Signal Threatens to Leave France Over Proposed Encryption Backdoor Law

Update: Following the publication of this article, we were informed that the French parliament voted against the controversial bill, so the threat to people's privacy has been negated, for now. However, it is often the case that governments retract law proposals when those are met with fierce resistance from the public only to reintroduce them as articles within other, seemingly unrelated law amendments. That said, public awareness and vigilance remain key in safeguarding privacy rights.

Signal has warned it will exit the French market if a controversial surveillance bill—dubbed the “Narcotrafic” law—is passed with provisions that would mandate backdoors into encrypted messaging platforms.

The warning came directly from Signal Foundation President Meredith Whittaker, who posted a statement on X, criticizing the law's proposed mechanism allowing government agents to be silently added to private encrypted chats.

Whittaker called the scheme a “ghost participant proposal” and emphasized that any such mechanism constitutes a backdoor, undermining end-to-end encryption by design. She affirmed that Signal would “exit the French market before it would comply with this law as written.”

Law proposal raises widespread concerns

The draft law, which is framed as a response to organized crime and drug trafficking, has already passed France's Senate and is now under debate in the National Assembly. Among its most contentious provisions is one that would compel secure messaging services to enable law enforcement to access encrypted communications within 72 hours of a legal request. Providers who fail to comply could face penalties up to €1.5 million for individuals or 2% of global annual turnover for organizations.

The controversial provision was previously removed by a parliamentary commission but has since been reinstated via amendments from centrist and right-wing lawmakers. La Quadrature du Net, a French digital rights advocacy group, has issued strong opposition to the law, warning that the surveillance powers it grants extend well beyond drug trafficking and could be used against activists and protesters. The group has labeled it as “one of the most repressive and dangerous texts of recent years.”

Beyond encrypted messaging, the bill includes far-reaching surveillance capabilities, such as allowing police to remotely activate microphones and cameras on personal devices, authorize bulk data collection through “black boxes,” and censor online content tied to drug-related offenses. The “dossier-coffre” provision would also allow investigators to withhold surveillance details from defendants, significantly undermining legal transparency and the right to defense.

Signal, a non-profit secure messaging service used by journalists, activists, and millions of privacy-conscious users globally, has been a vocal defender of encryption standards. Whittaker emphasized that breaking encryption in one jurisdiction compromises security everywhere, stating that “communications don't stay within jurisdictional boundaries.” She warned that creating a technical mechanism for government access not only undermines trust but also creates a global vector for abuse by malicious actors.

Tuta Mail, another encrypted communications provider based in Germany, has previously also denounced the French bill. Tuta argues that the law likely violates both the GDPR and Germany's IT Security Act, which mandate strong encryption and prohibit weakening IT systems for law enforcement access. “A backdoor for the good guys only is not possible,” the company stated, warning about the broader implications for digital privacy across the EU.

If passed, France would become one of the first democracies in Europe to legally mandate encryption backdoors—despite longstanding warnings from cryptographers, cybersecurity agencies, and civil liberties organizations that such measures are technically unworkable and inherently dangerous.

The proposed French law follows a pattern of increasingly aggressive surveillance policy in the country. In February, the VPN Trust Initiative (VTI), a coalition representing major VPN providers, denounced another law requiring VPNs to block piracy-linked websites, citing grave concerns about privacy and precedent. Several VPN providers have hinted at withdrawing from the French market if forced to compromise encryption or user anonymity.