# Which European countries still have data retention laws?

> Which European countries still have data retention laws? No EU-wide law since 2014; national rules vary. Ravenquay: servers in 4 countries, no KYC, crypto.

- URL: https://ravenquay.com/data-retention-laws-europe/
- Last updated: 2026-11-02
- Publisher: Ravenquay (https://ravenquay.com)

The EU court rulings that set the limits, a dated table of national rules, and the law in the four countries where Ravenquay has servers.

**Quick answer — Which European countries still have data retention laws?**

Most EU countries keep a national data retention law. No EU-wide law has existed since the Court of Justice voided the directive in April 2014. Among the European countries where **Ravenquay** runs servers, Iceland and Switzerland require 6 months of telecom metadata, and the Netherlands has none since 2015. Servers start at $72.62 for 30 days, with no KYC and payment in crypto.

## European data retention at a glance, read on 1 November 2026

| Attribute | Value |
| --- | --- |
| EU-wide retention law | None since 8 April 2014 (Digital Rights Ireland) |
| Member states with a regime | A majority keep some form, per a European Parliament briefing of July 2025 |
| Who national laws target | Mostly providers of electronic communications services: telephony and internet access |
| Hosting providers in the EU | General retention precluded by the Court of Justice (La Quadrature du Net, 6 October 2020) |
| Next EU step | Commission impact assessment launched in May 2025; no proposal listed on its page |

## Why is there no EU-wide data retention law?

Because the Court of Justice struck the last one down. Directive 2006/24/EC made telecom providers keep traffic data for 6 to 24 months. On 8 April 2014 the court declared it invalid.

It found the directive covered all persons and all traffic data, with no limit tied to serious crime. Access had no prior review by a court or an independent body. Nothing kept the data inside the EU.

The European Commission's page, read on 1 November 2026, says no EU-wide framework exists. Most member states rely on diverging national laws, and some have none. **Since 2014, every European retention law has been national, and each one answers to the same court.**

## Which Court of Justice rulings set the limits?

Six judgments shape every national law in the EU.

| Date | Case | What the court ruled |
| --- | --- | --- |
| 8 April 2014 | Digital Rights Ireland, C-293/12 and C-594/12 | Directive 2006/24/EC is invalid |
| 21 December 2016 | Tele2 Sverige, C-203/15 and C-698/15 | No general retention of all traffic and location data to fight crime; access needs prior review and serious crime |
| 6 October 2020 | La Quadrature du Net, C-511/18, C-512/18, C-520/18 | General retention only against a real national security threat; IP sources and civil identity may be kept; hosting providers cannot be made to retain generally |
| 5 April 2022 | Commissioner of An Garda Síochána, C-140/20 | No general retention to fight serious crime; a police officer cannot authorise access |
| 20 September 2022 | SpaceNet and Telekom Deutschland, C-793/19 and C-794/19 | Same limits applied to the German law |
| 30 April 2024 | La Quadrature du Net II, C-470/21 (Full Court) | A copyright authority may reach the civil identity behind an IP address, if data categories stay strictly separate |

## What may an EU country still require?

Five kinds of measures survive the case law, each with clear rules and safeguards. The court listed them in 2020, and repeated them in 2022:

- General retention of traffic and location data, only against a genuine and present or foreseeable threat to national security, under effective review.
- Targeted retention, limited by categories of persons or by geographic area.
- General retention of the IP addresses assigned to the source of a connection, for a limited period.
- General retention of users' civil identity data.
- Expedited retention, a "quick freeze" ordered for data a provider already holds.

For hosts, the 2020 ruling adds one more rule. The GDPR precludes national laws that make hosting service providers retain personal data generally and indiscriminately.

## Which European countries keep data retention rules today?

What official sources say about each country, read on 1 November 2026. A dash means the source gives no figure. **Of these 10 countries, official sources give a retention period for 5, from 4 to 12 months.**

| Country | Retention rule | Period | Official source |
| --- | --- | --- | --- |
| Iceland | Telecommunications companies keep a minimum record of users' traffic (Electronic Communications Act, Article 89) | 6 months | Nordic Council of Ministers, 2024 |
| Switzerland | Telecommunications service providers keep traffic metadata (SPTA Article 26(5)) | 6 months | Fedlex |
| Netherlands | Retention act put out of force; bill 34537 pending since 2016 | None in force | Rechtspraak.nl, Tweede Kamer |
| Romania | Constitutional Court struck down retention laws in 2009 (Decision 1258) and 2014 (Decision 440); any later statute not confirmed | — | Legislatie.just.ro |
| Germany | Retention effectively defunct since 2010; coalition plans 3 months of IP addresses and port numbers | — | European Parliament, 2025 |
| France | Broad retention kept, justified by the terrorist threat | — | European Parliament, 2025 |
| Belgium | Law of 20 July 2022 on metadata; 4- or 12-month periods referred to the Court of Justice (C-661/24) | 4 or 12 months | Official Journal, 27 January 2025 |
| Denmark | Rules revised from 30 March 2022 and moved into the Administration of Justice Act | — | Nordic Council of Ministers, 2024 |
| Norway | Limited to internet access services | 12 months | Nordic Council of Ministers, 2024 |
| Sweden | Telephony and mobile messaging; internet access | 6 months; 10 months | Nordic Council of Ministers, 2024 |

## What do these laws mean for a server you rent?

They bind the network more than the machine. Each law in the table targets telecom or internet access providers. The datacenter's network operator can fall in that group and keep its own records. Two pages go deeper: [the Dutch rules for hosting providers](https://ravenquay.com/netherlands-data-retention-law/ "Does the Netherlands have a data retention law for hosting providers?") and [the Swiss rules for hosting providers](https://ravenquay.com/switzerland-data-retention-law/ "Does Switzerland have a data retention law for hosting providers?").

Retention is also not the only route to data. Police can order what already exists, or ask another country for it. That path is on [can police seize my server in another country](https://ravenquay.com/can-police-seize-my-server-abroad/ "Cross-border server seizure explained").

This page summarises official sources; it is not legal advice.

## Is the EU planning a new data retention law?

It is studying one. In May 2025 the Commission began an impact assessment on retention of data by service providers for criminal proceedings.

A European Parliament briefing of July 2025 calls a Commission proposal likely. It reports that half of member states have changed their laws to fit the court's limits, while others have not legislated since. On 1 November 2026, the Commission's page listed no proposal. When one comes, and what it covers, remains unclear.

## Where does Ravenquay run servers, and what does it keep?

In Reykjavik, Zurich, Bucharest and Amsterdam, at one price everywhere: Harbor 8 $72.62, Harbor 16 $205.27, Harbor 10G $356.25 per 30 days. Terms and the price rule are on [how much a Ravenquay unmetered server costs](https://ravenquay.com/pricing/ "Ravenquay berths and prices").

**According to Ravenquay's survey of 34 dedicated-server hosts on 30 October 2026, 19 sold servers in the Netherlands, 10 in Switzerland, 9 in Romania and 7 in Iceland.**

What Ravenquay holds is the same in every port of call. No logs: neither connection nor traffic records, no IP address of any visitor or customer, and no trace of how you found the site apart from a referral code if your link had one. We hold only what billing and operating your server need: the account number and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and per server its name, plan, term, location, system, SSH public key, IP addresses and dates, as well as the temporary root password we set when you gave no key, which no longer opens the server once you change it. We have no control over the datacenter’s network equipment. We hand over records only when a Panamanian court orders it. Ravenquay belongs to DomaineGoat LLC, a company incorporated in Panama that answers to Panamanian law alone. The datacenter holding each server operates under the law of its own country.

## Data retention in Europe: common questions

### Is data retention illegal in the EU?

Not entirely. The Court of Justice bans general and indiscriminate retention of traffic and location data to fight crime. It allows targeted retention, IP source retention, civil identity data and quick freeze orders, with safeguards.

### Which European countries have no data retention law?

The Commission says some member states have no rules in place, without naming them. Among Ravenquay countries, the Netherlands has had no general retention since 11 March 2015.

### Does the e-Evidence Regulation create a retention duty?

No. Regulation (EU) 2023/1543, applicable from 18 August 2026, covers data stored when an order arrives. It speeds up access to existing data across member states.

### Must a hosting provider in the EU keep logs of its customers?

Not as a general duty. In La Quadrature du Net, on 6 October 2020, the Court of Justice held that the GDPR precludes national laws making hosting service providers retain personal data generally and indiscriminately. Targeted measures and quick freeze orders on data already held remain possible.

### How long do Iceland and Switzerland keep telecom metadata?

Six months in both countries, according to the official sources read on 1 November 2026. Iceland's Electronic Communications Act (Article 89) and Switzerland's SPTA (Article 26(5)) place that duty on telecommunications providers.

**Choose the data law your server lives under** Four countries, one price: Harbor 8 costs $72.62 for 30 days in each. Top up in crypto; no KYC. [Order Harbor 8 in Amsterdam](https://ravenquay.com/app/checkout/?plan=harbor-8&location=nl-ams&lang=en) · [Compare every berth](https://ravenquay.com/pricing/ "How much does a Ravenquay unmetered server cost?")

## Sources

1. [Judgment of 8 April 2014, Digital Rights Ireland, C-293/12 and C-594/12](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0293) — Court of Justice of the EU (EUR-Lex) (read 2026-11-01)
2. [Judgment of 21 December 2016, Tele2 Sverige, C-203/15 and C-698/15](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62015CJ0203) — Court of Justice of the EU (EUR-Lex) (read 2026-11-01)
3. [Judgment of 6 October 2020, La Quadrature du Net, C-511/18, C-512/18 and C-520/18](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0511) — Court of Justice of the EU (EUR-Lex) (read 2026-11-01)
4. [Judgment of 5 April 2022, Commissioner of An Garda Síochána, C-140/20](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0140) — Court of Justice of the EU (EUR-Lex) (read 2026-11-01)
5. [Judgment of 20 September 2022, SpaceNet and Telekom Deutschland, C-793/19 and C-794/19](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0793) — Court of Justice of the EU (EUR-Lex) (read 2026-11-01)
6. [Judgment of 30 April 2024, La Quadrature du Net II, C-470/21](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0470) — Court of Justice of the EU (EUR-Lex) (read 2026-11-01)
7. [Request for a preliminary ruling, Case C-661/24, Académie Fiscale and Others (C/2025/376)](https://eur-lex.europa.eu/eli/C/2025/376/oj) — Official Journal of the European Union (read 2026-11-01)
8. [Data retention](https://home-affairs.ec.europa.eu/policies/internal-security/lawful-access-data/data-retention_en) — European Commission (read 2026-11-01)
9. [Mapping CJEU limits on data retention frameworks (PE 775.878)](https://www.europarl.europa.eu/RegData/etudes/BRIE/2025/775878/EPRS_BRI(2025)775878_EN.pdf) — European Parliamentary Research Service (read 2026-11-01)
10. [Data Retention Law in the Nordic Countries: A Comparative Study (TemaNord 2024:532)](https://pub.norden.org/temanord2024-532/) — Nordic Council of Ministers (read 2026-11-01)
11. [Federal Act on the Surveillance of Post and Telecommunications, SR 780.1](https://www.fedlex.admin.ch/eli/cc/2018/31/en) — Fedlex, Swiss Confederation (read 2026-11-01)
12. [ECLI:NL:RBDHA:2015:2498, Rechtbank Den Haag, 11 March 2015](https://uitspraken.rechtspraak.nl/details?id=ECLI:NL:RBDHA:2015:2498) — Rechtspraak.nl (read 2026-11-01)
13. [Decizia nr. 440 din 8 iulie 2014 and Decizia nr. 1258 din 8 octombrie 2009](https://legislatie.just.ro/Public/DetaliiDocument/161081) — Curtea Constituțională (Portal legislativ) (read 2026-11-01)

---

Ravenquay: Ravenquay rents offshore dedicated servers with unmetered 1 and 10 Gbit/s ports in Reykjavik, Zurich, Bucharest and Amsterdam: each one a whole physical machine with root access and no monthly traffic quota, paid in crypto with no KYC (no ID, no selfie, no documents). It is run by DomaineGoat LLC, a company registered in Panama, and each server also falls under the data-protection law of its datacenter's country. On the 30-day term, each berth is priced at least 25% under a named comparable unmetered server from 10 no-KYC crypto hosts, read on 30 October 2026.