FREEDOM ON THE NET 2026 Seismic Shifts on the Global Internet 6. Does monitoring and collection of user data by service providers and other technology companies infringe on individuals’ right to privacy? (0–6 points) • • • • • • • Do specific laws or binding legal decisions enshrine the rights of individuals over personal data? Do regulatory bodies, such as a data protection agency, effectively protect people’s privacy, including through investigating companies’ mismanagement of data and enforcing relevant laws or legal decisions? Can the government obtain user information from companies (such as service providers, low Earth orbit satellite internet providers, digital platforms, email providers, device manufacturers, and data brokers) without a legal process? Do the country’s laws require these companies to collect and retain user data beyond the scope of ordinary business purposes? Are these companies required to store users’ data on servers located in the country (that is, are there “data localization” requirements)? Do these companies monitor individuals and supply information about their digital activities to the government or other powerful actors? Does the state attempt to impose similar requirements on these companies through less formal methods, such as threats of censorship and legal liability for company employees? Are government requests for user data from these companies transparent, and do companies have a realistic avenue for appeal, for example via independent courts? 7. Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in relation to their online activities? (0–5 points) • • • • • Are individuals subject to physical violence in relation to their online activities? Are individuals subject to other intimidation and harassment—such as verbal threats, travel restrictions, nonconsensual sharing of intimate images, doxing, or property destruction or confiscation—in relation to their online activities? Are individuals subject to online intimidation and harassment specifically because they belong to a certain ethnic, religious, gender, LGBT+, migrant, diaspora, or other relevant group? Have the online activities of dissidents, journalists, bloggers, human rights defenders, or other individuals based outside the country led to repercussions for their family members or associates based in the country (in other words, coercion-by-proxy)? Have foreign nationals in the country been arrested and extradited to their home country in retaliation for their online activity, particularly material that is protected by international human rights standards? 8. Are websites, governmental and private entities, service providers, or individuals subject to widespread hacking and other forms of cyberattack? (0–3 points) • • • 32 Have websites belonging to opposition or civil society groups or to news outlets in the country been temporarily or permanently disabled due to cyberattacks (such as distributed denial-of-service [DDoS] attacks), particularly at politically sensitive times? Are websites, news outlets, blogs, or social media accounts subject to targeted technical attacks as retribution for posting certain content, for example on political and social topics? Are governmental entities subject to significant and targeted cyberattacks meant to steal data or disable normal operations, including attacks that originate outside the country? @freedomhouse #FreedomOnTheNet