the wide scope of products and services that may fall within age-check obligations, how these obligations can affect non-proprietary operating systems and free software projects, and how effective the law's crucial data protection safeguards will be in a context of likely widespread age checks for accessing content online.

Similarly, the European Union has taken large steps towards mandatory age verification that could undermine privacy, expression, and participation rights for everyone. Politicians are promoting an EU-wide approach to age verification through its age verification “app,” which will be fully interoperable with the Digital Identity Wallet. While this mini-app has been announced as technically ready to be rolled out “for citizens to use,” it comes with its own realm of potential privacy and security concerns, such as long-term identifiers (which could result in tracking) and over-exposure of personal information. 

The European Commission also supports age verification in various legislative initiatives, from proposals that would allow or mandate companies to scan our communication (“Chat Control”) to non-binding guidelines of existing laws, such as the Digital Services Act. The EU Parliament, too, has proposed an EU digital minimum age of 16 for access to social media, a move that aligns with EU Commission’s president Ursula von der Leyen’s recent public support for measures inspired by Australia’s model. To all these initiatives EFF has provided one consistent response: mandatory age verification measures are not the right way to protect young people. 

These proposals restrict the fundamental rights of young people to speak to each other and to access information. They also force all internet users, not just those under a certain age, to upload private data—like a face scan or passport—in order to access a website or service. In considering the vast scope of privacy issues pertaining to the collection, storage, and sharing of this personal information, the problems of age verification in restricting free speech are compounded by these reckless and harmful approaches to verification. 

The problem of censorship and surveillance goes far beyond the borders of the internet. EFF continues to explore support for legislative and litigation challenges that recognize how these laws harm everyone’s rights to privacy, free expression and due process.

For years, civil society organizations, workers, journalists, and human rights experts have warned that major technology companies risk enabling grave human rights abuses when they provide cloud computing, AI, and surveillance infrastructure to governments implicated in violations of international and humanitarian law. While many companies pay lip service to evaluating customers and contracts for human rights implications (lip service Exhibit A: Palantir!), too often those processes fail to provide any meaningful accountability when their standards are not met or are simply ignored. But recent developments at Microsoft suggest that accountability for failing to uphold the human rights standards that a company itself sets, even if incomplete, is possible. 

According to recent reporting, Microsoft’s Israel chief has departed amid an escalating ethical controversy surrounding the company’s business relationships with the Israeli Ministry of Defense. The move follows months of scrutiny, internal dissent, and sustained pressure from inside the organization along with press and civil society, especially after a report by The Guardian revealed that Microsoft technologies were used in systems connected to mass surveillance and military targeting operations in Gaza in ways that appeared to violate Microsoft’s own standards. This did not happen overnight.

In September 2025, Microsoft reportedly suspended certain services after initial investigations raised serious concerns about how its cloud and AI infrastructure may have been used. That alone distinguished Microsoft from many of its peers. Rather than simply dismissing mounting concerns or hiding behind vague claims of neutrality, Microsoft appeared to recognize that providing technology in conflict settings creates real human rights responsibilities. Now, after additional investigation and continued public scrutiny, it appears the company has taken another step, one that should send a strong signal to others that violating Microsoft’s human rights commitments could cost you your job. This is important. 

There is still much more Microsoft should do, of course. The company has yet to fully disclose the scope of its findings, explain exactly which services were suspended, or clarify what safeguards remain in place to prevent its technologies from contributing to human rights abuses in the future. We shouldn’t have to infer the connection between this employment action and the company’s investigation. 

Just prior to reports that Microsoft had fired its Israel Country General Manager, EFF joined Access Now, Amnesty International, Fight for the Future, and 7amleh in a joint May 7, 2026 letter to Microsoft leadership calling on the company to publicly release the findings of its investigation, suspend business relationships tied to serious human rights abuses, and implement meaningful safeguards to prevent its technologies from contributing to further harm. The letter detailed allegations regarding Microsoft’s reported provision of Azure cloud and AI services to Israeli military and intelligence units involved in surveillance and targeting operations, while also pressing the company to take concrete human rights due diligence measures going forward. Those demands remain urgent, even as Microsoft appears to be taking some of the steps we urged.

But even as we push for more, it is important to recognize when a company takes steps in the right direction. Because this is what it means to put human rights commitments into practice. It means acknowledging that human rights policies are not just branding exercises or transparency reports. It means accepting that companies providing cloud infrastructure and AI services have responsibilities when credible evidence emerges that their technologies may be enabling violations of international law. And it means taking concrete action when those risks become known.

The allegations facing Microsoft are serious. Human rights organizations and investigative reporting have documented claims that Microsoft Azure services were used by Israeli military and intelligence units to process large-scale surveillance data, support AI-assisted targeting systems, and sustain military cloud infrastructure during the war in Gaza. The concerns raised extend beyond ordinary business risk; they implicate potential complicity in violations of international humanitarian and human rights law.

Faced with these allegations, Microsoft could have chosen the path many tech companies take: deny everything, attack critics, suppress worker dissent, and continue business as usual. Instead, the company appears to have begun responding to the evidence.

Technology companies are not powerless bystanders. Cloud providers and AI companies make choices every day about who gets access to their infrastructure, under what conditions, and with what oversight. When companies claim to uphold human rights principles, those commitments should have operational consequences. Too many companies, in both international and domestic policing contexts, provide technology to institutions that violate people’s human rights and civil liberties, then fall back on the claim that they are merely providing a service that their customers can use how they see fit. This is an ethical failing that falls short of most companies’ publicly expressed commitments. Microsoft’s recent actions suggest that sustained public pressure, worker organizing, investigative journalism, and civil society advocacy can force even the world’s largest technology companies to respond.

Google and Amazon should especially see this as a clear example to follow. Both companies also provide services to the Israeli Ministry of Defense and have faced years of criticism over those contracts and services, including from EFF. Yet neither has demonstrated the level of responsiveness or accountability that Microsoft has shown. If Microsoft can suspend services, investigate allegations, and make leadership changes amid mounting evidence and ethical concerns, then other cloud giants can no longer pretend that meaningful action is impossible.

The technology industry has spent years insisting that ethics and human rights matter. The real test has always been whether those principles survive when profits, government contracts, and geopolitical pressure are on the line. Microsoft’s recent steps are not the end of that story, but they may mark the beginning of what real accountability can look like.

We’re looking at you, Amazon and Google. If Microsoft can do it, why can’t you?

Poor accountability, feeble control mechanisms, and insufficient legal frameworks have led to systematic human rights violations in the Americas, with no consistent remedy or reparation to victims. What's needed is to materialize essential guarantees and measures to combat repeated surveillance abuses in the region. To help build a path for solutions, EFF launches the guide Tackling Arbitrary Digital Surveillance in the Americas, adding to our extensive work leveraging human rights norms to confront state privacy violations.

The document compiles privacy, data protection, and access to information guarantees established within the Inter-American Human Rights System to provide concrete, actionable guidance to governments in the Americas to curb the vicious cycle of state digital surveillance abuses. It outlines the safeguards and institutional measures necessary to protect individuals and details rules, parameters, and standards to overcome current pernicious practices and trends. 

As concerns over national and public security intensify, countries in the region seem to increasingly normalize the pervasiveness of digital surveillance technologies and their arbitrary use by security forces as a distorted form of protection. However, no actual protection can arise from arbitrary surveillance. 

When public security, intelligence, and law enforcement agencies neglect or harm settled rights in the name of national security or public order, they too become a threat. Tolerating rights violations creates the dire situation that the Freedom of Expression Special Rapporteur of the Inter-American Commission on Human Rights thoroughly analyzed in his report about the serious impacts of digital surveillance on freedom of expression in the Americas.

The great majority of states in Latin America have ratified the American Convention on Human Rights. As such, the parameters and rules our new guide describes stem directly from their obligations before international human rights law. State agents and institutions must take the necessary measures to make them a reality.

As EFF’s guide points out, states must implement clear and precise legal frameworks that:

• define surveillance powers and limitations;
• ensure all surveillance measures pursue legitimate aims without discriminatory ends;
• subject interference with privacy to rigorous necessity and proportionality analysis;
• require prior judicial authorization for digital surveillance measures;
• maintain detailed records of surveillance operations;
• establish independent civilian oversight institutions with technical expertise and enforcement powers;
• guarantee individuals' right to informational self-determination and proper notification; and
• provide effective remedies and reparation for victims of surveillance abuses.

States must also put in place the institutional processes and structures to give effect to these legal guarantees. As we stress in the document, States that embrace the guide’s recommendations will not only comply with their international obligations, but will also build more resilient, rights-respecting security architectures capable of addressing genuine threats without sacrificing the freedoms they exist to protect. 

Civil society leaders, activists, legal experts, public defenders, oversight institutions, and state officials committed to human rights must gather and ramp up the fight against the normalization of digital surveillance abuses in the Americas. We hope that EFF’s new guide can serve as a crucial tool in strengthening this fight, one that we have joined since our early days.

Osama Khalid was just twelve years old when he began contributing to Wikipedia Arabic. In the height of the blogging era, he became a prolific blogger, publishing writings on his home country of Saudi Arabia, meetups he attended, and his opinions and observations about open source technology and freedom of expression. He advocated for internet freedom, contributed time and translations to various projects—including EFF’s HTTPS Everywhere—and was a thoughtful presence at the conferences he attended around the world…all while training to become a pediatrician.

In July of 2020, he was detained amid a wave of arbitrary arrests carried out by the Saudi authorities during the Covid-19 lockdown and initially given a five-year prison sentence. That sentence was later increased on appeal to 32 years, then reduced in 2023 to 25 years, and again to 14 years this past September. In a joint letter that we signed on to in April, the Saudi human rights organization ALQST, which has been leading the campaign for Osama’s release, wrote: “The huge discrepancy between sentences handed down at different stages in the case underscores the arbitrary manner in which sentencing is carried out in the Saudi judicial system.”

So, what was his “crime”? Sharing information online that conflicted with official narratives. Osama’s Wikipedia contributions included pages on critical human rights issues in Saudi Arabia, including the treatment of women’s rights activist Loujain al-Hathloul (herself an EFF client) and Saudi Arabia’s infamous al-Ha’ir prison. His blog, which has since been taken offline, included articles such as one criticizing government plans for the surveillance of encrypted platforms.

Over the years, we’ve campaigned for the release of a number of individuals imprisoned for their speech. Our contributions to the campaigns of Ola Bini, the Swedish software developer who has been targeted by the government of Ecuador for the past seven years, and Alaa Abd El Fattah, have had real impact. These cases are reminders that attacks on free expression are rarely confined to borders: governments around the world continue to use vague cybercrime laws, national security claims, and politically motivated prosecutions to silence critics, technologists, journalists, and activists.

Supporting these two—and others we’ve highlighted in our Offline project—has never been about defending only individuals. It has also been about defending the principle that writing code, sharing ideas, criticizing governments, and organizing online should not be treated as crimes. Public pressure, international solidarity, legal advocacy, and sustained campaigning can shift the political cost of repression—and, in some cases, help secure meaningful protections for those targeted.

That’s why we’re highlighting Osama’s case and will continue to work with partners including ALQST to advocate for his release. Osama Khalid, like so many human rights defenders, journalists, and internet users detained by the Saudi government, deserves to be free.

Internet shutdowns are devastating for human rights. When people are disconnected from the internet and digital services, it impacts all aspects of their life—from accessing essential information, to seeking medical care, or communicating with loved ones, both in that country and externally. But on January 8th, 2026, the government of Iran shut down internet communications for the entire country as a rebellion threatened to topple the authoritarian government. The government then proceeded to execute as many as 656 dissidents over the next 3 months, though the actual number could be much higher. Which is part of the point: shutdowns often precede government acts of violence. 

Iran’s shutdown was hardly an isolated incident. Earlier this month, the U.S. military invaded Venezuela and kidnapped the Venezuelan president shortly after US cyber forces shut down all internet access and power grids for the capital city of Caracas. India routinely shuts off internet access in the Kashmir region, and Syria shut down internet communications as many as 73 times, most recently in 2025. Even the UK recently had a localized temporary internet shutdown. At the time of this writing there are 14 ongoing internet shutdowns worldwide.  

Government shutdowns aren’t the only reason an entire region or country might lose internet access. Hurricanes, earthquakes, and wildfires can take out internet connections in many regions of the world, and will only increase as climate change ramps up. They can completely disable the communications infrastructure relied upon by victims, their families, first responders, and disaster relief efforts. Having an alternate way to communicate in such times can save lives.  

One way to limit the impact of such shutdowns is to prepare in advance by setting up systems and structure for circumvention and resiliency. 

To keep people connected during internet shutdowns and blackouts, communication networks must be operational before and after the disaster or shutdown. To be effective, they must be widespread so that people can get access to them reliably, and they must be usable by a majority of the community. And any viable solution must be accessible and sustainable on a community level, not just to people with vast financial resources or technical knowledge. You shouldn’t have to be a tech wizard to be able to communicate with your neighbors!

Radios

There are many ways for a community to build their own disaster resilient communications. Radios, for example, are cheap, decentralized, and resilient. Many people with moderate technical skill have set up Meshtastic repeaters. Meshtastic is a way to use a common unlicensed radio spectrum and a technology called LoRA to have peer-to-peer decentralized communications with people in your neighborhood or city. When you buy a Meshtastic device (cheap ones cost around $20) you can link it to your phone and send text messages to people in your area without ever touching the telephone network or the internet. Messages are delivered directly from person to person over public radio waves.

There is also amateur radio, also known as ham radio, which has been used in disaster communications for decades. Ham radio requires a license, but allows you to communicate farther than Meshtastic, using repeaters or even bouncing signals off the stratosphere to talk to people on the other side of the planet or even on the International Space Station. It is even possible to access the internet over ham radio. 

Peer-to-peer messaging apps 

Another option for internet communication during a shutdown is peer-to-peer messaging apps. One such project,called Briar, uses the Bluetooth functionality on phones to route messages from device to device until they reach their destination, even in instances where there is no internet. However, Briar faces the same problems many mesh projects do: almost nobody has the app installed and it’s difficult to use. If a mesh chat app isn’t already widely installed before an internet shutdown, it’s going to be even harder to get people to install it en masse once the shutdown starts. 

A similar effort called bitchat has recently gained some attention. Bitchat is a peer-to-peer chat system that routes over Nostr, Tor, and Bluetooth. It is unfortunately tainted in many people’s eyes by being a project by former Twitter CEO Jack Dorsey, but it is open source and runs on both Android and iOS. It was used with some success in Iran during the latest internet shutdown. 

Another option is Delta Chat, which uses PGP for encryption and email for routing, while still being much simpler to use than either technology. Delta Chat is highly regarded in Iran for its ability to route a message through even the tiniest sliver of email access.

Satellite internet 

Satellite internet is an internet connection that uses a connection to a satellite dish to reach the internet, such as Starlink. Since there are no wires and no physical connection to infrastructure, satellite internet is harder to shut down. Satellite internet has therefore been used in many cases to circumvent internet shutdowns, with people sharing bandwidth with their neighbors. Satellites are harder for governments to shut down unilaterally.  Unfortunately when the satellites are owned by tech oligarchs, such as Starlink (owned by Elon Musk), or by allied governments, the owners of those satellites may willingly shut down the network anyway. 

Dreaming of a better future

Ultimately an app that is already widely being used would be the best option for shutdown resistant communication. Imagine if WhatsApp or Signal could fall back to mesh networking over bluetooth or wifi. Even better, imagine if our phones all had LoRA built in so we could have more effective mesh networks! What if our phones all had a connection to a satellite constellation run by an international coalition of hackers? We can dream of a better world and we can build it. 

We can’t rely on tech oligarchs to save us, especially when these same companies and governments are the ones to sever our access to the internet and telecommunications. This is why it's important to set up communication mechanisms before a disaster happens. 

As hackers, it's important for us to build these tools and infrastructure of decentralized communication, to help people learn how to use them, and to set up networks before disaster strikes. Get together with others in your city and start setting up resilient off-grid networks and building community now. 

Before you download or use any of the tools mentioned in this guide check with a lawyer in your jurisdiction or country and make sure you understand what legal risks you might be taking on. 

A previous version of this article appeared in the Spring 2026 issue of 2600 magazine. 

When governments shut down spaces for dialogue, dissent, and collective organizing, the damage extends far beyond a single event. The abrupt cancellation of RightsCon 2026—the world’s largest annual global digital rights conference—is not just a logistical disruption for thousands of researchers, journalists, technologists, and activists—it is part of a growing global pattern of shrinking civic space and increasing hostility toward free expression and independent civil society.

Just days before the conference was set to begin and as participants had begun to arrive in Lusaka, organizers announced that RightsCon would no longer proceed in Zambia or online after mounting political pressure and demands that would have excluded vulnerable communities and constrained discussion. The U.N.’s World Press Freedom Day, which was set to take place just prior to the conference, was scaled down in light of the events, and its press freedom prize ceremony postponed to a later date.

RightsCon has long served as one of the few truly global convenings where civil society groups, grassroots organizers, technologists, and policymakers can meet on equal footing to confront some of the most urgent human rights challenges of the digital age—from censorship and surveillance to internet shutdowns, platform accountability, and the safety of marginalized communities online. EFF has had a presence at RightsCon since its inception in 2011, and had planned to meet with and learn from international partners and present our work during several sessions in Lusaka.

The cancellation is especially devastating because of what RightsCon represents. For many advocates—particularly those from the global majority—it is not merely another conference. It is a rare opportunity to build solidarity across borders, form lasting partnerships, learn from other regions’ experiences, secure funding and support for local work, and ensure that the people most impacted by digital repression have a seat at the table. Holding the event in southern Africa carried particular significance, promising to elevate regional voices and strengthen local digital rights networks.

What happened in Zambia sends a chilling message. According to organizers and multiple reports, the pressure surrounding the event included Chinese government demands to exclude Taiwanese participants and moderate discussions around politically sensitive topics. At a moment when governments around the world are increasingly restricting protest, targeting journalists, cutting funds for human rights work, banning young people from online communities, censoring speech, and criminalizing civil society activity, the cancellation of RightsCon reflects the broader erosion of democratic space online and offline.

Organizations from the digital rights community have spoken out forcefully against the government’s cancellation of the conference, making clear that these attacks on civic participation will not pass unnoticed. Access Now described the decision as evidence of “the far reach of transnational repression targeting civil society.” Index on Censorship’s response warned that the move represents a dangerous escalation in attempts to suppress open dialogue, while IFEX rightly described the cancellation as a blow not just to one conference, but to freedom of expression and assembly everywhere.

We are also heartened to see statements from members of the international community—including Tabani Moyo, who spoke about the impact on the southern African community, and Taiwanese participant Shin Yang, who emphasized the importance of preserving spaces where marginalized communities can safely organize and speak—underscoring that attempts to silence civil society only reinforce the importance of defending open, global spaces for organizing and debate.

Even as this cancellation represents a serious setback, it is important to remember that the digital rights community has always adapted under pressure. Around the world, advocates continue to organize in increasingly difficult environments, finding new ways to connect, collaborate, and resist censorship and repression. Upcoming events like the Global Gathering and FIFAfrica—both of which EFF plans to attend—will bring together members of the community to tackle tough issues. And in the meantime, groups from all over the world are working together to incorporate global perspectives into platform regulations, oppose age verification laws, protect against surveillance, and fight internet shutdowns, among many other efforts.

RightsCon itself emerged from a recognition that defending human rights in the digital age requires international solidarity—and that need has not disappeared.

The conversations that were supposed to happen in Lusaka will continue elsewhere: in community spaces, online gatherings, encrypted chats, and future convenings yet to come. Governments may close venues, restrict participation, or attempt to narrow the boundaries of acceptable speech, but they cannot erase the global movement working to defend a free and open internet.

RightsCon will not go on in Zambia, but we remain heartened and inspired by the strength of the global digital rights community, stand with them in solidarity, and look forward to seeing our allies at the next RightsCon and other upcoming events.

EFF joins 18 organizations in writing a letter to UK policymakers urging them to address the root causes of online harm—rather than undermining the open web through blunt restrictions.

The coalition, which includes Mozilla, Tor Project, and Open Rights Group, warns that proposed measures following the passage of the Children’s Wellbeing and Schools Bill risk fundamentally reshaping the internet in harmful ways. Chief among these proposals are sweeping age-gating requirements and access restrictions that would apply not only to young people, but effectively to all users.

While framed as efforts to protect children online, these policies rely heavily on age assurance technologies that are either inaccurate, privacy-invasive, or both. As the letter notes, mandating such systems across a wide range of services—from social media and video games to VPNs and even basic websites—would force users to verify their identity simply to access the web. This creates serious risks, including expanded surveillance, data breaches, and the erosion of anonymity.

Beyond privacy concerns, the signatories argue that these measures threaten the core architecture of the open internet. Age-gating at scale could fragment the web into a patchwork of restricted jurisdictions, limit access to information, and entrench the dominance of powerful gatekeepers like app stores and platform ecosystems. In doing so, policymakers risk weakening the very qualities—interoperability, accessibility, and openness—that have made the internet a global public resource.

The letter also emphasizes what’s missing from the current policy approach: meaningful efforts to address the underlying drivers of online harm. Many digital platforms are designed to maximize engagement and profit through pervasive data collection and targeted advertising, often at the expense of user safety and autonomy. Rather than imposing access bans, the coalition calls on UK policymakers to hold companies accountable for these systemic practices and to prioritize user rights by design.

Importantly, the signatories highlight that the internet remains a vital space for young people: offering access to information, support networks, and opportunities for expression that may not exist offline. Policies that restrict access risk cutting off these lifelines without meaningfully reducing harm.

The message is clear: protecting users online requires more than heavy-handed restrictions. It demands thoughtful, rights-respecting policies that tackle the business models and design choices driving harm, while preserving the open, global nature of the web.

Digital Fairness in the EU

The next few years will be decisive for EU digital policymaking. With major laws like the Digital Services Act, the Digital Markets Act, and the AI Act now in place, the EU is entering an enforcement era that will show whether these rules are rights-respecting or drift toward overreach and corporate control. With the proposed EU’s Digital Fairness Act (DFA), the Commission is now turning to increasingly visible risks for users, such as dark patterns and exploitative personalization. Its “Digital Fairness Fitness Check” makes clear that existing consumer rules need updating to reflect how digital markets operate today.

But not all proposed solutions point in the right direction. Regulators are already flirting with measures that rely on expanded surveillance, such as age verification mandates—surface-level fixes that risk undermining fundamental rights while offering little more than a false sense of protection.

For EFF, digital fairness means addressing the root causes of harm, not requiring platforms to exert more control over their users. It means safeguarding privacy, freedom of expression, and the rights of users and developers.

If the DFA is to make a real difference, it must tackle structural imbalances. Lawmakers should focus on two interlocking principles. First, prioritize privacy. Reforms should address harms driven by surveillance-based business models, alongside deceptive design practices that impair informed choices. Second, strengthen user sovereignty, which is also a necessary precondition for European digital sovereignty more broadly. Strengthening user sovereignty means taking measures that address user lock-in, coercive contract terms, and manipulative defaults that limit users’ ability to freely choose how they use digital products and services.

Together, these principles would support the EU’s objectives of consistent consumer protection, fair markets, and a more coherent legal framework. If implemented properly, the EU could address power imbalances and build trust in Europe’s digital economy.

Ban Dark Patterns

Dark patterns are practices that impair users’ ability to make informed and autonomous decisions. Many companies deploy these tactics through interface design to steer choices and influence behavior. Their impact goes beyond poor consumer decisions. Dark patterns push users to share personal data they would not otherwise disclose and undermine autonomy by making alternatives harder to access.

The DFA should address this by clearly prohibiting misleading interfaces that distort user choice in commercial contexts. While the Digital Services Act introduced a definition, it only partially bans such practices and leaves gaps across existing consumer law rules. The DFA should close these gaps by, at the very least, introducing explicit prohibitions and clearer enforcement rules, without resorting to design mandates.

Tackle Commercial Surveillance

At the core of digital unfairness lies the pervasive collection and use of personal data. Surveillance and profiling drive many of the harms regulators are trying to address, from dark patterns to exploitative personalization. The DFA should tackle these incentives directly by reducing reliance on surveillance-based business models. These practices are fundamentally incompatible with privacy and fairness, and they distort digital markets by rewarding data exploitation rather than quality of service. At a minimum, the DFA should address unfair profiling and surveillance advertising by strengthening privacy rights and banning pay-for-privacy schemes. Users should not have to trade their data or pay extra to avoid being tracked. Accordingly, the DFA should support the recognition of automated privacy signals by web browsers and mobile operating systems, which give users a better way to reject tracking and exercise their rights. Practices that override such signals through banners or interface design should be considered unfair.

Addressing surveillance and profiling also protects children, since many online harms are tied to the collection and exploitation of their data. Systems that serve ads or curate content often rely on intrusive profiling practices, raising concerns about privacy and fairness, particularly when applied to minors. Rather than turning to invasive age verification, the focus should be on limiting data use by default.

Strengthen User Sovereignty

There is a major gap in how EU law addresses user autonomy in digital markets: many digital products and services still restrict what people can do with what they pay for through opaque or one-sided licensing terms, technical protection measures, and remote controls. These mechanisms increasingly limit lawful use, modification, or access after purchase, allowing providers to revoke access, disable functionalities, or degrade performance over time. In practice, this turns ownership into a conditional rental.

Consumers must be able to use and resell digital goods without hidden limitations and with clear licensing terms. Too often, technical and contractual lock-ins, including remote lockouts and unilateral restrictions on functionality, erode that control. Recent legal reforms show that progress is possible. Rules such as those under the Digital Markets Act have begun to curb technical and contractual barriers and promote user choice. However, many restrictions persist.

The DFA must address these practices by targeting unfair post-sale restrictions and strengthening users’ ability to control and switch services. This means setting clear limits on unfair terms and misleading practices, alongside robust transparency on how digital services function over time. It should also strengthen interoperability and support user control, allowing people to access third-party applications and to let trusted applications act on their behalf, reducing lock-in and expanding meaningful choice in how users interact with digital services.

This is the fifth and final installment of a blog series reflecting on the global digital legacy of the 2011 Arab uprisings. You can read the rest of the series here.

If the Arab Spring was defined by optimism about what the internet could do, the years since have been marked by a more sober understanding of what it takes to defend it. 

Back in 2011, the term “digital rights” was still fairly new. While in the decades prior, open source and hacker communities—as well as a handful of organizations including EFF—had advocated for digital freedoms, it was through the merging of disparate communities from around the world in the 2000s that digital rights came to be more clearly understood as an extension of fundamental human rights.

In 2011, we observed that there were only a few organizations focused on digital rights in the region. Groups like Nawaat, which emerged from the Tunisian diaspora under the Ben Ali regime; the Arab Digital Expression Foundation, formed to promote the creative use of technology; and SMEX, which was initially created to teach journalists and others about social media but has grown to become a powerful force in the region, led the way. Since that time, dozens of organizations have emerged throughout the region to promote freedom of expression, innovation, privacy, and digital security.

Understanding how the digital rights movement evolved in the Middle East and North Africa requires a closer look at the communities that shaped it, and the organizations that are carrying on the fight today. Perspectives from people and organizations that were key to these efforts offer critical insight into how the movement has grown and what challenges lie ahead.

Reem Almasri, a senior researcher and digital sovereignty consultant, says that:

‘Digital rights’ emerged as a term around the Arab Spring, when the internet was still a fairly unregulated space, we were still trying to figure out the tech companies’ policies, and force governments to look at the internet as a fundamental right like water and electricity.

But then the need to converge digital rights to everyday rights—economic, political, social rights—and to connect it to geopolitics has started to be thought about, and to be in discussion as well. And to not look at digital rights as a separate field from everything else that’s affecting it, from the geopolitical context.

Mohamad Najem, who co-founded SMEX in 2008 and has led it to become the largest organization in the region, told me that, at the time, “Nobody gave [social media] a lot of attention in our region.” Their work was “a positive approach to social media, how we can democratize sharing information, how we can share more from civil society, change people’s minds, et cetera.”

“After that phase,” he continues, “we can think about 2012-2013—after the Arab Spring, as an organization we started looking at the infrastructure of the internet, and how freedom of expression and privacy are affected. That’s when we started looking more at what we call digital rights.”

Towards Tech Accountability

In the aftermath of the Arab Spring, social media companies moved from a largely hands-off approach to governance toward more formalized—and often opaque—content moderation systems. Platforms expanded their trust and safety teams and began working more closely with civil society through trusted partnerships in the region and globally. But, Mohamad Najem says:

After the expansion of tech accountability itself and the adaptation of tech companies, we’ve noticed that it’s not taking us anywhere. Gradually we’ve come to a new phase where it feels like tech accountability is an economy by itself that is not leading to real results. So the next phase for us at least and maybe for others in global majority communities is how we can focus on digital public good, how we can push more governments, private and public institutions to adopt more open source software, to look at the ecosystem and understand the US threats happening now, et cetera.

Another group that has played a key role in the fight for digital rights and tech accountability in the region is 7amleh, a Palestinian organization that was founded in 2013. At the time, says Jalal Abukhater:

[I]t was unique and interesting in Palestinian society to have a human rights organization dedicated fully to the topic of digital rights, you know, human rights in a digital format. However, with the years, we saw various milestones, we saw progress of policy decisions and movements through the Israeli government to influence content moderation in Big Tech companies. We saw problems there as an organization.

7amleh took a leading stance in fighting to preserve the digital rights of Palestinians during a period where there was a very strong influence through the Israeli government. There was actually quite important reporting coming through 7amleh on the situation of online content moderation at a time when it wasn’t really a topic being discussed but it was very clearly a situation where there was major influence by government and political suppression happening as a result.

An Ever-Expanding Ecosystem

While in the early days, the digital rights movement attracted specialists, today, people from other fields have recognized how digital rights intersect with their work, and the digital rights community has embraced them.

Almasri says:

Because the digital rights movement has been decentralizing and has stopped being a speciality, it stopped being an exclusive thing for digital rights specialists, since of course the internet not only in the Arab region but all over the world has become a fundamental infrastructure for running any kind of sensitive operations, or operations in general…all types of organizations, and companies, and initiatives are thinking about their digital security, about how internet laws are affecting the use of the internet, or putting them at risk, and how surveillance technologies are affecting their operations.

Abukhater credits the collaborative work that emerged within the region over the years in building the movement’s strength:

[Today], civil society and digital civil society have many forums, many coalitions and networks, but it’s always important to remember that this is work that builds over many years of experience, and relationships, and networks—that it’s different parties coming to support each other at different phases to ensure that this kind of work succeeds and that this ecosystem is sustained globally with support from partner organizations which were very crucial in ensuring that this ecosystem is sustained, especially in Palestine.

Growing Collaborations

Conferences like Bread and Net, first held in Beirut in 2018, and the Palestine Digital Activism Forum (PDAF), first held in Ramallah in 2017, bring activists, academics, journalists, and other practitioners together to network and learn about each other’s work. The pandemic, conflict, and other barriers haven’t stopped either conference from carrying on: PDAF has become an annual virtual event that draws big-name speakers, while Bread & Net has spaced out its meetings but continues to draw bigger crowds each time. 

Almasri credits these meetings with expanding the movement beyond the traditional techies and activists who first got involved. “You see a wide spectrum of different fields. You see artists, archivists, journalists joining these conversations, which is definitely on the brighter side of things when it comes to this field, or this scene.”

She also credits the emergence of alliances such as the Middle East Alliance for Digital Rights (MADR, of which EFF is a member), founded in 2020 by individuals and organizations who had been working together for many years to formalize those collaborations.

“Other than the collaborations at the advocacy level, [MADR] creates a sort of pressure point on Big Tech, on content moderation policies, allows for certain coordination at the level of the UN, et cetera, which I see as really positive because it brings some of the redundant efforts together and helps decide on priorities.”

Looking Forward

In thinking about the future of the movement, Almasri and Najem agree that digital rights are no longer a niche. In Najem’s words, “It’s about everything else…it’s about everything.” 

Almasri adds:

[W]hen it comes to priorities, things that this scene has been working on, I feel that October 7 [2023] was a big turning point in the way that digital rights activists, researchers, and academics—this field—is looking at digital rights in general. Of course, there is the major question of the need to revise tactics to fight Israel’s tech-enabled genocide that is also empowered by the global economy, big tech, and governments of the world?  What alliances should we start building on a regional and global level?

She sees ‘digital sovereignty,’ the ability of people and communities to choose, control, and use technology that serves their needs and values, as one of the next big topics for the movement to tackle, as debates over who owns and hosts our data have sharpened amid revelations that U.S. companies have played a role in regional conflicts.

There have been pockets of debates on how to achieve digital sovereignty, especially from human rights organizations documenting war crimes … There’s an awareness of how the dependence on US-based providers, cloud storage, even hosting infrastructure is a risk, especially after how using these services has been weaponized against the digital existence of certain organizations in the region that have been deplatformed or had their content removed on platforms like Meta and YouTube because their content doesn’t align with the foreign policy of the United States…so it raises a big question about how we look at digital independence, what is the spectrum of independence that civil society in the region can achieve, and in relation to what’s available as well.

Almasri also points to the role of researchers in the region:

There has been a lot more research on the political economy of surveillance technologies, so not only looking at how governments are using them, but their supply chain, who’s investing in these technologies, and how geopolitical networks empowered their proliferation in the hands of governments.

This is where studies looking at the political economy of AI and the military become important, trying to understand how this field of weapons, the military, and AI grew together as part of this global capitalist system rather than looking at these technologies in silos, that is. Looking at the proliferation of these technologies from a geopolitical point of view, looking at the bigger ecosystem rather than zooming in to the specifics of it. I think this has been a big development in the way that we look at digital rights, and the way that digital rights have been converged and integrated into the geopolitical scene.

As the global digital rights community continues to expand, it’s clear that the questions at its core are no longer just about access or expression, but about power—who holds it, how it is exercised, and who is left out of its protections. What began as a fight to keep the internet open has become a broader effort to reimagine it—an effort that is grappling with questions of infrastructure, ownership, and the global inequalities embedded in both.

And yet, despite the scale of these challenges, the movement’s strength lies in the solidarity, the ecosystems, and the networks it has spent more than a decade building. From the early days of the blogging and techie communities to the increasingly powerful digital rights community, advocates in the region have gone up against dictators, endured war and repression, yet remain determined to push forward.