Journalists get new spyware protections in landmark EU media law

BRUSSELS (CN) — The European Union on Thursday rolled out sweeping rules designed to shield journalists from government spyware and protect news outlets from political interference, marking the bloc’s biggest attempt yet to safeguard freedoms as concerns mount about media independence across Europe.

The European Media Freedom Act — taking full effect across all 27 EU countries — creates the first continent-wide legal framework that explicitly bars governments from meddling in editorial decisions and sharply restricts when authorities can deploy surveillance technology against reporters.

The law essentially creates the first comprehensive EU-wide framework for media freedom, combining protection of journalistic independence with transparency requirements and safeguards against both state interference and Big Tech platform overreach.

The law takes effect as most EU countries grapple with serious media freedom problems. New data from the 2025 Media Pluralism Monitor shows the bloc’s average media pluralism risk score is 49% — a medium-risk level — with only Germany, Sweden, Denmark and the Netherlands ranked “low risk.” Twenty countries face “very high risk” levels of media ownership concentration, while several, including France, Germany and Sweden, carry “high-risk” ratings for journalist safety.

The timing isn’t coincidental. Press freedom advocates have raised increasingly urgent alarms about deteriorating conditions for media in several EU countries, including Hungary and Poland, where governments stand accused of weaponizing state resources to pressure critical outlets and using sophisticated spyware against journalists.

“Independent media are the backbone of any democracies,” said Michael McGrath, the EU’s top official for justice and democracy. “With the European Media Freedom Act entering into application, media and journalists across the EU gain unprecedented safeguards.”

The new rules get quite specific about what governments can and cannot do. Under the regulation, EU authorities are flatly prohibited from forcing journalists to reveal their sources or from using sophisticated surveillance technology on devices used by reporters, their sources or anyone who might have information about those sources.

There are exceptions, but they’re narrow: Surveillance software can only be used in cases involving serious crimes like terrorism, child abuse or murder — and only with prior judicial authorization. Even then, the measures must be regularly reviewed by courts.

But legal experts warn the surveillance protections may have significant gaps. The law might not prevent governments from hiring private companies to conduct surveillance, and includes broad exceptions for “compelling public interest” reasons that could include public security — potentially allowing governments considerable room to continue monitoring journalists.

The law also tackles a growing concern about online censorship. Major platforms with more than 45 million EU users — think Facebook, YouTube and X — must now give media companies advance warning before removing their content, allowing news organizations time to respond.

For American tech giants, this creates new compliance requirements including identifying media organizations, explaining content decisions and prioritizing media complaints. They’ll also have to publish transparency reports and engage in formal dialogues with media companies claiming unfair treatment.

But press freedom advocates say even these measures don’t go far enough. Pavol Szalai, EU head of Reporters Without Borders, calls the law “historical progress” but warns it’s insufficient to address platform power.

“Facebook and Instagram and others, they set the rules of the game globally for media,” he told Courthouse News on Friday. “It’s not the government or the media owners” who have the most influence over news distribution.

Media companies must also come clean about who owns them. Under the new rules, news outlets have to publicly disclose their ownership structures, including any government or foreign funding — information that must be “easily and directly accessible” to readers and viewers.

A new EU oversight board will coordinate enforcement and can weigh in on media mergers that might threaten news diversity. The merger oversight addresses a widespread problem, with 20 EU countries facing “very high risk” for media ownership concentration.

Still, the legislation faced pushback from some unexpected quarters.

Even some EU countries with strong press freedom records — including Germany, France, Denmark and Belgium — expressed skepticism about whether Brussels should be regulating media at all. German regional authorities were “particularly pronounced” in their opposition, viewing the law as an unnecessary intrusion into national sovereignty over media regulation.

The Netherlands, despite its “low-risk” status, reported 249 journalist harassment cases in 2024, while Germany and France both scored “high risk” for journalist safety, according to the data.

Some observers suggested the opposition was driven more by bureaucratic turf protection than genuine press freedom concerns, particularly among German regional media regulators reluctant to cede authority to Brussels.

Implementation challenges ahead

While civil society groups and journalism organizations largely welcome the protections, press freedom advocates warn the law’s success is far from guaranteed.

“We have serious concerns that many national governments lack both the preparation and political commitment to implement the necessary legislative changes,” a media coalition said in a joint statement Friday, despite countries having over a year to prepare. “This threatens to undermine the law’s effectiveness.”

The advocates noted that journalists can take governments to court for failing to implement the rules, even without new domestic legislation. But they stressed that meaningful enforcement depends on whether the European Commission — the EU’s executive branch — will pressure non-compliant governments.

Szalai echoed these implementation concerns, telling Courthouse News that Reporters Without Borders worries “there is not enough political will to put life into this legislation, and it will only stay a dead letter.”

The legislation represents a significant expansion of EU authority into media regulation, an area traditionally left to individual countries.

The regulation also reflects broader tensions within the EU about democratic backsliding, with media protections built on separate anti-SLAPP rules designed to help journalists fight back against abusive lawsuits aimed at bankrupting them into silence. Activists named the measures “Daphne’s Law” — after assassinated Maltese journalist Daphne Caruana Galizia — which came into force in May.

The timing was crucial — 11 EU countries currently have high-risk levels for such abusive litigation, while 21 nations still criminalize defamation.

Commission officials say the measures respond to documented threats to media independence, including government efforts to control news coverage through funding manipulation and regulatory pressure.

For American observers, the EU’s approach offers a striking contrast to the U.S. system, where press freedom protections rely heavily on constitutional rights and court precedents rather than detailed regulatory frameworks. The European model emphasizes proactive government obligations to protect media independence, not just restraints on official interference.

Implementation began in stages earlier this year, with the new EU oversight board launching operations in February. The phased rollout creates legal precedents, with some provisions that took effect earlier representing the first time EU law created positive obligations for governments to protect media pluralism.

Friday’s deadline means the core protections are now legally binding across Europe, but the real test will be whether governments actually follow through.