Privacy-focused Proton Mail shared payment data in FBI Stop Cop City investigation: report

Privacy promises are easy to market. They get a lot harder to defend when a court record starts pulling on the loose threads.

That is what makes this latest Proton Mail story hard to ignore. As first reported by 404 Media, a court filing says Proton Mail shared payment data with Swiss authorities, and that information later made its way to the FBI in an investigation tied to the Stop Cop City movement in Atlanta.

The account in question was allegedly linked to Defend the Atlanta Forest, a group associated with protests against the police training center critics call Cop City. According to the report, that payment trail helped investigators work out who was behind an anonymous Proton Mail address connected to that orbit.

For anyone who follows privacy tech, the big takeaway is not that encrypted email was somehow broken. It is that the inbox and the billing trail are two very different things. Separate coverage from The Verge, citing the same court documents, says end-to-end encryption can protect account content, but payment information and other metadata are much harder to keep hidden.

That distinction matters because Proton has spent years building a public image around privacy, Swiss law, and keeping user data out of reach where it can. The 404 Media report puts fresh attention on the gap between encrypted content and the limited account data a provider may still hold, produce, or be forced to produce through a legal process.

In recent posts on X, Proton Mail took a jab at Microsoft over data harvesting and also backed the Keep Android Open open letter pushing back on Google’s proposed developer registration rules. That campaign argues that central registration creates new privacy risks and unnecessary surveillance pressure, which makes this FBI-linked Proton Mail report land a little harder.

There is also a simple user lesson here, especially for people searching terms like “is Proton Mail anonymous” or “can Proton Mail share data with police.” Privacy tools can make strong promises about encryption, but that does not automatically erase payment records, signup details, or other metadata that may sit outside the encrypted part of the service. If anything, this story is a reminder that “private” and “untraceable” are not always the same thing when billing data enters the picture.

None of that means Proton is unique here, and it does not mean the service can read users’ encrypted message contents based on what has been reported so far. But it does mean a company that regularly calls out other tech firms over privacy is now facing fresh scrutiny over the kind of user-linked information that can still surface when investigators come knocking.

Featured image edited with AI