FISA 702 is Expiring.

Why European Companies Should Still Be Cautious

When it became known that the infamous Section 702 of the American Foreign Intelligence Surveillance Act (FISA) would temporarily expire, the reaction from some observers was predictable: If the legal basis for key parts of the digital US foreign surveillance is removed, the use of American cloud providers should automatically become less critical.

However, this conclusion would be premature.

The current development mainly shows one thing: The real problem was never solely the law itself.

What FISA 702 Actually Regulates

Section 702 has been the foundation for significant parts of the USA’s electronic foreign intelligence for years. It allows American intelligence agencies to collect data from individuals likely located outside the United States. Programs like PRISM and the so-called Upstream surveillance, where data is obtained either directly from service providers or from central network infrastructures, have become particularly well-known.

Critics have been arguing for years that these powers extend much further in practice than officially stated and regularly capture data from US citizens or individuals who should not be the target of surveillance.

The fact that the legal basis is now temporarily expiring is less the result of a fundamental reassessment of surveillance practices and more an expression of political conflicts within American domestic politics.

The Real Signal is Alarming

More interesting than the expiration of the law is the public reaction of leading politicians.

Several Republicans have already signaled that the intelligence agencies should continue their work as unchanged as possible. Even the possibility of a presidential order is openly discussed.

This creates a remarkable situation.

While European companies often try to assess risks based on concrete legal grounds, the American debate shows that political actors themselves sometimes consider the practical continuation of surveillance more important than the question of whether the previous legal basis is currently valid.

For European companies, this is not a reassuring message.

Why the Discussion is Bigger Than FISA 702

In Europe, the debate about American cloud providers is often reduced to individual laws. Sometimes it’s about the CLOUD Act, sometimes about FISA 702, sometimes about new data protection agreements between the EU and the USA.

This easily creates the impression that the problem could be solved by changing a single law.

In reality, however, it is a structural issue.

US companies are subject to American jurisdiction. American authorities have various legal instruments to access data or request information. At the same time, the history of the past two decades shows that surveillance powers have regularly been expanded rather than restricted following terrorist attacks, geopolitical crises, or security policy tensions.

Those who only look at individual laws therefore overlook the bigger picture.

What Does This Mean for Companies?

The current development is not an argument for fundamentally avoiding American hyperscalers.

AWS, Microsoft Azure, and Google Cloud remain among the most technologically capable platforms in the world. For many companies, they are the most economically and technically sensible solution.

However, the message is an argument for taking data classification seriously.

Not all information requires the same level of protection.

Marketing data, public content, or non-critical business applications are to be evaluated differently than research data, health data, government information, critical infrastructure data, or strategic corporate knowledge.

The more sensitive data becomes, the more important it is to consider under which jurisdiction it is processed, who can potentially access it, and what legal options actually exist in the event of a conflict.

The Real Lesson for Europe

The discussion about FISA 702 ultimately highlights a problem that goes far beyond data protection.

Europe still has limited digital infrastructures of its own that can compete with American hyperscalers. This creates a situation where many companies rely on providers operating outside the European legal framework.

As long as this dependency exists, every political development in Washington will have immediate impacts on European companies—regardless of whether it concerns data protection, surveillance, sanctions, or geopolitical conflicts.

Digital sovereignty therefore does not mean categorically rejecting American technology.

It means understanding dependencies, consciously assessing risks, and where it makes sense, building and using European alternatives.

The expiration of FISA 702 changes little about this fundamental question.

It merely serves as a reminder of why it exists in the first place.