- IP address retention: eco warns against a three-month retention requirement and firmly rejects a six-month one.
- Data preservation orders: Extending these to include inventory, usage and content data would constitute a qualitative escalation.
- Digital investigative powers: Biometric matching and data analysis threaten to create a new surveillance architecture.
Berlin, 12 June 2026 – On the occasion of today’s deliberations in the German Federal Council (Bundesrat) on several security-policy legislative proposals, eco – Association of the Internet Industry warns against a fundamental shift in digital domestic policy. At the centre of the debate are, among other things, the indiscriminate retention of IP addresses, a possible extension of the retention period to six months, preventive preservation orders, automated biometric matching of publicly accessible Internet data, cross-proceedings data analyses and expanded digital investigative powers for police and security authorities. In the association’s view, the current drafts and committee recommendations amount to significantly more data retention, more data linking and a greater degree of intrusion. This is gradually creating a new digital surveillance architecture.
“What is being negotiated here under the label of modern investigative powers is, in reality, a massive expansion of state access to the digital sphere,” says Klaus Landefeld, Member of the Board at eco – Association of the Internet Industry. “The German Federal Council must not turn individual interventions that are sensitive under the rule of law into a blueprint for digital mass surveillance.”
eco is particularly critical of the planned IP address retention.
“Even three months of indiscriminate IP address retention are critical. Six months would not be justifiable under the rule of law,” says Landefeld. “A longer retention period brings no demonstrable benefits for investigative work, but creates an even larger data retention infrastructure for law-abiding citizens.”
eco also views the planned expansion of preservation orders with great concern.
“Extending preservation orders to subscriber, usage and content data does not constitute a minor technical adjustment, but rather creates a significantly broader preservation and access infrastructure,” says Landefeld. “This shifts the debate from targeted data preservation to a comprehensive state right of access. Content data in particular concerns the very core of private communication and represents a completely different level of interference with fundamental rights.”
eco is also particularly critical of the planned possibilities for automated biometric matching with publicly accessible Internet data. This would effectively turn the open Internet into a state search and identification space.
“The Internet is not a biometric search archive,” says Landefeld. “Anyone who makes publicly accessible content automatically searchable for faces or identities is shifting the boundary between targeted law enforcement and general digital observation.”
eco emphasises that effective investigative instruments are necessary in the digital sphere. However, they must be strictly limited under the rule of law, proportionate, technically practical and empirically justified.
“Security is not achieved through legally uncertain mass powers, biometric Internet searches and ever-new retention obligations,” says Landefeld. “Germany needs targeted, effective and controllable instruments – not a digital surveillance architecture in reserve.”
