European digital rights organisations call for a full EU-wide ban on spyware to protect fundamental rights
"Spyware Document Pool" 19 January 2026
Spyware use continues to spread across Europe in a climate of institutional inaction and normalisation. Despite repeated scandals in at least 14 Member states, and clear evidence of human rights violations, neither the European Commission nor States have introduced any red lines. Victims lack effective remedies, commercial vendors operate with complete impunity, and the European spyware market is thriving, often through public money.Journalists, activists, human rights defenders and civil society have mobilised in response. This document pool brings together the essential resources to understand, track, and challenge spyware in Europe and internationally...
...In 2025, the EDRi network adopted a comprehensive position calling for a full ban on spyware in the European Union. The paper outlines the legal, technical and human-rights bases for this demand...
...the EU must take urgent steps to address the broader spyware ecosystem:
→ End the commercial spyware market by prohibiting the operation of spyware vendors and investors and the export of spyware from within the EU. This business model based on secrecy, vulnerabilities, and abuse must be dismantled to prevent further expansion of this industry.
→ End the vulnerabilities and exploit market by banning the commercial trade of vulnerabilities for these purposes. Public funding and procurement must no longer fuel the development of new exploits. Resources should instead be redirected toward coordinated vulnerability disclosure, good-faith researchers and cybersecurity strengthening
→ Ensure access to remedies for victims that have already suffered spyware abuse, by creating clear legal avenues for individuals to seek redress, including judicial remedies, reparation mechanisms, and state accountability for unlawful spyware use. The EU must also ensure effective investigation, prosecution, and sanctions against perpetrators and investors, including political and administrative accountability for public officials responsible for spyware abuses.