The biggest issue with the current trend towards tech mass surveillance is that it doesn’t necessarily have to be codified into law for it to be effective.

Even if the UK doesn’t manage to pass a law that bans VPNs, even if Chat Control doesn’t pass, even if the EU puts stringent regulation around user data collection, mass surveillance can still de facto be implemented above the law.

Sure, VPNs may not be illegal. But what if my website has a daily updated database of known VPN servers offered by the major providers (it’s just a few thousands of servers, after all), and I prevent you from accessing it unless you turn off your VPN or Tor?

And what if many websites start sharing that approach?

And what if connections from IPs on those lists started being classified in Cloudflare’s highest risk category, so you have to solve 5 CAPTCHAs to find cars and bikes before you can access the content?

Sure, the law may not require you to have a genuine Android or iOS device in order to verify your identity. But what if, when you access a website, Cloudflare puts under your nose a CAPTCHA with a QR code to be scanned from your mobile device, creating a link between you as a person and your visit to that website?

Sure, the EU may impose heavy fines over Google for its abuse of dominant position and unrestricted access to people’s information. But what’s the point when most of the apps start anyway using the new Google Integrity API to verify user access, and when the EU itself considers using that API for identity verification on its side?

Sure, Chat Control may not pass. But what if Facebook simply silently removes E2EE from its chat services, ending up with people’s conversations stored overnight in clear text, ready to be handed out to the best buyer?

The tech industry has reached such a level of power concentration that laws don’t matter anymore.

All it takes is Cloudflare to add a new challenge to their CAPTCHA, or Google to add a new control to their Integrity APIs, and thousands if not millions of websites and apps become suddenly inaccessible to those who want privacy.

Those tech companies and the decisions they take during their closed-doors meetings have become the law.