Proton: the illusion of anonymity

Imagine using a messaging service reputed to be ultra-secure… and discovering that it helped identify you. That is what happened to a protester linked to the Defend the Atlanta Forest and Stop Cop City movements in the United States. These activist groups based in Atlanta are notably fighting to prevent the construction of a new police training center, in a municipality that has seen several protests against police violence following the killings of George Floyd and Rayshard Brooks by officers in 2020.

The case dates back to 2024. At the time, the FBI was trying to identify the user of a Proton Mail address used by activists. This web company promises its customers complete confidentiality, stating on its website: "Most email providers, such as Gmail, Outlook and Yahoo, scan the content of your emails and exploit your data. Thanks to end-to-end encryption, you are the only person who can view your emails."

Since Proton is based in Switzerland, American authorities cannot directly request information from it. They therefore go through the Swiss justice system, which can legally compel the company to cooperate. The company then provides the data it holds. Not the content of the emails, which are encrypted and unreadable, but information linked to the account. In this specific case, everything came down to one detail: payment. The user had paid for their subscription with a bank card, leaving a trace in their name. That was enough to trace back to their identity.

Proton regularly reminds users of this point: encryption protects messages, not users’ identities. In other words, even if no one can read the content of your emails, it does not mean you are anonymous.

What Proton can (still) share

An analysis published in March 2026 by the American NGO Freedom of the Press Foundation points in the same direction: Proton is not designed to guarantee anonymity. The service may temporarily retain IP addresses (which provide an indication of our location), associate recovery emails (which may not be anonymous), and must respond to legal requests from Swiss authorities.

The company’s transparency report shows that in 2025, Proton Mail received more than 9,000 requests from the Swiss justice system. It responded to about 89% of them, as required by law. And even if Proton does not directly provide data to foreign authorities, they can go through Switzerland to obtain it.

This is not the first time for the email service. As early as 2021, the company had already provided an IP address (which can, in some cases, be used to trace a person’s identity via their location) in a case involving French activists from the environmental movement Youth for Climate. They were subsequently searched, through the same legal mechanism.

It is therefore important to keep in mind a technical limitation that is often overlooked: with Proton, only the message content is encrypted. The email subject, the sending time, and certain information about the sender remain visible. If you write to someone using Gmail or another standard service, the message may become readable again on the recipient’s side. In short, an encrypted email protects what you write, but not who you are. If you leave traces elsewhere (payment, login, IP address), they may be enough to identify you online.

References:

• Korben

  Proton Mail helped the FBI unmask an anonymous protester

• Le Temps

  Suspected of betraying its principles by handing over a user’s data to the FBI, the Geneva-based company Proton strongly defends itself

• Freedom of the Press Foundation

  Proton Mail is not for anonymity

• Reporterre

  Reputed to be secure, Protonmail provided police with information on climate activists