Encryption Laws Secria

Encryption laws by country

None of the laws on this page bans encryption. They give governments ways to get at encrypted data.1, 2, 3, 4

United Kingdom: in lawAustralia: in lawIndia: in lawChina: in lawRussia: in lawCanada: proposedFrance: rejectedUnited States: bills died
  • In law
  • Proposed
  • Rejected or died

Select a country on the map, or see the table. Checked 28 October 2026 against the sources.

The laws, country by country

Laws and orders that weaken or restrict encryption, what each one asks of encrypted services or their users, and where it stands.

CountryLaw and what it requiresStatusDate
United KingdomInvestigatory Powers Act 2016, section 253, and the 2018 Technical Capability RegulationsA technical capability notice can require a provider to keep the ability to remove encryption it applied, where reasonably practicable.In lawAct of 29 Nov 20161, 5
United KingdomOnline Safety Act 2023, section 121Ofcom can require a service to use accredited technology to find child sexual abuse content, "whether communicated publicly or privately".In lawAct of 26 Oct 20233
United KingdomRegulation of Investigatory Powers Act 2000, sections 49 and 53A person believed to hold a key can be served a notice to disclose protected information.In lawAct of 28 Jul 20004, 6
AustraliaTelecommunications and Other Legislation Amendment (Assistance and Access) Act 2018Agencies can request or require technical help from communications providers. In 2024-25 agencies gave 58 requests and no notices.In lawAct No. 148, 20187, 8, 9
IndiaIT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, rule 4(2)Large messaging services must be able to identify a message's "first originator" when a court or the government orders it, for listed offences punishable by five years or more.In lawNotified 25 Feb 20212
ChinaCounter-Terrorism Law, Article 18Telecom operators and internet service providers must give police and state security technical support, including decryption, in terrorism cases.In lawAdopted Dec 201510
RussiaFederal Law No. 374-FZOnline services that encode users' messages must give Russia's federal security body the information needed to decode them.In law6 Jul 201611
CanadaBill C-22, Lawful Access Act, 2026, Part 2A provider would not have to comply where that would introduce a systemic vulnerability.ProposedPassed the House 18 Jun 2026; in Senate committee since 22 Oct 202612, 13
European UnionProposed Child Sexual Abuse Regulation ("Chat Control")At talks on 29 June 2026, negotiators provisionally agreed almost all of it except detection.ProposedTalks 29 Jun 202614
FranceDrug trafficking bill, article 8 terWould have required encrypted messaging services to let intelligence services access certain communications.Rejected20 Mar 202515, 16
United StatesEARN IT Act (S. 1207) and Lawful Access to Encrypted Data Act (S. 4051)Senate bills that never got a vote of the full Senate and died at the end of their Congress.DiedIntroduced 2023 and 202017, 18, 19, 20
 Statuses as of 28 October 2026. In law means the law has been passed; it does not tell you how often a power is used.

This page describes laws. It is not legal advice.

Two kinds of order people mix up

Orders to the company

A UK technical capability notice is served on a provider. It can require the provider to be able to remove electronic protection "applied by or on behalf of" that provider.5 India's rule and China's law also put the duty on the service.2, 10

These orders reach the encryption a provider applies to its own service.

Orders to the person

A UK disclosure notice is served on the person believed to hold the key. Knowingly failing to comply is a crime, with up to 2 years in prison, or 5 in some cases.4, 6

Where these laws exist, holding the key can make you the one the order is served on.

Questions people ask

Is encryption illegal in the UK?

The UK laws we track do not ban it. They let the Home Secretary serve technical capability notices on providers, and let authorities require a person to disclose protected information.1, 6

Is Apple's Advanced Data Protection coming back to the UK?

Apple says it hopes to offer it in the UK in the future. As of its notice published on 22 September 2025, UK users who had not already turned it on can no longer do so.21

What is a technical capability notice?

A notice under section 253 of the Investigatory Powers Act 2016 that requires a provider to take steps so it can give the assistance a warrant may demand. The Home Secretary must consider it necessary and proportionate, and a Judicial Commissioner must approve it.1

Did the EARN IT Act pass?

No. The 2023 version, S. 1207, was approved by the Senate Judiciary Committee but never got a vote of the full Senate, and died when that Congress ended. The Lawful Access to Encrypted Data Act, S. 4051 from 2020, never left committee and died the same way.17, 18, 19, 20

Sources 21
  1. Investigatory Powers Act 2016, section 253: technical capability notices, legislation.gov.uk, The National Archives. Read 28 October 2026.
  2. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, updated 6 April 2023, Ministry of Electronics and Information Technology, India. Read 28 October 2026.
  3. Online Safety Act 2023, section 121: notices to deal with terrorism content or CSEA content, legislation.gov.uk, The National Archives. Read 28 October 2026.
  4. Regulation of Investigatory Powers Act 2000, section 53: failure to comply with a notice, legislation.gov.uk, The National Archives. Read 28 October 2026.
  5. The Investigatory Powers (Technical Capability) Regulations 2018, SI 2018/353, legislation.gov.uk, The National Archives. Read 28 October 2026.
  6. Regulation of Investigatory Powers Act 2000, section 49: notices requiring disclosure, legislation.gov.uk, The National Archives. Read 28 October 2026.
  7. Telecommunications (Interception and Access) Act 1979 and Part 15 of the Telecommunications Act 1997, Annual Report 2024-25, Department of Home Affairs, Australia. Read 28 October 2026.
  8. Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, No. 148, 2018, Federal Register of Legislation, Australia. Read 28 October 2026.
  9. The Assistance and Access Act 2018, Department of Home Affairs, Australia. Read 28 October 2026.
  10. Provisions of China's counterterrorism bill inspired by foreign laws: official, 28 December 2015, China Daily, National People's Congress site. Read 28 October 2026.
  11. Federal Law No. 374-FZ of 6 July 2016 (in Russian), President of Russia, kremlin.ru. Read 28 October 2026.
  12. C-22 (45-1), Lawful Access Act, 2026: status, LEGISinfo, Parliament of Canada. Read 28 October 2026.
  13. Bill C-22, as passed by the House of Commons on 18 June 2026, Part 2: Supporting Authorized Access to Information Act, Parliament of Canada. Read 28 October 2026.
  14. Regulation to prevent and combat child sexual abuse: outcome of the trilogue on 29 June 2026 and next steps (11501/26, 7 July 2026), Council of the European Union. Read 28 October 2026.
  15. Scrutin public n° 1102, amendment n° 640 to article 8 ter, 20 March 2025, Assemblée nationale (France). Read 28 October 2026.
  16. Vote n° 1102, amendement n° 640, proposition de loi narcotrafic, Datan (independent site built on National Assembly open data). Read 28 October 2026.
  17. S. 1207 (118th): EARN IT Act of 2023, GovTrack.us. Read 28 October 2026 from the Internet Archive copy of 4 February 2025.
  18. S. 4051 (116th): Lawful Access to Encrypted Data Act, GovTrack.us. Read 28 October 2026 from the Internet Archive copy of 4 February 2025.
  19. S. 1207 (118th Congress), EARN IT Act of 2023: bill status and actions, US Government Publishing Office (govinfo). Read 28 October 2026.
  20. S. 4051 (116th Congress), Lawful Access to Encrypted Data Act: bill status and actions, US Government Publishing Office (govinfo). Read 28 October 2026.
  21. Apple can no longer offer Advanced Data Protection in the United Kingdom to new users (published 22 September 2025), Apple Support. Read 28 October 2026.

We read the law itself, and every status has a date. How we check