# Jurisdictions, Five Eyes and privacy

Every company follows the laws of the country it is based in. Those laws decide which authorities can demand data, what process they need, and whether the company can tell users. Privacy Ratings shows each company's jurisdiction on its rating page, in category tables, and on the country pages below.

## The Eyes arrangements

The **Five Eyes** began with the UKUSA Agreement on signals intelligence sharing. The **Nine Eyes** and **Fourteen Eyes** are wider sharing arrangements. Intelligence agencies in these countries share data with each other, which can let them receive information about people they could not legally collect themselves.

| Arrangement | Countries |
| --- | --- |
| Five Eyes | United States, United Kingdom, Canada, Australia, New Zealand |
| Nine Eyes | Five Eyes, plus Denmark, France, the Netherlands and Norway |
| Fourteen Eyes | Nine Eyes, plus Belgium, Germany, Italy, Spain and Sweden |

Sources: [UKUSA Agreement](https://en.wikipedia.org/wiki/UKUSA_Agreement), [Forward Email technical whitepaper](https://forwardemail.net/technical-whitepaper.pdf) (section 9.5).

## How other guides handle jurisdiction

- **Privacy Guides** requires VPN providers to be "based in a jurisdiction where it cannot be forced to do secret logging," and prefers email providers in "a jurisdiction with strong email privacy protection laws," without naming countries. [VPN criteria](https://www.privacyguides.org/en/vpn/), [email criteria](https://www.privacyguides.org/en/email/)
- **That One Privacy Site** flagged Five Eyes countries red, Nine and Fourteen Eyes countries yellow, and everything else green. [Chart formulas](https://thatoneprivacysite.xyz/vpn-chart-formulas/)
- **EFF's Who Has Your Back** rated companies on what they do with government requests: transparency reports, user notice, and requiring warrants. [Who Has Your Back](https://www.eff.org/who-has-your-back-2017)

## How Privacy Ratings handles it

**Jurisdiction appears on each page but does not affect the score.** Location alone is a weak signal:

- Proton, in Switzerland and outside all Eyes arrangements, complied with 8,313 of 9,301 legal orders in its most recent yearly report. [Source](https://proton.me/legal/transparency)
- Proton VPN, same company and same country, complied with none because it keeps no logs. [Source](https://proton.me/legal/transparency)
- Mullvad, in Fourteen Eyes Sweden, has passed audits confirming its VPN servers keep no customer data. [Source](https://mullvad.net/en/blog/vpn-server-audit-found-no-information-leakage-or-logging-of-customer-data)

The data a provider keeps, and who holds the keys, decide what it can hand over. The scores measure those things: encryption, logging, audits, **transparency reports** and **user notice**. Each page still shows the country, its Eyes membership, EU or GDPR coverage, and whether the [CLOUD Act](/cloud-act/) applies, so you can weigh jurisdiction yourself.

## Countries

| Country | Eyes | Data protection | CLOUD Act | Rated |
| --- | --- | --- | --- | --- |
| [United States](https://privacyratings.com/jurisdictions/united-states/) | Five Eyes | - | provider | 532 |
| [Germany](https://privacyratings.com/jurisdictions/germany/) | Fourteen Eyes | EU | - | 88 |
| [France](https://privacyratings.com/jurisdictions/france/) | Nine Eyes | EU | - | 45 |
| [United Kingdom](https://privacyratings.com/jurisdictions/united-kingdom/) | Five Eyes | GDPR-style | agreement | 43 |
| [Switzerland](https://privacyratings.com/jurisdictions/switzerland/) | None | GDPR-style | - | 38 |
| [Canada](https://privacyratings.com/jurisdictions/canada/) | Five Eyes | - | - | 28 |
| [Netherlands](https://privacyratings.com/jurisdictions/netherlands/) | Nine Eyes | EU | - | 22 |
| [Sweden](https://privacyratings.com/jurisdictions/sweden/) | Fourteen Eyes | EU | - | 15 |
| [Australia](https://privacyratings.com/jurisdictions/australia/) | Five Eyes | - | agreement | 14 |
| [Czechia](https://privacyratings.com/jurisdictions/czechia/) | None | EU | - | 11 |
| [Austria](https://privacyratings.com/jurisdictions/austria/) | None | EU | - | 9 |
| [Singapore](https://privacyratings.com/jurisdictions/singapore/) | None | - | - | 9 |
| [Ireland](https://privacyratings.com/jurisdictions/ireland/) | None | EU | - | 8 |
| [Italy](https://privacyratings.com/jurisdictions/italy/) | Fourteen Eyes | EU | - | 7 |
| [Estonia](https://privacyratings.com/jurisdictions/estonia/) | None | EU | - | 6 |
| [Finland](https://privacyratings.com/jurisdictions/finland/) | None | EU | - | 6 |
| [India](https://privacyratings.com/jurisdictions/india/) | None | - | - | 6 |
| [Norway](https://privacyratings.com/jurisdictions/norway/) | Nine Eyes | EEA | - | 6 |
| [Poland](https://privacyratings.com/jurisdictions/poland/) | None | EU | - | 6 |
| [Cyprus](https://privacyratings.com/jurisdictions/cyprus/) | None | EU | - | 5 |
| [Spain](https://privacyratings.com/jurisdictions/spain/) | Fourteen Eyes | EU | - | 5 |
| [Belgium](https://privacyratings.com/jurisdictions/belgium/) | Fourteen Eyes | EU | - | 4 |
| [China](https://privacyratings.com/jurisdictions/china/) | None | - | - | 4 |
| [Denmark](https://privacyratings.com/jurisdictions/denmark/) | Nine Eyes | EU | - | 4 |
| [Israel](https://privacyratings.com/jurisdictions/israel/) | None | - | - | 4 |
| [Japan](https://privacyratings.com/jurisdictions/japan/) | None | - | - | 4 |
| [Romania](https://privacyratings.com/jurisdictions/romania/) | None | EU | - | 4 |
| [South Korea](https://privacyratings.com/jurisdictions/south-korea/) | None | - | - | 4 |
| [Bulgaria](https://privacyratings.com/jurisdictions/bulgaria/) | None | EU | - | 3 |
| [Luxembourg](https://privacyratings.com/jurisdictions/luxembourg/) | None | EU | - | 3 |
| [Marshall Islands](https://privacyratings.com/jurisdictions/marshall-islands/) | None | - | - | 3 |
| [New Zealand](https://privacyratings.com/jurisdictions/new-zealand/) | Five Eyes | - | - | 3 |
| [Russia](https://privacyratings.com/jurisdictions/russia/) | None | - | - | 3 |
| [Slovakia](https://privacyratings.com/jurisdictions/slovakia/) | None | EU | - | 3 |
| [British Virgin Islands](https://privacyratings.com/jurisdictions/british-virgin-islands/) | None | - | - | 2 |
| [Cayman Islands](https://privacyratings.com/jurisdictions/cayman-islands/) | None | - | - | 2 |
| [Costa Rica](https://privacyratings.com/jurisdictions/costa-rica/) | None | - | - | 2 |
| [Gibraltar](https://privacyratings.com/jurisdictions/gibraltar/) | None | GDPR-style | - | 2 |
| [Hungary](https://privacyratings.com/jurisdictions/hungary/) | None | EU | - | 2 |
| [Iceland](https://privacyratings.com/jurisdictions/iceland/) | None | EEA | - | 2 |
| [Latvia](https://privacyratings.com/jurisdictions/latvia/) | None | EU | - | 2 |
| [Lithuania](https://privacyratings.com/jurisdictions/lithuania/) | None | EU | - | 2 |
| [Panama](https://privacyratings.com/jurisdictions/panama/) | None | - | - | 2 |
| [Slovenia](https://privacyratings.com/jurisdictions/slovenia/) | None | EU | - | 2 |
| [Ukraine](https://privacyratings.com/jurisdictions/ukraine/) | None | - | - | 2 |
| [United Arab Emirates](https://privacyratings.com/jurisdictions/united-arab-emirates/) | None | - | - | 2 |
| [Argentina](https://privacyratings.com/jurisdictions/argentina/) | None | - | - | 1 |
| [Bermuda](https://privacyratings.com/jurisdictions/bermuda/) | None | - | - | 1 |
| [Greece](https://privacyratings.com/jurisdictions/greece/) | None | EU | - | 1 |
| [Hong Kong](https://privacyratings.com/jurisdictions/hong-kong/) | None | - | - | 1 |
| [Malaysia](https://privacyratings.com/jurisdictions/malaysia/) | None | - | - | 1 |
| [Malta](https://privacyratings.com/jurisdictions/malta/) | None | EU | - | 1 |
| [Pakistan](https://privacyratings.com/jurisdictions/pakistan/) | None | - | - | 1 |
| [Portugal](https://privacyratings.com/jurisdictions/portugal/) | None | EU | - | 1 |
| [Türkiye](https://privacyratings.com/jurisdictions/turkiye/) | None | - | - | 1 |