Zoom and Microsoft Teams are not banned across Europe – millions of businesses and citizens open them every day. But in 2026 a harder question is being asked, and European governments are increasingly answering it in public: can US-owned video conferencing platforms be used in a way that fully satisfies European data protection law, particularly for regulated or public-sector data?
The honest answer is nuanced. These tools are not illegal for general use, yet the legal and political ground beneath them is shifting fast. This guide sets out where the line actually sits – what is restricted and what is not – why France and Germany are moving public servants off US platforms, the regulations that drive the debate, and what organisations that need genuine data sovereignty should evaluate before they commit.
No – Zoom and Microsoft Teams are not outright illegal in the European Union, and they remain widely available to private businesses and individuals. What has changed is the level of scrutiny. A growing number of European public-sector bodies are actively restricting or banning US video conferencing tools over data protection, digital sovereignty and – in Microsoft's case – competition concerns.
So the practical picture has two layers:
In other words, the question is rarely "is this software legal?" It is "can this provider's legal structure keep our data out of reach of non-EU authorities?" For many organisations in 2026, that question is becoming decisive.
The clearest signal that this is no longer a theoretical debate is public-sector procurement. Through 2026, several European governments have begun actively replacing US video conferencing and productivity tools with sovereign alternatives.
France. In January 2026 the French government announced it would move public servants off US video tools – Zoom, Microsoft Teams, Webex and GoTo – and onto Visio, a state-built platform developed by the digital agency DINUM and hosted on French infrastructure. Coverage put the eventual scope at around 2.5 million civil servants, with a full transition targeted for 2027 and the government citing data sovereignty, security and cost as its reasons.
Germany. The northern state of Schleswig-Holstein has been migrating its administration away from Microsoft Windows, Office and Teams toward open-source alternatives such as Linux and LibreOffice, a move widely read as a data-sovereignty statement as much as a cost one. German data protection authorities have also been among the most vocal in Europe about the risks of US cloud services in government.
Elsewhere. Regional and public bodies in Austria and Denmark have taken similar steps away from standard US productivity suites. None of this amounts to an EU-wide ban – but the direction of travel across the public sector is consistent, and private-sector procurement teams are watching it closely.
Underneath the headlines sits a genuine conflict of laws. Under the GDPR, personal data transferred outside the European Economic Area must be protected by safeguards that guarantee an "essentially equivalent" level of protection.
This became far harder to demonstrate after the Schrems II ruling of the Court of Justice of the European Union (CJEU), which invalidated the EU–US Privacy Shield. The Court found that US surveillance law could override the protections offered by transfer mechanisms such as Standard Contractual Clauses (SCCs), and it told organisations that they must assess, case by case, whether foreign law undermines EU data protection rights before relying on those clauses.
The most discussed instrument in this debate is the US CLOUD Act. It allows US authorities to compel US-based companies to hand over data they control – even when that data sits on servers physically located in Europe. In practice, EU-hosted infrastructure operated by a US parent company may still fall under US jurisdiction. Storing data in a European data centre is not, on its own, enough: what matters is who ultimately controls it and which laws they answer to.
The successor framework, the EU–US Data Privacy Framework (DPF), is intended to restore a lawful route for transfers to certified US companies, and it remains in force. But it is not settled law. An appeal is before the CJEU (lodged in October 2025), and a 2026 US Supreme Court decision affecting the independence of the Federal Trade Commission prompted the European Data Protection Board to ask the European Commission to reassess whether the adequacy decision still holds. For organisations planning years ahead, the safest reading is that transatlantic transfer law remains uncertain – and that designing around the question is more durable than designing around the current answer.
The compliance debate is not only academic – European regulators have acted.
In August 2021 the Hamburg Commissioner for Data Protection and Freedom of Information issued a formal warning to the city's Senate Chancellery against using the on-demand version of Zoom, arguing that it involved transfers of personal data to the US with no valid legal basis under the Schrems II standard. It was a regulator's warning rather than a court ruling, and it applied to a specific public-sector configuration – but it set an early marker for how European authorities view US video tools in government.
Microsoft has faced a separate line of pressure on competition grounds. Following a complaint and a European Commission investigation into the bundling of Teams with its Microsoft 365 and Office 365 suites, Microsoft began selling those suites without Teams in the EEA and Switzerland. In 2025 the Commission accepted a set of binding commitments from Microsoft – including Teams-free suites at a wider price gap, interoperability for competing tools and data portability – that run for seven years, with the interoperability and portability obligations lasting ten. Antitrust is a different question from data protection, but it reinforces the same underlying theme: European institutions are increasingly willing to constrain how US platforms operate in the single market.
Both can be configured to support GDPR compliance in many contexts – but neither can fully remove the jurisdictional exposure that comes with a US parent company. Zoom and Microsoft both offer Data Processing Agreements, EU data-residency options and encryption, and large enterprises with legal resources can build a defensible compliance position for routine business use.
The difficulty appears at the edges that matter most:
Compliance here is not a tick-box exercise tied to data-centre location. It is a judgement about legal control – and that judgement is exactly what is under pressure.
When assessing a video conferencing or collaboration provider for European compliance, the questions that matter most are structural:
A provider that is headquartered in the EU, operated under EU jurisdiction, hosted on EU-owned infrastructure and free of extraterritorial data-access exposure removes most of these questions at the root – rather than mitigating them after the fact.
This is the model Digital Samba is built on. Digital Samba is a Barcelona-based company, operating entirely under European Union jurisdiction – which means it is not subject to US extraterritorial access laws such as the CLOUD Act.
For the products most often chosen by organisations with strict requirements – Digital Samba's embedded video API and SDK, and its DS Free service – all personal data is stored and processed on European infrastructure. That infrastructure is run by European providers (hosting partners in the Netherlands, Germany and France, with Swiss capacity for scaling), with no US hyperscaler in the media path. Digital Samba works with a deliberately small set of sub-processors, and the only US-based one – used for support tickets – is optional and can be excluded entirely by European B2B customers, so that all personal data processing stays within Europe.
On top of EU jurisdiction and EU hosting, Digital Samba offers a GDPR-ready Data Processing Agreement with clear controller and processor roles, encryption in transit and at rest, optional application-layer end-to-end encryption, and a commitment to notify customers of any data breach within 24 hours – tighter than the regulatory baseline. For teams embedding video into their own product, the same compliance posture is available through the white-label video API and SDK; for a fuller view of the legal footing, Digital Samba sets out its position on video conferencing built for European legal compliance.
The point is not that US platforms are unusable. It is that, for organisations where data sovereignty and regulatory certainty are non-negotiable, choosing a provider whose legal structure sits inside the EU is simpler and more durable than engineering safeguards around one that does not.
Zoom provides a Data Processing Agreement, EU data-residency options and encryption, and can be configured to support GDPR compliance for many routine business uses. The unresolved issue is jurisdictional: as a US-owned company, Zoom can fall under US laws such as the CLOUD Act even when data is hosted in Europe, which is why European regulators have challenged its use in sensitive and public-sector settings.
As with Zoom, Microsoft Teams can be configured toward GDPR compliance through Microsoft's DPA, EU data boundaries and contractual safeguards. The same jurisdictional exposure applies, and Teams has additionally faced EU competition action over its bundling with Microsoft 365 and Office 365, resulting in binding commitments to offer Teams-free suites and interoperability in the EEA and Switzerland.
Yes. Several European providers offer video conferencing hosted entirely within the EU and operated under EU jurisdiction, which removes exposure to US extraterritorial law. Digital Samba is one example – a Barcelona-based provider with EU-only hosting for its embedded and DS Free products and a GDPR-ready Data Processing Agreement.
Not entirely, and not all at once. Private businesses continue to use both widely. But across the public sector the trend is clear: governments in France, Germany and elsewhere are actively migrating official users to sovereign or open-source alternatives on data-sovereignty and cost grounds, and that is reshaping expectations for regulated industries too.
For public servants, yes. In January 2026 the French government announced it would move its administration – reported at around 2.5 million civil servants – off US video tools including Zoom and Teams and onto a state-built platform, Visio, with the transition targeted for 2027. It applies to government use, not to private businesses or citizens.
If you have reached this article, you are probably weighing up whether your current video platform can meet European legal requirements – and what a genuinely EU-based alternative would look like. To talk through GDPR-compliant, EU-hosted video conferencing for your organisation, just send us a message and we will gladly share more.