Can the FBI or Police Track Proton Mail?

This page is part of the Proton Mail FAQ Hub.

Can police read the emails themselves?

Can police track Proton Mail messages and read them? No, and this is the part most coverage gets muddled. The body of every email is encrypted on your device before it ever reaches Proton’s servers, using zero-access encryption where Proton keeps no key. So when a warrant arrives, the company can only surrender ciphertext it genuinely cannot open. Investigators end up with a locked box and no way to force it. Open-source clients and independent audits back this up rather than asking you to take it on trust.

There is a caveat worth stating plainly, because it catches people out. If you write to someone on Gmail or Outlook, the copy sitting in their inbox is readable by their provider, and a warrant served on that provider sidesteps Proton completely. Encryption guards the message on Proton’s side. It cannot police the habits of whoever you happen to be emailing, nor the screenshots they quietly take.

What can a Swiss court order compel?

Here the honest answer gets less comforting. Proton is a Swiss company, and a valid, legally binding Swiss court order can compel it to hand over the limited metadata it does hold, and to begin logging fresh metadata such as an IP address for one specific, named account going forward. It cannot be forced to decrypt content, because it cannot, but metadata is a different matter. In the well-known 2021 case Proton logged your IP address for a targeted account after receiving a binding order from Swiss authorities, then complied as the law required.

Foreign agencies, the FBI included, cannot simply post a demand to Geneva and expect results. They must route the request through Swiss mutual legal assistance channels, and Proton contests orders it judges invalid or overbroad. That process buys time and filters out fishing expeditions. It is friction, and friction matters, but nobody should mistake friction for immunity.

Does Proton put you above the law?

No, and it was never sold as that. Proton is a law-abiding company under Swiss jurisdiction, not a lawless bunker offshore. If you become the subject of a Swiss criminal investigation, the same legal machinery that reaches any other provider reaches Proton too, and the company has been consistent in saying so. The privacy is real; the impunity is imaginary.

The common error is treating a privacy tool as a licence to do as you please. What Proton actually does is raise the cost of surveillance and shrink the pool of data that can ever be collected about you. For a journalist, an activist or an ordinary person who simply dislikes being data-mined, that is genuinely useful. For someone running a serious crime, it slows the process rather than stopping it. It is the difference between a strong lock and a magic cloak, and Proton sells the lock.

How do you reduce what can be traced?

A handful of practical habits shrink your metadata footprint considerably. None of them make you invisible, and anyone promising invisibility is either careless or dishonest. The point is to remove the pieces of information that could ever be logged in the first place.

Do those things and there is far less for any order to gather later. Skip them and Proton still protects your message content, but the surrounding trail is richer than it needed to be. At BAIZAAR we would rather hand you the limits in writing than let you lean on a comforting myth.

• Sign up and log in over Tor or a trustworthy VPN, so your real IP address never reaches Proton at all.
• Avoid attaching a recovery email or phone number that leads straight back to your legal identity.
• Keep in mind that who you email, and when, remains metadata even while the content stays sealed.

Is Proton Mail worth it for most people?

For the overwhelming majority, yes. You get email content that nobody at Proton can read, a company with a track record of contesting foreign overreach, and metadata minimisation you can tighten further yourself. Moving up to Proton Mail Plus adds custom domains, more addresses and extra storage without touching the underlying security model, so the encryption story stays identical. You are buying resistance and restraint, not a disappearing act.

Just keep your expectations calibrated. Proton protects your correspondence about as well as a mainstream service can, and traces poorly by design, yet a valid order in the right jurisdiction still bites. That is the honest trade on offer. For nearly everyone weighing it up, it remains a very good one.

---