US Supreme Court kills the Data Privacy Framework — third time's the harm for EU-US data deals
By the Archibou team
On June 30, 2026, the US Supreme Court made a ruling whose consequences ripple far beyond Washington. It confirmed that the US president can fire the head of the Federal Trade Commission (FTC) at will. In doing so, it dealt a fatal blow to the Data Privacy Framework (DPF) — the third agreement meant to « protect » European data transferred to the United States.
Just like the two before it.
Source: « Le Data Privacy Framework remis en question par la fin de l'indépendance de la FTC », Next.ink, July 2, 2026.
Quick glossary to follow along
Before we dive in, let's clarify the key terms. Because without them, the news stays abstract.
Data Privacy Framework (DPF) — The third EU-US agreement governing personal data transfers. It allows companies like Google, Meta, Microsoft, and Amazon to legally store and process European data on US servers.
FTC (Federal Trade Commission) — The US consumer protection agency. Under the DPF, it was supposed to act as the independent watchdog ensuring European data rights are respected on US soil.
Cloud Act — A 2018 US law that gives American authorities (FBI, NSA, etc.) the right to access any data held by a US company, regardless of where in the world that data is stored. Yes, even your family photos.
Safe Harbor / Privacy Shield — The two previous EU-US data agreements. Same goal, same promise. Both struck down by the European Court of Justice for the same reason: the US does not guarantee equivalent data protection.
Three agreements, three failures. The pattern is clear.
2015 — Safe Harbor is invalidated by the Court of Justice of the European Union (CJEU) after Max Schrems files a complaint. Reason: the US fails to protect European data from mass surveillance.
2020 — Privacy Shield meets the exact same fate. Same court, same plaintiff, same conclusion: US law overrides the agreement's commitments.
2026 — Data Privacy Framework. Same story. The US Supreme Court has just demonstrated that the FTC — the DPF's designated independent guardian — is anything but. The president can fire its directors the moment they become inconvenient. How can an agency whose leader can be dismissed on a whim protect anything?
Three times. Same script. One constant: data transferred to the United States is not protected, regardless of how many agreements are signed.
As Max Schrems, the activist behind all three legal challenges, puts it: « The Commission built a house of cards under industry pressure. Now that it's clearly collapsing, they must take responsibility. » He calls for « an orderly exit from the US cloud. »
Why this matters for you and your photos
The DPF was the legal shield that US tech giants waved to reassure you: « Don't worry, your data is protected by treaty. »
That shield is gone.
Without the DPF, your data stored with an American company — Google Photos, Dropbox, iCloud, Microsoft OneDrive — falls back under the sole authority of the Cloud Act. Concretely, the US administration can demand access to your photos, your documents, your health data, without much you can do about it. And they don't even have to tell you.
This isn't theory. This is US law, and it applies.
So what now?
The answer isn't a fourth agreement. That would mean ignoring the evidence: US law will not change to protect Europeans. American sovereignty will always trump European data protection. That's how sovereignty works.
The only real guarantee is to not transfer your data to the United States in the first place.
Solutions exist today:
- Hosting in France, with a French provider (OVH, for instance)
- Under French and European jurisdiction — outside the Cloud Act's reach
- On open-source software, verifiable by anyone
- With no data resale, no profiling, no AI analysis
This is exactly what Archibou does. No transatlantic agreement needed when your data never crossed the ocean.
A personal choice that matters
This week's news gives you a rare opportunity: to understand a complex issue at the very moment it becomes concrete — and to act on it.
The Data Privacy Framework is the third agreement to collapse. There may be a fourth. But the question is no longer « when will the next one fall? » It's: « Do I want my memories, my documents, my digital life to depend on a legal text that can be undone by a single ruling? »
Your data belongs to you. It's time its protection followed the same rule.