Proton CTO Bart Butler told The Verge that no company will risk criminal liability for user privacy, framing it as a cost-benefit calculus. Proton, valued at $800M after a 2022 €100M raise, sells encrypted email and VPNs to 70M users but has faced scrutiny for cooperating with Swiss authorities in rare cases, like a 2021 climate activist arrest tied to IP logs from Proton Mail. Butler’s stance reflects a shift: even privacy-first firms bend to legal pressure when subpoenas or national security requests arrive.

Butler’s admission underscores a harsh truth: privacy as a product is only as strong as the jurisdiction it operates in. Switzerland’s neutral reputation helps Proton, but its compliance with local laws reveals that encryption is a feature, not an absolute. This erodes the marketing myth that any service can fully shield users from state power. The second-order effect is a chilling realization for users: privacy is a luxury good, and its providers will always prioritize survival over principle when confronted with legal jeopardy.

Proton wins by managing expectations and retaining institutional trust. Users lose the illusion of absolute privacy. Competitors like Tutanota or Skiff, which tout stricter no-logs policies, gain a differentiation edge but risk regulatory backlash. Governments win as they tighten control over the last bastions of encrypted communication.

Expect Proton to double down on jurisdictional arbitrage, perhaps expanding in privacy-friendly regions like Iceland or Singapore. Watch for regulatory pushback in the EU, where the DMA and GDPR may force Proton to weaken end-to-end encryption under guise of ‘public safety.’